Anthropic details Fable 5's cyber safeguards and proposes a jailbreak severity framework

What Anthropic published

Anthropic has posted a follow-up on Fable 5's cyber safeguards and jailbreak framework, released now that Fable 5 is back and available globally after a government-mandated suspension. The post does two things: it opens up the internal logic of the safety classifiers that gate Fable 5's cybersecurity behavior, and it proposes — jointly with Amazon, Microsoft, Google, and other Glasswing partners — a shared framework for scoring how severe a given jailbreak is.

Cybersecurity is the textbook dual-use domain for a model: the same capability that lets a defender find a vulnerability in their own codebase lets an attacker find one in someone else's. Anthropic doesn't block all cybersecurity activity in Fable 5 — that would gut its value to defenders — so the real engineering problem is drawing the line precisely enough that the model stays useful without becoming a force multiplier for attackers.

The four-tier classifier

Anthropic sorts cybersecurity requests into four bands, each with a distinct intended classifier behavior:

• Prohibited use — ransomware, wipers, cyber-physical sabotage against power/water/medical systems, malware development, C2 infrastructure, BGP/DNS/CA-level attacks. Blocked outright. The justification is asymmetry: these capabilities offer attackers far more than they offer defenders.
• High-risk dual use — exploitation, credential attacks, privilege escalation, exploit development, VM/container escapes, and assessments against ICS/SCADA, telecom core, or financial infrastructure. Normal red-team and pentest work, but Fable 5 blocks it until Anthropic has better controls to verify who's asking. This tier also covers "high-uplift" vulnerability finding — bugs other widely available models can't find; if only Fable can surface a class of vulnerability, Anthropic treats that as a capability gap worth closing, even though disclosure is broadly a public good.
• Low-risk dual use — OSINT, enumeration of public services, protocol testing. Mostly allowed, with some blocked as part of a deliberate "safety margin" that trades false positives on benign requests for catching more actual jailbreaks.
• Benign use — core defensive and IT work. Allowed, monitored.

The safety-margin framing is worth sitting with. Anthropic is explicit that Fable 5's margin is set wider than prior models', meaning more legitimate defensive requests get blocked as collateral — a real cost to security teams, and one Anthropic is naming rather than burying in an aggregate accuracy number.

A shared vocabulary for jailbreak severity

The second piece is the more consequential one long-term: a draft framework, built with Glasswing partners, for describing how bad a jailbreak is. The proposed axes are capability gain (how much more can the jailbroken model do), breadth (how many harmful behaviors does it unlock), weaponization ease (how much additional work is needed to turn output into actual harm), and discoverability (how hard is the jailbreak to find and how likely to spread).

This matters because there's no common unit today for "a jailbreak was found." A prompt that shaves an hour off writing a phishing email and one that reliably produces working exploit code for an unpatched CVE are both "jailbreaks," but they aren't the same event. A shared severity scale lets a lab talk to a regulator, or to another lab, without re-litigating the taxonomy each time. Anthropic paired the framework with a HackerOne program for researchers to submit cyber jailbreaks in Fable 5 — a scale is only useful once someone's triaging real submissions against it.

My take

I read this as Anthropic responding to the accountability gap a government-mandated suspension exposes: when a regulator pulls access to a frontier model, "trust us" isn't an adequate answer to "what exactly are you blocking, and how do you know a bypass is serious?" Publishing the classifier taxonomy and a cross-vendor severity framework turns an internal safety judgment call into something inspectable, and eventually auditable against other vendors' numbers. For teams building on Claude in security contexts, the practical takeaway is narrower: expect the safety margin to reject some legitimate defensive queries by design, and if your pentest or SOC workflow leans on Fable 5, budget for the high-risk dual-use tier staying closed until Anthropic ships the access controls it says are coming.