Anthropic strengthens Fable 5's AI defenses

Anthropic has redeployed Claude Fable 5 globally and detailed how it is trying to prevent the model from being used for cyberattacks. The company also proposes a scale for measuring the severity of jailbreaks, meaning techniques that force an AI to ignore its safety limits.

The decision comes after Fable 5 returned to service on July 1. It is now available to all users, while Anthropic explains which cybersecurity requests it blocks, which it allows, and how it plans to assess failures that manage to bypass its defenses.

Four levels for cybersecurity tasks

The problem is that many security tools have dual uses. Analyzing code to find a vulnerability can help protect a company, but it can also be the first step toward attacking it.

That is why Fable 5 does not block every cybersecurity-related question. Its classifiers, systems that detect the risk of a request, divide requests into four groups:

• Prohibited use: actions such as creating ransomware, stealing data, evading antivirus software, deploying malware, sabotaging physical systems, or attacking Internet infrastructure. These are blocked.
• High-risk dual use: penetration testing, privilege escalation, lateral movement, exploit development, or attacks against industrial networks, telecommunications, and financial systems. These are also blocked for now.
• Low-risk dual use: reviewing public systems, looking for vulnerabilities that other tools already detect, or testing cryptographic protocols. These are allowed in many cases, although they are monitored and some requests are blocked as a precaution.
• Benign use: fixing code, analyzing logs, managing networks and clouds, applying patches, investigating incidents, or reverse-engineering malware. The intention is to allow these tasks, although false positives may occur.

The most delicate boundary involves vulnerability discovery. Anthropic wants Fable 5 to find known flaws or vulnerabilities that other tools can already detect, but it intends to block the discovery of complex vulnerabilities that no available model can find yet. It also blocks the automatic generation of functional exploits.

Protection does not depend on a single filter. Anthropic combines classifiers with access controls, safety training, and offline monitoring. It also acknowledges that the so-called safety margin can block some legitimate requests: the wider that margin is, the harder it is for a dangerous request to get through, but incorrect blocks also increase.

A scale for measuring jailbreaks

Anthropic proposes a scale called Cyber Jailbreak Severity, or CJS, so companies, researchers, and governments can describe a jailbreak using common criteria. The scale runs from CJS-0, informational, to CJS-4, critical.

The score combines four factors:

• Capability gain: how much more an attacker can do because of the jailbreak compared with the tools that already exist.
• Scope: whether it works for a single task or across many attack categories.
• Ease of turning it into an attack: how much work and knowledge are needed to use it.
• Ease of discovery: whether it requires specialized research or is already published and available to anyone.

A public jailbreak that disables all protections with a single instruction would receive the CJS-4 category. By contrast, a technique that only extracts a known text string from a security tutorial could remain at CJS-0 because it does not give the attacker a new capability.

The scale is not linear. Each level represents a significant jump in risk. Anthropic can also raise the category if the flaw allows the discovery of a critical vulnerability, has no nearby fix, or can be combined with other known issues.

What changes for you

For a typical user, the most visible effect will be that some cybersecurity requests are rejected even when they have a legitimate explanation. An administrator may be able to ask for help analyzing logs or correcting a configuration, but not necessarily for automating an intrusion or developing an exploit during an authorized test.

Anthropic presents the system as a draft and is asking researchers, governments, and civil society organizations for feedback. It has also opened a program on HackerOne for researchers to report potential jailbreaks in Fable 5.

The question to watch is whether these filters can reliably distinguish defense from attack without turning security assistance into a series of blocks. As models become more useful for finding flaws, measuring that boundary with shared criteria will be just as important as improving the model.