Tool · curated 24 Jul 2026
system_prompts_leaks/Anthropic/claude-fable-5.md at main · asgeirtj/system_prompts_leaks · GitHub
First reported · updated · 5 reports github.com
Coverage timeline
Why it matters
Leaked system prompts give researchers and adversaries insight into a model's hidden instructions and guardrails, aiding both defensive study and the crafting of prompt-injection or jailbreak attacks against deployed LLMs.
A GitHub repository (asgeirtj/system_prompts_leaks) hosts an extracted/leaked system prompt file for Anthropic's Claude Fable 5, part of a broader collection of leaked LLM system prompts. Anthropic's own announcement describes Fable 5 and the cyberdefense-oriented Mythos 5 (Project Glasswing) as models with state-of-the-art capabilities gated by conservative safeguards.
Summary
This dossier analyzes public reporting on a leaked ("extracted," not hacked) copy of the system prompt driving Anthropic's Claude Fable 5, published via the openly licensed asgeirtj/system_prompts_leaks GitHub repository and dissected in an Analytics Vidhya breakdown. The document is characterized as a roughly 3,826-line, deeply nested XML instruction layer governing tone, refusals, wellbeing, memory, tools, artifacts, and search behavior.[0]
The reporting is corroborated by Anthropic's own launch announcement, which confirms Fable 5 launched on 9 June 2026 as a Mythos-class model made safe for general use, sharing weights with the more permissive Claude Mythos 5, and using conservative safeguards that reroute high-risk queries (such as cybersecurity) to Claude Opus 4.8 in under 5% of sessions.[0][6]
This is not an exploited vulnerability or an attacker campaign. The security-relevant substance is defensive: the prompt embeds prompt-injection resistance (distrusting forged system reminders and memory-smuggled instructions) and a layered guardrail model, illustrating how frontier-model operators design refusals, routing, and injection defenses.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-06-09 | Anthropic launches Claude Fable 5 (Mythos-class) and Claude Mythos 5.[0][6] |
| June 2026 | A near-complete copy of the Fable 5 system prompt surfaces on GitHub via the asgeirtj/system_prompts_leaks repository.[0] |
| 2026-06-12 | Anthropic suspends access to Claude Fable 5 and Claude Mythos 5.[6] |
| 2026-07-01 | Anthropic redeploys Claude Fable 5 and Mythos 5.[6] |
| 2026-07-15 | Analytics Vidhya publishes its breakdown of the leaked Fable 5 system prompt.[0] |
How it works
The reporting describes system-prompt extraction as a class of weakness: large language models can be coaxed into reciting their own hidden instruction layer, which is how the Fable 5 prompt was obtained without a conventional hack.[0]
The prompt itself documents prompt-injection risks it must resist: forged "system reminders" pasted into user input that attempt to loosen rules, and instructions covertly stored in memory (e.g. "always agree," "never criticise") that the model is instructed to ignore.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Claude Fable 5 (and Claude Mythos 5, same weights) | System prompt for Fable 5 inside the Claude app; a near-complete copy was exposed publicly. | Not a patchable software defect; Anthropic suspended access on 12 June 2026 and redeployed on 1 July 2026 for operational reasons.[0][6] |
Key takeaways
- A leaked system prompt is a rulebook, not the model itself—the capabilities live in the weights, while the prompt encodes operator policy on tone, refusals, tools, and limits.[0]
- Frontier-model safety is implemented in layers: explicit refusals that state a principle rather than the detection logic, classifier-based rerouting of high-risk queries to a more constrained model, and built-in distrust of injected reminders and memory.[0][6]
- System-prompt extraction is a realistic exposure vector—models can be induced to recite their hidden instructions—so operators should assume prompt contents may become public and avoid placing secrets in them.[0]
Defensive actions
- Treat any "system reminder" or similar authoritative-looking text pasted into user input as untrusted and do not let it relax model guardrails.: The Fable 5 prompt explicitly warns that forged system reminders may try to loosen the rules and instructs the model to distrust them, a defense builders should replicate in their own agent designs.[0]
- Prevent stored memory or long-term context from carrying executable instructions to the model and ignore imperative directives embedded in retrieved notes.: The prompt notes stored notes could smuggle instructions such as "always agree" or "never criticise" and is told to ignore them, mitigating memory-based prompt injection.[0]
- Layer safeguards rather than relying on a single refusal wall—combine refusals, topic classifiers that reroute high-risk queries, and injection distrust.: The analysis frames the guardrail as "not one wall but several thin ones," and Anthropic confirms a classifier reroutes high-risk topics to Opus 4.8 in under 5% of sessions.[0][6]