Claude Fable 5's New Safety Classifier: Blocking the Jailbreak in Over 99% of Cases
The jailbreak report that triggered Fable 5's suspension is now handled by a purpose-built classifier. Here is how the new safeguard works and what it means.
TL;DR
The jailbreak technique that led the US government to apply export controls on Claude Fable 5 is now blocked by a purpose-built classifier. Anthropic reports it stops the specific technique in over 99% of cases, and rather than refusing outright, blocked requests are rerouted to Claude Opus 4.8. Anthropic paired the announcement with a frank admission that no model can be made fully impervious to jailbreaks.
Background: The Report That Started It
On June 12, 2026, the US government applied export controls to Fable 5 and Mythos 5 following a jailbreak report from Amazon researchers. Anthropic reviewed the demonstrated technique and characterized it as surfacing a small number of previously known, minor issues - but the export directive forced a worldwide suspension regardless. Resolving the concern was a precondition for bringing the model back.
How the New Classifier Works
Anthropic trained a classifier that recognizes the specific bypass pattern from the report. When it fires:
- The flagged request does not reach Fable 5's unrestricted path.
- Instead, the request is handled by Claude Opus 4.8, a model with a longer safety track record.
- The user still gets a response, but through a safer route.
This "reroute rather than refuse" design mirrors Fable 5's original safety architecture, where cybersecurity classifiers already sent triggered queries to Opus 4.8. The new classifier narrows that net to the exact technique regulators were worried about.
Why "Over 99%" and Not 100%
Anthropic was unusually direct about the ceiling: "It is probably impossible to make any AI model fully robust (that is, impervious) to jailbreaks." A classifier is a statistical filter, so a determined adversary may still find edge cases. The honest framing matters - it sets expectations for defenders and avoids overclaiming a solved problem.
What It Means for You
For everyday users and developers, the classifier is invisible - normal requests are unaffected, and the reroute only touches the flagged pattern. For security teams, the takeaway is that Anthropic treated a single reported technique as a hard release gate, retrained a targeted defense, and shipped it before restoring general access. That is a useful data point on how frontier labs are handling capability-versus-safety tradeoffs in 2026.