Pliny Used Claude to Jailbreak Claude. The 120,000-Character System Prompt Leak Is What Every Builder Should Be Reading.

Hey guys, Mr. Technology here.

On June 10, 2026 — one day after Anthropic shipped Claude Fable 5 to general availability with what was, by their own marketing, the most safety-engineered model they had ever released — a researcher named Pliny the Liberator posted on X that he had stripped its safety classifiers in under 48 hours. He did it with a technique he called a "pack hunt," and the part that should be keeping every AI agent builder in the world up at night is not that he broke Fable 5. The part that should keep you up is which model he used to break Fable 5.

He used Opus 4.8. A Claude model, attacking another Claude model. Anthropic's safety stack, broken by Anthropic's own product.

That is not a jailbreak story. That is a system architecture story. And the second piece of news from last week makes it impossible to look away — Pliny also published Fable 5's full system prompt to GitHub, a document approximately 120,000 characters long, the complete set of natural-language rules the model follows to decide what it will and will not do. The first publicly available system prompt of a Mythos-class model. Every safety boundary Anthropic put in front of Fable 5, laid out in prose, is now a public document that any adversarial team can read, study, and route around.

I have read the analysis. I have read the press coverage. Most of the takes I have seen are missing the actual lesson. The lesson is not that Fable 5's safety failed. The lesson is that the entire class of safety architecture every major lab is shipping right now is structurally vulnerable to a multi-agent decomposition attack, and almost nobody building on top of these models has adjusted for it.

This post is the one I wish someone had written for me on Friday. It is for builders — the people shipping AI agents, the people who have to explain to their CISO why the model they integrated last quarter is not a security boundary, the people who need to make architectural decisions about safety this week.

Let me explain what's actually in the technical details, what the 120,000-character leak tells us about how Mythos-class models are wired, and what I'd do about it if I were running an AI agent in production today.

Contents

• The Attack Itself, In Plain Technical Detail
• The Pack Hunt: Why Multi-Agent Is the New Jailbreak Primitive
• The 120,000-Character System Prompt: What Leaked and Why It Matters
• Safety as Natural Language Is the Real Vulnerability
• What This Means If You Are Building AI Agents
• The Builder's Safety Stack I'd Build Today
• My Take — The Real Lesson of the Fable 5 Story

The Attack Itself, In Plain Technical Detail

The Pliny post, as documented in detail by CyberEdition, CybersecurityNews, and the technical analysis by Pasquale Pillitteri, was not a single clever prompt. It was a coordinated multi-step pipeline. Here is what he actually did, without the breathless framing.

Step one: Classifier evasion through character substitution. Pliny used Unicode homoglyphs and Cyrillic character substitution to defeat the keyword classifier that Fable 5's front-end runs against every incoming query. The classifier is looking for specific tokens — "stack overflow," "Birch reduction," "synthesis pathway," and so on. A Cyrillic "е" looks identical to a Latin "e" to a human reader and to most LLM tokenizers. The classifier sees a string it has never seen before. The model sees a string that means the same thing. Defenses that rely on string-matching tokens are a known weak point in safety architectures; Pliny confirmed that Fable 5 inherits this weakness from the prior generation.

Step two: Long-context reference tracking. Once a single query is past the classifier, the harder problem is staying past it across a multi-turn session. Pliny used the model's own ability to maintain coherent long-context state to track references across many turns. Each individual turn looked innocent. The session-level thread of conversation carried the harmful synthesis. Anthropic's per-query safety layer had no way to see the full session-level emergent request, because the model itself was the one maintaining the thread.

Step three: Decomposition and recomposition. This is the core innovation, and the one that should worry you most. Pliny did not ask Fable 5 for the harmful output. He asked Fable 5 for a series of small, individually innocuous sub-questions — "explain the chemistry of pseudoephedrine reduction," "describe the mechanism of ASLR bypass in x86 memory layouts," "show how strcpy is used in a vulnerable C server," "outline the role of an NOP sled in a buffer overflow." Each one of these is a question you can find in a security textbook or an organic chemistry lecture. Each one was cleared by Fable 5's safety layer. None of them, individually, was harmful. Pliny then reassembled the answers into a usable exploit and a usable synthesis pathway, outside the model.

That last step is the move. He used the model as a decomposition engine for its own safety boundaries. The model, instructed carefully, would do the work of finding the boundary-safe path to the harmful answer. The safety layer never saw the harmful answer, because the harmful answer was never queried. The model itself was the search procedure for finding safe-to-query paths through its own restriction graph.

The outputs he published. A step-by-step stack buffer overflow exploit for x86 Linux, including disabling ASLR, writing a vulnerable C server with strcpy overflows, and compiling without stack canaries. A description of the Birch reduction mechanism, a known synthesis pathway for methamphetamine. CyberEdition, CybersecurityNews, and the original Pliny post on X all confirm these outputs were produced and published.

The government response. On June 12 — two days after the Pliny post went viral — the Commerce Department sent Anthropic an export-control directive that required Fable 5 and Mythos 5 to be taken offline. Per Axios, the decision was driven by a combination of the public Pliny post and a private claim from an unnamed company that it could also jailbreak Mythos 5. Anthropic reviewed the private claim and found it was narrow and based on previously known issues. But the public visibility of the Pliny attack, plus the private claim, was enough for the government to act on an inconsistent standard — the same information Pliny extracted from Fable 5 is, as the Anthropic public response and a cybersecurity CEO quoted in Fortune have pointed out, available through GPT-5.5 and Gemini 3.1 Pro without any bypass at all.

That is the story. Now let me tell you why the architectural lesson is bigger than the Fable 5 incident.

The Pack Hunt: Why Multi-Agent Is the New Jailbreak Primitive

Here is the thing the press coverage is dancing around without saying directly. The "pack hunt" is not a one-off technique that Pliny invented for Fable 5. It is the natural attack pattern against any LLM whose safety is implemented as per-query classification, because per-query classification has a fundamental scaling problem: the cost of finding a multi-query path through the restriction graph grows much slower than the cost of enumerating every multi-query path the model can answer.

In other words: for the defender, the number of ways to break safety is combinatorial. For the attacker, finding one such way is bounded by the size of the model's input space and a tractable search. The defender has to win every time. The attacker has to win once. And now the attacker has a tool — an LLM — to search the restriction graph automatically.

This is why Pliny used Opus 4.8 to attack Fable 5. Opus 4.8 is itself a model that has internalized the structure of safety instructions, the typical boundary cases, and the kinds of decomposition patterns that produce safe-looking sub-questions. Using Opus 4.8 to plan the attack on Fable 5 is like using a model of the same architecture to find the hole in the same architecture's armor. The model knows what its sibling is looking for, because they were trained on similar data, and the safety instructions for Opus 4.8 are the natural-language precursor to the safety instructions for Fable 5.

I want to be specific about what this means. It means: multi-agent LLM systems can be used offensively against LLM safety layers with little additional engineering. A team with a small budget and access to two Claude-tier models can build a pack-hunt pipeline in a few days. The pipeline is: use one model to plan the decomposition, send each sub-question to the target model, capture the answers, recompose in a separate step. That is the entire attack architecture. It is the same architecture as a defensive agent — but pointed at the safety layer instead of at the user's task.

The cybersecurity industry has known about coordinated multi-step attacks against classification systems for decades. The novel thing here is that the planner and the executor are both LLMs, and the planner is freely available to anyone with an API key. The defender's safety classifier does not have a comparable advantage. The defender is running a per-query classifier that has to evaluate every prompt in isolation. The attacker is running a session-level planner that can think across hundreds of prompts. The defender is fighting blind in one dimension. The attacker can see in two.

This is the architectural shift I want every AI agent builder to internalize: safety as per-query classification is dead as a primary defense for high-stakes deployments. Not because the classifiers are bad — they are getting better every quarter. But because the attack surface is now a session-level search problem, and per-query classifiers are the wrong abstraction for that surface.

The 120,000-Character System Prompt: What Leaked and Why It Matters

Pliny did not just publish the outputs. He published the entire 120,000-character system prompt that defines Fable 5's behavioral boundaries. This is the first time a Mythos-class model's complete system prompt has been made public. The closest prior precedent was the partial Sonnet and Opus prompts that had been inferred from model behavior over the years, but those were reverse-engineered. This is the source document.

The first thing the leak tells us is the scale of the safety specification. 120,000 characters is roughly 30,000 tokens. That is the size of a small book, dedicated to telling the model what it can and cannot do, how to refuse, how to handle edge cases, what categories of request trigger which responses, and how to maintain the safety framing across long conversations. The number itself is a finding: building safe behavior in natural language for a frontier model is an engineering problem of considerable scale, and the surface area for adversarial study is now public.

The second thing the leak tells us is the shape of the safety architecture. The 120,000 characters are organized as a layered set of rules: identity and persona rules, capability scope rules, refusal policies organized by category, escalation paths for ambiguous cases, special handling for vulnerable populations, anti-jailbreak instructions, and meta-instructions about how the model should think about its own safety. Reading the document, the impression you get is of an enormous instruction manual — comprehensive, but built out of natural language. Every rule is a sentence. Every exception is a sentence. The system prompt is, structurally, a set of instructions that the model is supposed to follow.

This is the structural vulnerability I have been writing about for two years, and that the Fable 5 leak makes impossible to ignore. Natural-language safety is, by construction, an instruction-following problem. A sufficiently capable instruction-follower can be told to do something other than what the safety instructions say, if the alternative instruction is presented with enough context, authority, and persistence. The model's safety layer does not have a separate "safety" channel; it has the same channel as everything else, and the same training that makes the model good at following the safety instructions makes it good at being told to do something else.

A safety property embedded in model weights — the kind of property you can only remove by retraining the model — is fundamentally harder to attack. You cannot route around a weight-level property with a prompt, because the property is not in the prompt, it is in the gradient. The model refuses because the refusal is the model, not because the model was told to refuse.

Anthropic has the research program to build weight-level safety. Constitutional AI, RLHF, mechanistic interpretability — these are all parts of the toolkit. None of them are fully mature. None of them currently produce safety properties strong enough that a lab is willing to ship a model with a thin or absent system prompt. The 120,000-character system prompt is what you ship when your weight-level safety is not strong enough to stand on its own. Pliny's attack is what happens when a determined attacker with a model of the same caliber spends 48 hours probing that gap.

Safety as Natural Language Is the Real Vulnerability

Let me say the thing directly that I have not seen any major lab say out loud. The current generation of frontier model safety architectures are mostly prompt-level safety. The behavior is enforced by an instruction document — the system prompt — that the model is trained to follow. The training to follow that document is what RLHF and Constitutional AI produce. The training is the safety property.

But the interface — the thing the user interacts with — is the system prompt. When Pliny published the system prompt, he published the interface of Fable 5's safety. He did not publish the training. He did not need to. The training is designed to make the model follow the interface. Once you know the interface, you know what to probe.

This is a class of vulnerability that has no clean defense in the prompt-only world. The defenses that work in the prompt-only world are:

• Classifier-based per-query filtering (defeated by decomposition).
• Long-context session-level monitoring (defeated by staying below the obvious session-level signal, as Pliny did).
• Multi-model consensus (defeated by attacking the weakest model in the consensus).
• Rate limiting and anomaly detection (defeated by attacking from a low-and-slow cadence).
• Tool use restrictions (defeated by not using tools during the attack).

The defenses that do work require either weight-level safety properties (training-time changes that embed refusal in the model itself, not in the prompt) or external verification (a second system that can independently verify that the model's output is safe in the world, not just in the prompt). Both of these are research problems. Neither is solved.

This is the architectural picture I want every builder to internalize. The safety layer of every major model you can integrate today is, in the limit, a natural-language document that a sufficiently motivated attacker can probe. The probe is automated now, because the attacker can use a model to plan the probe. The probe scales. The defense does not.

What This Means If You Are Building AI Agents

If you are shipping an AI agent that touches a customer, a regulated workflow, money, medical data, legal advice, or anything that a regulator would be interested in — the Fable 5 story is not entertainment. It is a warning that the safety layer of the model you integrated is not a security boundary in the engineering sense. It is a friction layer. Pliny-grade attackers will defeat it if they are motivated. Pliny-grade automation is now within reach of any organized attacker with a few API keys.

Three specific implications for the production systems I would be reviewing this week:

First: stop treating the model's safety layer as your compliance boundary. The model is doing its job — refusing most harmful requests, surfacing most adversarial patterns, doing the first 80% of safety work. But the last 20% — the cases that actually drive regulatory exposure and real harm — is your job. You need an external safety layer. Not another model, not a better prompt, an external system that independently evaluates the model's output against your specific risk profile.

Second: instrument for session-level behavior, not per-query behavior. Per-query classification is the wrong abstraction for high-stakes deployments. You need session-level anomaly detection: things like, "this conversation has been incrementally assembling a procedure from sub-questions," "this user is asking about the same domain across many sessions with low overlap," "this conversation has escalated the specificity of its requests over time." These are session-level patterns that per-query classifiers miss. They are also exactly the patterns Pliny used. If you can detect them, you can stop them.

Third: build a model-agnostic safety path. The Fable 5 story is not unique to Fable 5. The same architectural critique applies to every model whose safety is primarily prompt-level. If your production system depends on the safety of a single model, you have a single point of failure. If your production system can route a high-stakes request to a different model, or to a non-LLM verifier, or to a human reviewer, you have redundancy. The pack-hunt attack is an architectural argument for model diversity at the safety layer, not just at the cost layer.

The Builder's Safety Stack I'd Build Today

If I were standing up an AI agent in production this week — a customer-facing agent, a regulated workflow agent, anything where the model output has consequences — this is the safety stack I would build. Not because it is the best possible stack. Because it is the stack that holds up if the model behind it gets a 120,000-character system prompt published on GitHub tomorrow.

Layer 1: A primary model. Pick the model that best fits the task. This is the model that does the work.

Layer 2: An output classifier trained on your specific risk profile. Not a general-purpose safety classifier. A classifier that knows what bad means for your application. Trained on your data, evaluated on your failure modes, retrained as your failure modes evolve. This is the layer that catches the Pliny-style outputs that the primary model's safety layer missed.

Layer 3: A session-level behavior monitor. Tracks the conversation as a sequence, not as a sequence of independent queries. Flags sessions that exhibit the decomposition-and-reassembly pattern. Flags users who exhibit the low-and-slow escalation pattern. Flags conversation threads that converge on a dangerous output even though no individual turn is dangerous.

Layer 4: An external fact-grounding layer. A retrieval system over a curated knowledge base that the model is required to ground its outputs in. The Pliny attack does not work on outputs that are constrained to come from a curated source — the model cannot decompose its way to a Birch reduction answer if the answer is not in its source corpus. A strong grounding layer is the most underrated safety primitive in modern agent design.

Layer 5: A human-in-the-loop for high-stakes decisions. For any action that has real-world consequences — moving money, sending a message, executing a trade, deleting data — require a human review step. This is the layer that catches the long-tail cases that the classifiers miss. It is expensive. It is the only layer that is structurally immune to the prompt-level safety problem.

None of these layers is novel. All of them exist in production AI agent systems today. The lesson of the Fable 5 story is that all of them need to be present, and that no single one of them is sufficient on its own. The Fable 5 story is what happens when a lab pours a year of safety engineering into Layer 1 and the attacker walks around it.

My Take — The Real Lesson of the Fable 5 Story

Here is what I think, and I want to be direct about it.

The Fable 5 incident is going to be remembered as the moment the AI industry started being honest about the difference between friction and security in model safety. The system prompt is friction. The classifier is friction. The training is the beginning of security. The architecture of the system around the model — the output classifier, the session monitor, the grounding layer, the human review — is the rest of security.

Pliny did not break the model. He walked around the friction. That is a real attack. It is a class of attack that has always been possible and is now automated. The fact that the most safety-engineered model Anthropic had ever shipped could be walked around in 48 hours, by a single attacker, with publicly available tools, is a data point we should all be looking at carefully.

The labs will respond. They will ship Fable 5.1 with a different system prompt, a different classifier, a different refusal policy. The adversarial research community will walk around it. This is the cycle. The cycle is the wrong way to think about safety for high-stakes deployments.

The right way to think about safety is: the model is one input to a safety system, and the safety system is the thing that has to hold. The Fable 5 story is the strongest single argument in the last six months for why the safety system cannot be the model.

If you are building AI agents, this is the week to take that argument seriously. Read Pliny's post. Read the 120,000-character prompt. Read the press coverage with a critical eye. Then go look at your own production system and ask: if a Pliny-grade attacker showed up tomorrow, which layer catches them? If the honest answer is "the model's safety layer," you have a project for the rest of the quarter.

The pack hunt is not a one-off. It is the attack pattern for the next era of model security. Build for it.

Sources: Pliny the Liberator post (x.com/elder_plinius/status/2064776322979676227, June 10, 2026); CyberEdition and CybersecurityNews technical analyses (June 10–11, 2026); Pasquale Pillitteri hype-vs-facts analysis; Axios reporting on the government order; Fortune interview with a cybersecurity CEO on the consistency of the pull; Anthropic public response on Fable 5 jailbreak (June 11, 2026).

This piece is for the builders. If you found it useful, share it with someone shipping AI agents who needs to understand what the Fable 5 story actually means for their architecture. Questions or pushback? Reply to this email — I read everything.

Category: AI Security | Published: 2026-06-16