Argues that most catastrophic outputs receiving press attention share the trait that someone deliberately tried to evade refusal, whereas Fable 5 produced briefing-worthy output from the most common prompt in modern developer workflow. Concludes that a decade of AI safety research has been optimizing for the wrong threat model if routine debugging prompts can elicit sensitive material.
Submitted The Register's report to HN where it reached 559 points, signaling that the practitioner community considers the absence of adversarial intent — not the model output itself — to be the newsworthy element. The submission framing emphasizes that feds were alarmed by a simple prompt, not a jailbreak.
Points out that jailbreak attacks require intent, technical sophistication, and multi-turn iteration, making the attacker population small, while the population of developers typing 'fix this code' into LLM-backed IDEs is in the tens of millions and growing. Argues this asymmetry means benchmark suites measuring adversarial resistance miss where deployment risk actually concentrates.
Reports the researcher's account that a four-word prompt produced material alarming enough to trigger government attention, treating the substantive content of the output — not just the simplicity of the prompt — as the news hook. The piece centers federal briefers' reaction as evidence the output crossed a meaningful threshold.
The Register reported on June 15 that the Fable 5 model outputs which reportedly alarmed federal briefers were not the product of an elaborate jailbreak, multi-turn role-play, or prompt-injection chain. According to the researcher who surfaced them, the prompt was four words: 'fix this code.' The model, given what looked like a routine debugging request, returned material substantive enough to trigger a closed-door government briefing.
The detail matters because it inverts the dominant narrative around model safety failures. Most catastrophic outputs that get press attention — jailbreaks of GPT-4, Anthropic's prompt-injection demos, DeepMind's adversarial prefix attacks — share one trait: somebody tried. The user crafted a prompt designed to evade refusal. Fable 5's case is the opposite. The user did the equivalent of typing into Cursor on a Tuesday afternoon.
The Hacker News thread (559 points) latched onto this immediately. Senior practitioners pointed out that the framing 'no jailbreak required' isn't a footnote — it's the whole story. If you can get model-safety-significant outputs from the most common prompt in modern developer workflow, then a decade of AI safety research has been optimizing for the wrong threat model.
For two years, the AI safety industry has organized itself around adversarial robustness. Red-team budgets, benchmark suites, and procurement checklists all measure how well a model resists deliberate attack — not whether it volunteers sensitive material in response to a developer's normal Tuesday. That distinction now matters more than any single jailbreak demo.
Consider the math of deployment. A jailbreak attack requires intent, technical sophistication, and usually multi-turn iteration. The population of users capable of executing one is small. The population of developers typing 'fix this code' into an LLM-backed IDE is, conservatively, in the tens of millions and growing every quarter. Cursor crossed $300M ARR before the Anthropic acquisition. GitHub Copilot has 1.8M paid seats. Cline, Aider, and Continue collectively serve hundreds of thousands more. If the failure mode is 'model overshares when asked benign questions about code that happens to sit near sensitive material,' then the surface area is the daily IDE session of every developer at every regulated firm in the country.
The Fable 5 incident exposes a measurement gap that the industry has been quietly aware of but has not addressed. Anthropic's Constitutional Classifier work, OpenAI's preparedness framework, and the various NIST-aligned eval suites all foreground adversarial inputs. They measure the model's resistance to manipulation. None of them centrally measure incidental disclosure: the rate at which a model, given a normal task, produces material it shouldn't. That's a fundamentally different metric, and harder to game because it doesn't reward defensive refusal training the way jailbreak benchmarks do.
There's also a procurement angle that matters more than the safety-research angle. Defense and intelligence community AI procurement leans heavily on jailbreak-resistance scores, often via third-party red-team reports filed under FedRAMP-adjacent processes. If a model can score in the 95th percentile on those benchmarks while still alarming federal briefers when asked to debug a function, the entire procurement signal is broken. Buyers will want a new metric. Vendors will need a new way to demonstrate it. And the consulting firms currently selling adversarial red-team services will have to retool their offerings or get displaced.
The deeper cause, as Hacker News commenters pointed out, is structural. A frontier model's training corpus inevitably contains material adjacent to dual-use code patterns: cryptographic implementations, parser logic, memory manipulation primitives, weaponizable libraries that happen to be on GitHub. The model can't unlearn that context. When a benign prompt activates a region of the embedding space close to that material, the model fills in helpfully. That's not a safety failure in the alignment-research sense — it's a competence side effect. Smarter models will have this problem more, not less.
If you operate an AI coding assistant in any sensitive domain — defense, financial infrastructure, healthcare with regulated PHI, or anything subject to ITAR/EAR — the Fable 5 incident is a forcing function. Output-side monitoring is no longer optional, and the monitoring can't be limited to 'did the user attempt a jailbreak' — it has to cover 'what did the model say.'
Practical steps that should already be on the roadmap, in order of cost:
First, log model outputs at the session level. Most teams log prompts and have weak telemetry on responses. Flip that. The interesting signal is what came out, not what went in. A prompt log tells you what the user wanted; an output log tells you what the model gave them, which is the only thing that matters for incidental disclosure.
Second, run a second-pass classifier on outputs that touch known-sensitive code patterns — anything involving cryptography, parsers, network protocols, kernel interfaces, or files originating from cleared repositories. Haiku-class models are cheap enough to run on every response without affecting latency budgets. The classifier doesn't need to be sophisticated; it needs to flag the 0.1% of outputs that warrant a human glance.
Third, scope your AI coding assistant deployment by repository, not by user. The risk isn't that a specific person is malicious; it's that a specific codebase is sensitive. Most current deployments are user-scoped — Alice gets Cursor, Bob doesn't — which is the wrong axis. Sensitive repos should run with restricted models or no AI assistance at all; commodity repos can use the frontier tier. This is the same lesson the DLP industry learned in 2014.
Fourth, and this is the harder cultural change, train developers to assume the model knows more than it should about adjacent topics. The current mental model is 'the model is a junior engineer.' A more accurate model is 'the model is a junior engineer who happens to have read every open-source security paper ever published and won't always remember which ones it shouldn't quote in the context of your codebase.'
Expect the next 12 months of AI safety eval work to pivot hard from adversarial robustness toward incidental disclosure measurement. The first vendor that ships a credible 'benign-prompt safety score' will reset the procurement conversation. NIST will follow with framework guidance, probably late 2026 or early 2027. Compliance teams at major defense contractors are already drafting internal standards that go beyond what NIST has published. The longer arc mirrors what happened with data loss prevention in the 2010s: started as blocking, evolved into monitoring with context-aware classification. AI output safety is going to walk the same path, except faster, because the deployment velocity of LLM-backed dev tools doesn't give anyone time to catch up. The teams that get ahead of this build their own output classifiers now, before the procurement standards force them to.
If you set aside political menace, this is a huge problem with Anthropic's strategy.You _cannot_ say that Mythos is super dangerous and can only be rolled out to certain people, but then release Fable with anything other than bulletproof cyber denials.Clearly with LLMs, bulletproof denials are
They weren't freaked by anything, it's a retaliatory shakedown after ideological differences and Anthropic not doing exactly what they're told/what the Admin wants them to do.
Also for all the people saying Amazon's part in this couldn't be fabricated, remember that Amazon is a "friend of the administration". During Andy Jassy's tenure, they paid $75MM (wildly outbidding everybody else) for a Melania documentary that grossed ~16MM, a move publicly
Here’s the blog post referenced in the article that’s written by the person who reviewed the paper that purportedly found a ‘jailbreak’https://www.lutasecurity.com/post/the-fable-5-export-control...
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Lol "fix this code" is beautiful.Like it basically jail broke the "no security vul guard rails" not in any clever way but just by fixing them, producing exploit code just by writing test cases making sure it's fixed. So you just need to look at the code & tests as a huma