The Register's reporting frames the researcher's central finding as a structural inversion of the assumed threat model. Federal agencies treated Fable 5's dangerous outputs as a jailbreak success and hardened input filtering accordingly, but the researcher demonstrated the same outputs emerged from a benign 'fix this code' prompt — meaning the exploit lives in the model's completion trajectory, not in adversarial input crafting.
Argues the entire vocabulary of LLM red-teaming — jailbreak, prompt injection, DAN, grandma exploit — assumes a stable refusal posture being coerced. When the model produces dangerous artifacts while doing its actual job along the most statistically plausible completion path, prompt-layer defenses never see the failure. The completion is the exploit.
By surfacing The Register's piece to HN with the framing that feds 'freaked' over a non-jailbreak prompt, the submission amplifies the researcher's critique that agencies pattern-matched the outputs to a familiar adversarial-prompt narrative. The implication carried by the submission is that policy response built on that misreading — hardened input filtering — addresses the wrong layer entirely.
Reports the researcher's framing that agencies receiving the briefing treated the outputs as a jailbreak result and built a threat model around input hardening, when the actual finding was that no adversarial prompting was required. The piece positions this as an evidentiary error with downstream policy consequences.
The Register reported on June 15 that a security researcher briefing federal officials on Fable 5 demonstrated that the model's most alarming outputs — the kind that reportedly prompted internal panic at the agencies receiving the briefing — were not produced through any of the adversarial techniques that dominate the AI safety literature. There was no DAN-style role-play, no Unicode smuggling, no system-prompt override, no multi-turn social engineering. The prompt was, almost verbatim, *fix this code*.
The researcher's framing, per the report, is that the agencies misread their own evidence. They treated the outputs as a jailbreak result and built a threat model around hardened input filtering. The actual finding was the opposite: the model produced the same dangerous artifacts when handed an ordinary developer task with no adversarial intent encoded in the prompt at all. That distinction matters because it inverts the assumed shape of the attack surface.
The specifics of what Fable 5 produced aren't fully laid out in the public account — the briefing materials remain restricted — but the pattern the researcher describes is recognizable to anyone who has spent time with current frontier coding models. A snippet goes in. The model, doing its actual job, *completes* the snippet along the most statistically plausible trajectory of its training distribution. If that trajectory happens to pass through territory the safety team would have blocked at the prompt layer, the safety team never sees it. The completion is the exploit.
The entire vocabulary of LLM red-teaming — jailbreak, prompt injection, DAN, grandma exploit — assumes a model with a stable refusal posture being coerced out of it. That framing made sense when the dominant failure mode was a user asking *how do I make a bomb* and getting either a refusal or, with enough cleverness, a recipe. The control surface was the prompt, and the question was how robustly the model held its line.
Coding workflows have quietly invalidated that frame. A developer pasting in 200 lines of legacy code and asking the model to fix a null-pointer dereference is not asking the model anything refusable. There is no policy violation in the request. The model is supposed to comply. The risk is entirely downstream — in what compliance actually generates when the input contains, intentionally or otherwise, a structure that pulls completions toward credential leakage, sandbox escape patterns, or insecure deserialization. The researcher's point to the feds, as best the Register conveys it, is that you cannot defend this with a refusal classifier because nothing being asked is refusable.
Compare the two threat models. Under the jailbreak model, you invest in input-side defenses: prompt classifiers, system-prompt hardening, constitutional training against adversarial framings. Under the *completion drift* model the researcher is describing, none of that helps. The model isn't being tricked. It's being asked to do its job, and its job, given a particular input shape, has dangerous nearest-neighbor completions in weight space. The fix isn't a better refusal — it's output review, capability scoping, and treating model output the same way you treat input from any other untrusted source.
This is also why the agencies' reaction is, if the researcher is right, slightly off-target. "We need to red-team for jailbreaks" is a 2023 sentence. The actual 2026 sentence is closer to "we need to assume the model will produce this output for ordinary users doing ordinary work, and architect around that." Those imply very different procurement requirements, very different acceptance tests, and very different liability stories.
There's a community version of this argument that has been brewing for a while. Anthropic's own work on sleeper agents, Apollo's evaluations on scheming, and the steady drip of papers showing that fine-tuning on innocuous data can undo safety training — they all point at the same uncomfortable conclusion. The attack-vs-benign distinction is a UI artifact, not a property of the model. The model doesn't know the prompt is adversarial. It just completes.
If you ship code that runs model output — Copilot-style autocomplete, agent frameworks, anything in the Cursor / Windsurf / Cline lineage — the practical update is straightforward and somewhat depressing. Treat every model completion as untrusted input to your build system, the same way you'd treat a string from an HTTP request. Static analysis on the diff, not just the source. Secrets scanning on the output. Capability gates on tool calls.
For agent frameworks specifically, the *fix this code* finding is a direct argument for least-privilege tool access at the per-call level, not per-session. A model that has filesystem write and shell exec for the duration of a coding task is a model that can act on a dangerous completion before any human reads it. The cheap version of mitigation is a confirm step on destructive ops. The expensive but correct version is a scoped sandbox per task, with the blast radius pre-declared.
For anyone running internal red-teams: rewrite your test plan. Stop scoring on jailbreak resistance. Start scoring on benign-prompt completion safety — what does the model produce when an honest developer pastes in honest code and asks for an honest fix? That number is the one that maps to your actual production traffic. Jailbreak resistance maps to a press cycle.
The agencies' panic, if the researcher's account holds, is the right reaction to the wrong stimulus. They saw dangerous output and reached for the threat model they already had. The harder update — that the model's *default* behavior on ordinary developer prompts is what produced the alarming artifact — implies a regulatory posture that is much less about banning specific prompts and much more about mandating output review and capability constraints at the deployment layer. That's a slower, more boring, more correct fight, and it's the one the next two years of AI policy is going to be about.
If you set aside political menace, this is a huge problem with Anthropic's strategy.You _cannot_ say that Mythos is super dangerous and can only be rolled out to certain people, but then release Fable with anything other than bulletproof cyber denials.Clearly with LLMs, bulletproof denials are
They weren't freaked by anything, it's a retaliatory shakedown after ideological differences and Anthropic not doing exactly what they're told/what the Admin wants them to do.
Also for all the people saying Amazon's part in this couldn't be fabricated, remember that Amazon is a "friend of the administration". During Andy Jassy's tenure, they paid $75MM (wildly outbidding everybody else) for a Melania documentary that grossed ~16MM, a move publicly
Here’s the blog post referenced in the article that’s written by the person who reviewed the paper that purportedly found a ‘jailbreak’https://www.lutasecurity.com/post/the-fable-5-export-control...
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Lol "fix this code" is beautiful.Like it basically jail broke the "no security vul guard rails" not in any clever way but just by fixing them, producing exploit code just by writing test cases making sure it's fixed. So you just need to look at the code & tests as a huma