Article Overview
When Fable 5 was redeployed at the end of June after the US government export control episode, two questions hung in the air. First: had the new classifiers actually held? Second: was there a smarter way to measure cybersecurity risk than the blunt binary of "can this model discuss hacking or not?"
On August 4, 2026, Anthropic answered both. After several weeks of monitoring and reviewing every report submitted through the new HackerOne bug bounty program, they have found no significant jailbreaks in Fable 5. The only techniques observed are low-severity cases — ones where weaker, widely available models can produce the same output, meaning the attack capability is not meaningfully higher than what already exists.
On the measurement question, Anthropic introduces something more important than the status update: a new evaluation framework built around a concept called uplift — measuring not whether an AI model can discuss a cybersecurity task, but whether it materially increases a realistic attacker's chance of success. A shellcode obfuscation example reveals data that will change how many people think about this problem: without hacking tools, the model helps an attacker succeed 8% of the time. With tools that an attacker already has, that number jumps to 67%.
This article explains the incident investigation framework Anthropic now uses, the Fable 5 status, the uplift metric, and what the four-condition shellcode data actually means for how AI cybersecurity risk should be understood.
Introduction
There is a question that sounds simple but turns out to be genuinely complicated: when an AI model helps with something cybersecurity-related, is that a problem?
The reflexive answer is yes. Cybersecurity capabilities can hurt people. AI making them more accessible sounds dangerous. Therefore any AI model that engages with cybersecurity topics must have a problem.
But spend thirty seconds thinking about who actually uses AI for cybersecurity work and the picture becomes less clean. Security researchers probing systems they are authorized to test. Developers trying to understand a vulnerability in code they wrote. Red team professionals whose job is to find weaknesses before attackers do. Students learning how exploits work so they can defend against them. Defenders building detection systems who need to understand attack patterns. All of these people are doing legitimate, often essential work — and all of them need AI to engage with cybersecurity content.
The question was never really "should AI help with cybersecurity." It was always "which kinds of help, for which kinds of people, cross the line from useful into dangerous." Anthropic's August 4 update is its most serious attempt yet to answer that question precisely.
Quick Summary
| Topic | Finding |
|---|---|
| Significant jailbreaks in Fable 5 since redeployment | None found |
| Jailbreaks observed | Low-severity only — weaker models achieve same output |
| False positives from classifiers | Small number, actively being reduced |
| New evaluation metric | UPL (Uplift) — assisted minus unassisted success rate |
| Shellcode task without tools + no AI | 0% success |
| Shellcode task with tools, no AI | 38% success |
| Shellcode task without tools + AI | 8% success |
| Shellcode task with tools + AI | 67% success |
| Key insight | Tool access multiplies AI's real-world attack capability dramatically |
| Safeguard approach | Block tasks with high uplift for tool-equipped attackers; allow legitimate security work |
Part One: How Anthropic Investigates Incident Reports
When Fable 5 and Mythos 5 launched in June, Anthropic deployed stronger cybersecurity classifiers and simultaneously launched a HackerOne bug bounty program for cybersecurity jailbreaks. Both changes produced a new kind of incoming signal: reports from partners, customers, and security researchers describing behavior that concerned them.
The first thing Anthropic learned from reviewing those reports was not about jailbreaks. It was about what people think a jailbreak is.
The vast majority of reports were not jailbreaks. They were bugs. Unexpected model behaviors. Edge cases where the policy was unclear. Situations where the model responded to a security-adjacent question and the person who received that response was not sure whether it should have. These are real issues worth investigating. But they are categorically different from a safety failure.
The Three Questions That Determine Whether Something Is a Jailbreak
When a report comes in, Anthropic evaluates it against three sequential questions.
The first question is whether the model responded to a concerning cybersecurity request despite its safeguards being active. If the safeguards triggered and blocked the response, the system worked. If the model responded, the next question becomes relevant.
The second question is whether that response was significantly harmful. Anthropic defines significant harm specifically: content relating to vulnerabilities in the CISA Known Exploited Vulnerabilities Catalog, or vulnerabilities with a CVSS score of 9.0 or higher. Either of these represents the kind of serious, actively-exploited security flaw where meaningful assistance provides real danger. The other category of significant harm is providing novel uplift — capability the attacker could not otherwise access.
The third question is whether the behavior was normalized — meaning ordinary, legitimate security work. Security researchers, penetration testers, vulnerability analysts, and defensive developers all need to discuss exactly the concepts that sound alarming out of context. A model that explains how a class of vulnerability works so a developer can patch their code is not a model that has been jailbroken. It is a model doing its job.
A report only represents an actual jailbreak when all three conditions align: the context indicated malicious intent, the model bypassed its safeguards, and the response provided significant harmful capability. All three. Not one, not two — all three. Most reports do not satisfy all three.
This framework is not a way of dismissing legitimate concerns. It is a way of distinguishing between the many things that look like security failures at first glance and the fewer things that actually are.
Part Two: The Fable 5 Status Update
Several weeks after Fable 5 was redeployed with its new classifiers on July 1, the picture is clear enough to describe publicly.
No significant jailbreaks have been found.
The only jailbreaks observed or reported through HackerOne have been low-severity technical cases. Low severity has a specific meaning in the framework Anthropic introduced alongside the redeployment: a low-severity jailbreak is one where the capability it provides is already accessible through tools an attacker would have anyway, or through weaker AI models they can already use. If getting Fable 5 to produce output about a particular vulnerability provides no more capability than asking Opus 4.8 — a model with less restrictive cybersecurity safeguards — then the security implication of the Fable 5 jailbreak is minimal, even if the jailbreak is technically real.
This is the distinction that makes the status update meaningful. The question was never whether any technique existed that could get Fable 5 to produce some cybersecurity-related output. The question was whether any such technique provided capability an attacker could not otherwise access. So far, the answer is no.
The classifiers are also producing a small number of false positives — legitimate cybersecurity queries that are being blocked incorrectly. Anthropic describes this as an ongoing tuning process: the classifiers are being refined to reduce these incorrect blocks while maintaining protection against actual risk. This is the expected state of a system that launched with deliberately conservative settings and is now being calibrated based on real-world data.
Part Three: A Better Way to Measure Cybersecurity Risk
The most significant contribution in this announcement is not the status update. It is the framework for measuring whether AI actually helps attackers — and the specific data that makes the answer more complicated than most people expect.
The Problem With How People Currently Think About This
The public discussion about AI and cybersecurity tends to operate on a binary: either the model can discuss offensive security topics, in which case it is dangerous, or it cannot, in which case it is safe. This framing is wrong in ways that matter for both safety and utility.
A model that can describe the general concept of a buffer overflow is not meaningfully helping an attacker. A model that provides working exploit code targeting a specific CISA-listed vulnerability in production infrastructure is a different matter entirely. Treating both as equivalent makes it impossible to build systems that serve defenders without also serving attackers — because defenders need the first kind of help and attackers benefit from the second.
Uplift: The Metric That Actually Measures What Matters
Anthropic's new measurement metric is called UPL, for Uplift. The formula is direct:
UPL = Assisted Success Rate − Unassisted Success Rate
This measures the marginal contribution of the AI. If an attacker succeeds 40% of the time without AI assistance and 65% of the time with AI assistance, the uplift is 25 percentage points — the additional success rate attributable to the model's help.
This is more meaningful than a raw success rate because it captures what actually matters: does the model make an attacker meaningfully more dangerous than they already are? A model that helps an attacker who would succeed anyway produces low uplift. A model that helps an attacker who would otherwise fail produces high uplift. The safeguard goal is to block the high-uplift assistance while preserving access for legitimate users.
The other critical element is the realistic attacker baseline. Anthropic deliberately chose to model an attacker who is starting from scratch on a task after some guidance — not a novice with no knowledge, but also not an expert who only needs the final piece. This matters because the relevant safety question is not whether a world-class offensive security researcher could use AI to do something marginally faster. It is whether AI meaningfully enables less sophisticated actors to accomplish attacks they otherwise could not.
The Shellcode Data: Why Tools Change Everything
The concrete example Anthropic presents — shellcode obfuscation — involves hiding malicious code from security scanners, a genuine attacker technique. The results of testing this task across four conditions reveal something that should change how anyone thinks about AI and cybersecurity risk.
| Condition | Success Rate |
|---|---|
| No AI, no tools | 0% |
| Tools available, no AI | 38% |
| AI available, no tools | 8% |
| AI available with tools | 67% |
Three conclusions follow directly from these numbers.
The first is that AI alone, without supporting tools, provides limited capability on this task. An 8% success rate means the AI is not independently enabling this attack at any meaningful scale.
The second is that tools alone — without any AI — already produce a 38% success rate. An attacker with standard tools available can succeed more than a third of the time even without AI assistance.
The third, and most important, is what happens when you combine them: 67%. Adding AI to an attacker who already has tools increases their success rate by 29 percentage points. The uplift of AI for a tool-equipped attacker is dramatically higher than the uplift for an attacker with no tools.
The implication for how safeguards should be designed is direct. The relevant question is not "can this model help with shellcode obfuscation in isolation." It is "can this model provide meaningful additional capability to an attacker who already has the tools needed for this attack." When framed that way, the answer is yes — and the safeguards should address that.
Fable 5's classifiers have been trained to block tasks that pose high risk specifically in the context of a realistic attacker who has tools. Tasks that provide low real-world uplift — security education, vulnerability concept explanation, defensive research — remain accessible. Tasks that provide high uplift to a tool-equipped attacker — the ones where the combination of AI plus tools substantially increases attack success — are blocked.
The Balance Anthropic Is Trying to Strike
The most honest sentence in the entire announcement is near the end: "We won't get this tradeoff perfect every time."
Sometimes the classifiers will be too conservative and frustrate a legitimate security researcher who needed an answer. Sometimes an attacker will find a path through that the classifiers did not anticipate. Both failures are real, both matter, and neither can be eliminated entirely through any amount of evaluation or training.
What the uplift framework provides is a principled basis for making these tradeoffs explicitly rather than arbitrarily. Rather than asking "does this output sound like it relates to hacking" — which will block legitimate work and may not block the most dangerous content — the framework asks "does this output provide meaningful capability to a realistic attacker who has the tools that enable the harm." That is the question whose answer actually determines whether a response is dangerous.
The goal Anthropic states is a model that is useful for cybersecurity work. Not a model that refuses to engage with security topics to protect itself from bad press. Not a model that helps with anything regardless of real-world risk. A model that serves the security researchers, developers, and defenders who constitute the vast majority of cybersecurity-related use — while reliably failing to serve the realistic attacker trying to use AI to increase the probability of a successful attack.
The data suggests the current calibration is working. The weeks since redeployment have produced no significant jailbreaks. The only bypasses observed are low-severity cases that provide no meaningful uplift beyond what already exists without AI. The false positive rate is small and declining.
That is a reasonable place to be seven weeks after the most scrutinized AI redeployment in the industry's history.
Final Takeaway
Two things are now clearer about AI and cybersecurity risk than they were before August 4.
The first is that Fable 5's post-redeployment classifiers are holding. Several weeks of monitoring and a new public bug bounty program have produced no significant jailbreaks. The only techniques found are low-severity cases where the capability is already accessible through other means.
The second is that the question "is this model dangerous for cybersecurity" was never the right question. The right question is "does this model provide meaningful additional capability to a realistic attacker who already has supporting tools." The shellcode data — 8% without tools, 67% with tools — makes visible a dynamic that was easy to miss with binary evaluation approaches. Safeguards calibrated against that specific risk can serve defenders without serving attackers, at least for the vast majority of interactions in both categories.
Perfect will never be achievable. But precise is better than blunt, and uplift is a more precise measure than binary capability.
