Claude Fable 5.2 Filters Route Prompts to a More Vulnerable Model

The catch is that Opus 4.8 resists prompt injection noticeably worse than newer models. In such attacks, instructions hidden in an email or web page are executed by the agent as if the user had written them.

On the Gray Swan benchmark, which pushes an agent to leak private data, delete files or trigger an unrequested payment, 4.09% of attacks succeed within fifteen attempts. That is about four times the rate for Fable 5.1 (1.02%) and Opus 5.5 (0.96%). Opus 4.8 handled 53% of the attempts and gave way 5.17% of the time, while Fable 5.2 held at 2.05% on the requests it processed itself.

An automated attacker with 200 attempts per scenario reached 89.82% success on coding tasks, with 99.5% of responses coming from the fallback model. None of Fable 5.2's own 43 responses gave way. Anti-injection probes lower the score to 28.16%, still three times the Fable 5.1 level. In computer-use tests, 38 of 40 successful attacks went through the fallback.

Mitigations and what users can do

The issue already appeared in the Fable 5.1 system card from September, and Opus 4.8 has since been hardened. Anthropic adds probes that inspect what the agent reads before it acts, plus a classifier blocking dangerous commands in the default execution mode of its coding tools.

Users who give an agent access to their inbox or browser can enable a setting, documented for earlier versions, that replaces the switch with a pause: the flagged request waits to be rephrased and nothing goes to the older model. Security researchers and other professionals whose legitimate work triggers the filters can request verified access to less restricted models.