Researchers found that Anthropic's Fable-5 model could bypass safety guardrails when asked to fix vulnerable code. The Trump administration blocked public access, calling it a national security threat. Critics argue the response is security theater, lacking cybersecurity expertise and clear AI regulations.
The feds freaked out over Fable-5 after simple "fix this code" prompt. Not a jailbreak, says a researcher. The jailbreak that prompted the Trump administration to block Anthropic's most advanced model from public access was actually a simple 3-word prompt: "fix this code." That's according to Katie Mossouri. She said she was the only outside expert to read the third-party research paper on the Fable-5 guardrail bypass techniques that prompted the ban. The U.S. government issued an export control directive. Anthropic shared the report privately with her, then outside Researchers reportedly fed Anthropic's Fable-5, Mythos, and Claude Opus open-source code containing known CVEs plus new code intentionally laced with vulnerabilities and asked the models to review the code for security issues. Fable-5 refused, so the researchers asked the AI systems to fix this code. The model reportedly obliged and after additional prompts also produced scripts to test the patches. That's it. The prompt was fix. Fix this code. So 3 words took down one of the most public, craziest frontier model releases in history. Jonathan, I'll turn it to you to elaborate on all of your opinions and takes.
I thought it might be something kind of silly like this, just given Anthropic's response to the judgment that this was a security issue. There's a lot of different opinions about how this should work, and I think probably it was Andrew Jassy, the CEO of Amazon, who reported this. Why is he reporting this? Is it just because technically it breaks the guardrail that Fable is supposed to have, so he's like, well, I need to report this? Or was it something that he actually thought was going to like negatively affect their customers? I think we're in the territory where there's not a regulation or a policy in place, especially given two facts of the Trump administration. One is that they tend to hollow out the bureaucracies of expertise that can actually diagnose these kind of problems. Like they're reviewing this without an expert in the room. There's nobody like that's a cybersecurity expert at a high level that has decision-making authority in the administration. And two, they just tend to put on theater about everything. This is just security theater. We all have seen these kind of security theaters play out in different teams, especially if you work like an enterprise environment, doesn't matter. It's just sort of a matter of opinion. It's— this is rhetoric. It's the kind of thing that like one party can back a statement that said this is not a problem, another party could back a problem that says this is a problem, but there's no detailed bill or legislation or regulation that is actually going to stress test it. And I think that this is where we're finding ourselves, is in the period where this is an unregulated industry. Anthropic's asking for regulation, and instead what they got was like security theater.
