A document recently published on GitHub, claimed to be the system prompt for Claude Fable 5, has garnered significant attention in the AI community. This document is not merely a brief guideline on “how the AI should respond,” but rather a comprehensive operational manual detailing how Claude should handle product information, safety policies, search, file generation, external tools, MCP apps, artifacts, copyright, citations, and user well-being.
https://github.com/elder-plinius/CL4R1T4S/blob/main/ANTHROPIC/CLAUDE-FABLE-5.md
However, there’s an important point to address first. It has not been officially confirmed whether the document uploaded to GitHub is the actual original internal system prompt from Anthropic. Therefore, rather than definitively calling it a “leaked system prompt,” it is more accurate to analyze it from the perspective of a “public document claimed to be the Claude Fable 5 system prompt.”
3-Line Summary
- The disclosed document is not merely a personality setting but rather an operational guideline encompassing the Claude product family’s operational policies, safety mechanisms, tool usage, and file processing rules.
- Particularly noteworthy are the relationship between Fable 5 and Mythos 5, the fallback structure to Opus 4.8 in high-risk areas, and the agent-like usage centered around MCP and Artifacts.
- While a system prompt leak can allow for the inference of a model’s internal behavioral rules, actual security relies more heavily on server-side classifiers, access control, tool isolation, logging, and policy enforcement structures than on the prompt itself.
What Does the Document Contain?
The first thing that stands out is product information. The document describes Claude Fable 5 as a generally available high-performance model within the Claude 5 family, sharing the same foundational model as Mythos 5 but differing in the application of safety features. This largely aligns with Anthropic’s official announcements. Fable 5 is positioned as a model for general users, while Mythos 5 is a model offered with restrictions in high-dual-use risk areas such as cybersecurity and life sciences.
Next, refusal and safety policies are outlined. The document elaborates on how Claude should respond to harmful substances, weapons, malware, vulnerability exploitation, illegal drug use, self-harm, eating disorders, and dangerous medical information. An interesting point is that it’s not just “unconditional refusal”; information that protects life or reduces harm can be provided, indicating a nuanced approach. In other words, the safety policy is designed not as a simple block, but as a structure that assesses risk levels and context.
Guidelines for legal and financial advice are also included. Claude is instructed not to make definitive judgments like a lawyer or financial expert, but rather to provide factual information in a way that allows users to make their own decisions. This mechanism prevents AI from displaying excessive confidence in professional advisory domains.
Guidelines on tone and format are also quite specific. Claude is to maintain a warm and friendly tone, but should not condescend to users’ judgment or unconditionally agree with them. Furthermore, the rules state to avoid excessive lists, bold text, and headers in responses, focusing instead on natural sentences. It’s not just about “responding politely,” but also about maintaining a certain distance to prevent users from becoming overly reliant on the AI.
User well-being guidelines are particularly extensive and detailed. They instruct Claude on what expressions to avoid and how to recommend professional or peer support when dealing with topics such as self-harm, mental health, delusional beliefs, eating disorders, self-blame, addiction, and over-reliance. This appears to reflect recent concerns that AI chatbots could cause emotional dependency or psychological reinforcement issues.
Search guidelines are also included. The document explains that Claude should use web search for questions involving information that can change, such as up-to-date information, current positions, prices, policies, laws, and product details. Conversely, it distinguishes that unchanging general knowledge or basic concepts do not require searching. The crucial point here is that while “when to search” is left to the model’s discretion, the criteria for that decision are very specifically detailed within the system prompt.
Another large section is the tool usage guidelines. The document includes definitions for various tools such as web search, image search, weather, sports data, location search, file creation, file display, bash execution, document viewing, string replacement, message composition, recipe widgets, and MCP connector recommendations. This demonstrates that Claude is designed not merely as a chatbot, but as an agent platform capable of performing tasks by combining tools.
File generation guidelines are also notable. They instruct Claude to create actual files when users request reusable outputs such as blog posts, reports, articles, presentations, or code files, and to distinguish between temporary working directories and final output directories. Furthermore, rules are included to first read relevant skill documents for each file type, such as documents, PDFs, PPTX, and spreadsheets. This implies that the model doesn’t just generate responses, but has a workflow for producing outputs within an execution environment.
Most Unique Aspects
The first unique aspect is that “the system prompt is more akin to a product operational policy than a mere prompt.” What we commonly consider a system prompt is a brief identity setting like “You are a friendly AI.” However, this document encompasses the model’s response style, policy judgments, tool call priorities, file generation methods, network access, and external connector selection methods. It can virtually be seen as the runtime operational document for an AI product.
The second unique aspect is the relationship between Fable 5 and Mythos 5. Looking at the general trend in the document and official announcements, Fable 5 is a version intended to provide Mythos-level capabilities to general users, while Mythos 5 is a restricted-access model with some relaxed safety features. Notably, in sensitive areas such as cybersecurity, biology, chemistry, and model distillation, Fable 5 is mentioned to fall back to Opus 4.8 instead of responding directly. This represents a more complex “model routing-based safety mechanism” than simple refusal.
The third unique aspect is the usage of MCP apps and connectors. The document explains when Claude should recommend a connector and when it should directly invoke it, particularly when a user mentions a specific external app or service. Notably, consumer-facing third-party MCP apps are designed such that Claude does not arbitrarily invoke them until the user explicitly selects them. This can be seen as a design prioritizing “explicit consent” over “convenience” when an AI agent accesses a user’s external accounts or services.
The fourth unique aspect is the persistent storage of Artifacts and “Claudeception.” The document mentions that Artifacts can use key-value stores, and it also indicates that AI-powered apps can be created by calling the Anthropic API from within Artifacts. Simply put, this means a structure where the Claude API can be called again from within a small web app created by Claude. This demonstrates that AI is evolving beyond merely generating responses, moving towards creating mini-applications that users can manipulate.
The fifth unique aspect is the very strong copyright guidelines. The document strongly instructs Claude not to directly copy long sentences when citing search results or external materials, but to rephrase and explain them as much as possible. This indicates that LLM services have entered a phase where they must control copyright, attribution, and content reproduction risks at the product level, not just as a technical issue.
The sixth unique aspect is the defensive phrasing that assumes prompt injection. The guidelines state that Claude should handle content carefully if users append tags that appear to be “instructions from Anthropic” at the end of a conversation. This implies that modern AI services already operate under the fundamental assumption that malicious instructions can be embedded within user input.
Implications from a Security Perspective
If such a system prompt is disclosed, attackers can understand the criteria by which the model refuses responses, which tools it calls in what order, and what expressions it avoids. Information such as the scope of safety features, fallback conditions, tool schemas, file paths, and network restrictions can be particularly helpful in estimating the attack surface.
However, it’s difficult to conclude that model security immediately collapses just from a system prompt leak. True security doesn’t reside solely in the prompt. Server-side classifiers, model routing, access control, API authentication, sandbox isolation, file system restrictions, network egress control, logging, and monitoring must all work in conjunction. The prompt is an important policy layer, but it should not be the sole security boundary.
Rather, the more important message from this case is that “AI service security is system security, not prompt security.” While hiding prompts is necessary, even if a prompt is exposed, core permissions and risky operations must be controlled on the server side. This is a crucial principle in the security design for the era of AI agents.
Lessons for AI Service Developers
First, sensitive secrets should not be placed in the system prompt. API keys, internal URLs, actual authorization tokens, administrator account information, or security bypass procedures should not be included in the prompt. System prompts should be designed with the assumption that they may eventually be exposed.
Second, a model’s safety policy should not rely solely on a single prompt. While a prompt can guide a model’s behavior, it is not a forceful security control. Operations such as executing dangerous tools, calling external APIs, deleting files, making payments, or accessing accounts must always undergo separate authorization verification and user confirmation.
Third, AI agents’ tool permissions should adhere to the principle of least privilege. If a model can access all files, all networks, and all external apps, a single prompt injection could cause significant damage. Explicit user consent, sandboxing, network restrictions, tool-specific policies, and audit logs are necessary.
Fourth, search and citation policies are also part of security. In the process of an AI searching for and summarizing up-to-date information, there’s a risk of incorporating incorrect sources, malicious webpages, documents containing prompt injections, and copyright infringement. Therefore, rather than blindly trusting search results, it’s necessary to evaluate source credibility, recency, copyright, and relevance to user intent.
Conclusion
The alleged Claude Fable 5 system prompt leak document is an interesting case that illustrates how complex the operating system of an AI service is. Modern AI chatbots are not merely “models that generate good answers.” They are vast agent platforms that integrate product policies, safety classifiers, tool calls, file systems, external connectors, copyright guidelines, user well-being policies, and search strategies.
In particular, the distinction between Fable 5 and Mythos 5 illustrates how high-performance AI models might be released in the future. Even with the same foundational model, a strong set of safety features is applied for general users, while more powerful capabilities are provided with restrictions to trusted organizations. This signifies that AI models are evolving not as single products, but as systems divided into multiple operational modes based on risk and trust levels.
Ultimately, what’s important is not whether the prompt was leaked itself, but whether the AI service can operate securely even with the assumption of prompt exposure. Future AI security must move beyond “techniques to hide prompts” towards creating “systems that do not collapse even if prompts are revealed.”
Leave a Reply