Anthropic

Claude Fable 5.1

• Released 1 September 2026
• Framework: Responsible Scaling Policy (RSP) and Frontier Compliance Framework (FCF)
• 8 tests by the provider
• 7 source documents

The provider's own tests

• automated and manual prompts · Run by 10a Labs, reported by the provider · Cyber

  10a labs ran over 6,700 automated and manual prompts against fable 5.1.

  Anthropic · 1 September 2026 · Read the source
• external ipi prompt injection benchmark · The provider · Injection & agentic

  overall, fable 5.1 refused malicious agentic coding and computer use requests at rates comparable to recent claude models while continuing to assist with dual-use and benign security tasks, and it is our most robust model to date on the external ipi prompt injection benchmark.

  Anthropic · 1 September 2026 · Read the source
• external partner sandbox evaluation · The provider · Deception & sabotage

  Reported result: in one of thousands of trials, fable 5.1 exploited a vulnerability within our partner’s sandbox: it ran code that, when compiled, retrieved files outside the sandbox that it should not have had access to

  while one of our partners was evaluating the final and a near-final snapshot of claude fable 5.1, they set up an evaluation environment where the model was in a sandbox, but it could submit code to a compiler outside of the sandbox.

  Anthropic · 1 September 2026 · Read the source
• indirect prompt injection (IPI) benchmark · The provider · Injection & agentic

  fable 5.1 is our most robust model to date on this benchmark, with an attack success rate of 0.1% at k=1, 0.7% at k=10, and 1.0% at k=15, improving on opus 5 (0.4%, 3.6%, 4.8%) and claude fable 5 (0.6%, 4.9%, 6.5%).

  Anthropic · 1 September 2026 · Read the source
• new Shade attacker in coding environments with prompt injection probes enabled · The provider · Injection & agentic

  prompt injection probes reduce attack success rates substantially across models, bringing fable 5.1 to 12.80%, the lowest of any model with safeguards enabled.

  Anthropic · 1 September 2026 · Read the source
• prompt injection probes · The provider · Injection & agentic

  with probes enabled, fable 5.1’s attack success rate is unchanged at 0.07%.

  Anthropic · 1 September 2026 · Read the source
• secure and defensive coding evaluation · The provider · Cyber

  claude fable 5.1 blocked significantly fewer of these defensive coding tasks than claude fable 5.

  Anthropic · 1 September 2026 · Read the source
• vulnerability finding evaluations · The provider · Cyber

  claude fable 5.1 reduces block rates on defensive vulnerability finding compared to claude fable 5.

  Anthropic · 1 September 2026 · Read the source

No document we read states: whether a capability level was crossed, an independent or government test, a safeguard. No incident on record names this version.

Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.

Previous version: Claude Fable 5 · Compare the two