The new Claude has a major problem: Anthropic’s AI is much easier to fool.

On November 9, Anthropic launched Claude Fable 5.2, its most capable model to date, with a 20% reduction in pricing and an IPO in the background. Like its predecessors, it shares its engine with Claude Mythos 5.2, a version reserved for verified organizations. The public version adds filters that block sensitive requests in cybersecurity, biology, and a few cutting-edge AI projects.The spec sheet published the same day breaks down, over 264 pages, the cost of this architecture.

A filter that sends trapped requests to the least capable model

When a request relates to offensive cybersecurity, the filter redirects the conversation to Claude Opus 4.8, a model released on May 28 (let’s face it, an eternity in the world of LLMs). The switch is automatic in Anthropic’s applications and optional for developers using the API, while sensitive biology and some work related to frontier models are routed to Opus 5. As with the previous generation, a banner should indicate the change, and the conversation would then remain on the replacement until the user goes back.

But there is a catch: Opus 4.8 is considerably less resistant to prompt injections than its younger counterparts. The technique involves slipping instructions into content that the agent reads while working, such as an email or a web page, and the model executes them as if they came from the user. Routing through the older model therefore opens an attack vector that Fable 5.2 alone would have closed.

On the Gray Swan test bench, which pushes an agent to exfiltrate private data, delete files or trigger a payment that nobody requested, 4.09% of attacks succeed after fifteen attempts. That is four times the rate against Fable 5.1 (1.02%) or Opus 5.5 (0.96%), two models that Fable 5.2 nevertheless outperforms almost everywhere else.In detail, 53% of attempts were served by Opus 4.8, which failed one time in twenty (5.17%), while Fable 5.2 held at 2.05% on requests it handled itself.

An automated attacker, trained to refine its attempts and equipped with 200 attempts per scenario, achieved 89.82% success on coding tasks; 99.5% of the responses then came from the fallback model. None of the 43 responses given by Fable 5.2 in person failed. The anti-injection probes deployed in products bring the score down to 28.16%, three times the level measured on Fable 5.1. The same pattern occurs in computer control, where 38 of the 40 successful attacks had gone through the fallback.

Should automatic fallback be turned off?

The phenomenon was already present in Fable 5.1’s scorecard, published in September, and Opus 4.8 has since been hardened. Anthropic is adding safeguards around the mechanism: probes inspect what the agent reads before it acts, and a classifier blocks dangerous commands in the default execution mode of its coding tools.

For anyone who entrusts their email or browsing to an agent, a setting documented until now for previous versions replaces the fallback with a pause. The flagged request is awaiting reformulation, and nothing is sent to the least capable model. Professionals whose legitimate work triggers the filters, security researchers in particular, can also request verified access to less restricted models.

In October 2024, Anssi and its German counterpart ranked prompt injection among the risks associated with coding assistants, calling for keeping a human in the loop. Two years later, that advice applies more than ever… to the most advanced product on the market. A safeguard is part of the attack surface, and reinforcing the door offers little protection when suspicious visitors are escorted to a less closely monitored entrance.

👉🏻 Follow tech news in real time: add 01net to your sources on Google and subscribe to our WhatsApp channel.

Source: Anthropic