Red-Team Study: Fable 5 Holds at 6.1% Jailbreak Rate, Opus 4.8 Reaches 11.5% Under Sustained Automated Attack
A paper posted to arxiv (2606.18193) directly measures attack success rates against Claude Fable 5 and Opus 4.8 using automated red-team tools that iteratively rewrite harmful prompts after each refusal. The findings arrive as the White House and Anthropic are jointly building a formal jailbreak severity benchmark to govern future model access decisions.
Fable 5’s worst-case attack success rate: 6.1%. Opus 4.8: 11.5%.
Both figures represent the maximum success rate observed under the strongest sustained attack condition, not average rates. Lower success rates under weaker attacks bring the practical risk below these ceilings, but neither model achieves zero — and at automated scale, even a 6% pass rate generates substantial harmful completions.
What the Attackers Did
The red-team methodology uses an adversarial loop: an attacker model generates a harmful prompt, submits it, observes the refusal, then rewrites the framing and tries again. This continues until the model either complies or the attack is exhausted. The paper characterises this as searching the prompt space for a framing the target model treats as legitimate rather than dangerous.
The pattern the researchers found persisting in both models is contextual, not syntactic. The old generation of jailbreaks — unusual character encodings, theatrical roleplay frames, base64 wrappers — does not account for most of the modern attack surface. What does work is finding a description of the harmful goal that resembles a legitimate context: safety research, education, fiction, policy analysis, technical troubleshooting.
Fable 5 resists this more effectively than Opus 4.8. The paper does not explain why — that is a noted gap — but the gap between the two models is consistent across attack types and not explained by the stronger attacks alone.
Why This Matters Now
The study lands at an awkward moment. Fable 5 and Mythos 5 are currently suspended for foreign nationals under a Commerce Department export control directive. The White House and Anthropic are negotiating a framework that would score jailbreaks by impact — how far a bypass went, what capability was exposed, how repeatable the attack was, what damage could realistically follow — rather than demanding perfect immunity as a condition of access.
The red-team data supports that framing. Perfect immunity at scale is not achievable: language models infer intent from phrasing, context, and precedent, and any system flexible enough to be useful will have boundary cases where a harmful request resembles a benign one closely enough to pass.
The practical implication for enterprises running these models in production is narrower: the attacks that succeed in the study are sustained, automated, and adversarially optimised. A one-shot prompt injection is very unlikely to hit the 6% success rate — that number reflects what a dedicated automated system achieves after many iterations. Defense-in-depth at the application layer remains the first line, not a fallback.