Anthropic blames Claude Fable 5.2's fallback model for its weaker result against prompt injection
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Gray Swan found in its indirect injection test that 4.09% of attacks on Fable 5.2 get through, while Fable 5.1 stayed at 1.02%. Anthropic puts most of the blame on Opus 4.8, the fallback model that steps in when a cybersecurity filter flags a request and that took 53% of the attempts. Notebookcheck points out that this automatic switch can be disabled.
Claude Fable 5.2 holds up worse than its previous version against prompt injection in an external test, according to the system card Anthropic published on November 9, and the company blames it mainly on the model that answers in its place when a filter is triggered.
The system card is the model's technical safety report. When the cybersecurity classifiers in Fable 5.2 flag a request, the reply comes from Claude Opus 4.8, an older model that copes worse with prompt injection: orders hidden in an email, a website or a file that the agent reads and may end up obeying.
In Gray Swan's indirect prompt injection test, with 15 tries per attack, the attacker got through in 4.09% of cases against Fable 5.2, compared with 1.02% for Fable 5.1 and 0.96% for Opus 5.5, a level close to Sonnet 5.5 (3.43%). Opus 4.8 ended up answering 53% of the attempts against Fable 5.2, whereas for Fable 5.1 the figure was 23%. When Fable 5.2 itself replied, the attack worked 2.05% of the time; when Opus 4.8 replied, 5.17%. In this evaluation, Opus 4.8 ran without the injection probes Anthropic uses in its products.
Anthropic says that since Fable 5.1 launched it has reinforced the protections on Opus 4.8 when it acts as the fallback. In its products it adds probes that review what the tools return before the model does anything with it, and in Claude Code there is Auto mode, which adds a classifier to stop risky tool calls.
According to Notebookcheck, the automatic switch between models comes switched on as standard and can be turned off in the settings ("Switch models when a message is flagged"); a flagged request is then held rather than handed to Opus 4.8. Citing Anthropic's help page, the outlet adds that these filters inspect all the content the model takes in, from memory and connectors to web searches and files, so text the user never typed can set off the switch.
Why it matters · analysis and opinion
The awkward fact is not the percentage but where it comes from. A filter meant to protect, the one that diverts sensitive cybersecurity requests, ends up putting in charge a model that is easier to fool, precisely in the tasks where the agent reads other people's content. And since the filter also checks what the model reads, not only what the user writes, an email or a website can trigger the switch without anyone asking for it. Anyone using Claude as an agent over inboxes, websites or third-party repositories has a practical decision to make: turn off the automatic switch and accept that some requests will stall, or keep it and rely on the extra protections Anthropic adds in its products.
Official source: Anthropic · Written with the help of AI: how we make the news
