The global redeployment of Anthropic’s Fable 5 isn’t just about performance improvements—it comes with a rethought safety architecture that directly addresses the dual-use tension in cybersecurity. Instead of a blanket ban on cyber-related queries, Fable 5 introduces a tiered classifier system that distinguishes between prohibited, high-risk dual-use, low-risk dual-use, and benign activities. This approach acknowledges a critical reality: the dual-use nature of cybersecurity capabilities means that blocking all access is not a viable strategy; context is everything.
The classifiers are one layer in a broader defense stack that includes model safety training, access controls, and offline monitoring. What makes this system notable is how it handles the so-called “safety margin”—a buffer that intentionally blocks a large fraction of even low-risk requests to minimize false negatives on the high-risk side. For Fable 5, this margin was made wider than for previous versions, reflecting a more cautious posture. Yet critics point out that classifier-based filters can become arms races: as attackers discover patterns in what gets blocked, they can craft prompts that skirt the boundary. This is where the proposed jailbreak severity framework becomes essential.
Anthropic, working with Glasswing partners, has released an early draft of their Cyber Jailbreak Severity (CJS) scale. It rates jailbreaks from CJS-0 (informational) to CJS-4 (critical), with each step roughly exponential in impact. The scoring considers four axes: capability gain, breadth of capability gain, ease of weaponization, and discoverability. A jailbreak that only helps novices is less severe than one that accelerates domain experts, because expert capabilities are harder to replicate with existing tools. Similarly, a technique that is easily shared on public forums (high discoverability) and requires no specialized LLM knowledge (high ease of weaponization) poses a much faster real-world threat.
The framework borrows conceptually from the Common Vulnerability Scoring System (CVSS) but differs in a key way: it separates offensive expertise from LLM exploitation skill. That distinction is valuable because a jailbreak might require deep knowledge of neural network internals to reproduce, yet once executed, it could output sophisticated exploit code that a novice can deploy. Conversely, a simple prompt tweak might be highly discoverable but only unlock trivial capabilities. By rating these independently, the CJS helps developers prioritize defenses.
To make the framework more practical, future iterations might add a temporal dimension: how long a jailbreak remains viable before model updates or monitoring catch it. Additionally, industry-wide adoption would require agreement on what constitutes “domain-expert-level” output—a subjective judgment that could invite disputes. Anthropic invites feedback, and their HackerOne program allows researchers to submit real jailbreaks for review, building a shared dataset.
Beyond classifiers and severity ratings, Fable 5’s documentation provides specific examples across all four classifier categories. Prohibited actions include ransomware, defense evasion, and C2 infrastructure; these are blocked entirely. High-risk dual-use actions like penetration testing and exploit development are blocked pending better access controls. Low-risk dual-use activities such as OSINT or vulnerability identification (if already possible with other models) are often allowed, though some are caught in the safety margin. Benign uses like secure coding, patch management, and malware reverse engineering are freely permitted.
One area where the framework could be extended is in addressing the socio-technical context of dual-use. The same query—say, “write a script to enumerate subdomains”—can be benign when run by an internal security team and malicious when used by a threat actor. Classifiers cannot read intent; they rely on surface-level patterns. The safety margin is a trade-off between allowing benign use and preventing harmful requests, and its size directly affects user experience. A wider margin increases protection but frustrates legitimate users, a tension that no technical fix fully resolves.
The broader significance of this release is its attempt to bring structured, transparent thinking to AI cybersecurity safeguards. While other frontier labs publish behavioral restrictions, few detail their classifier categories or propose a unified severity scale. If the CJS framework gains traction, it could become a standard vocabulary for governments, auditors, and developers—much as CVSS did for software vulnerabilities. That would mark a step toward accountable AI deployment, where safety is not a black box but a calibrated, discussable system.
We believe that by working together, we can establish a standard that enables the defensive uses of this technology while preventing its misuse. The debate over how to balance openness with safety will continue, but frameworks like these give it a much-needed anchor. Whether Fable 5’s classifiers hold up under adversarial pressure remains to be seen—but the transparency around their design and the invitation for outside scrutiny are constructive moves for the entire field.