What happened on July 2
Anthropic published a detailed breakdown of the safety classifiers behind Fable 5 on July 2, 2026, alongside an early draft of a jailbreak-severity scoring framework developed with Project Glasswing partners. They also opened a public HackerOne disclosure program specifically for cyber jailbreaks on Fable 5.
This is not just a technical post. It speaks to anyone using Claude Fable 5: what happens when someone finds a way to bypass the model's safety rules, and how Anthropic is trying to bring order before things get out of hand.
What "jailbreak" actually means here
A jailbreak is any technique that gets a model to bypass its safety rules. Not just "ask it anything" — there are sophisticated methods using elaborate scenarios, role-play setups, or code-formatted payloads.
Fable 5 is the first Anthropic model shipped with advanced safety classifiers that bucket behavior into four categories:
- Prohibited: requests like writing malware or assisting with exploits. The system refuses directly.
- High-risk dual-use: requests that could be legitimate or harmful. This is where the interesting work happens.
- Low-risk dual-use: tools with some risk but rare real-world abuse.
- Benign: ordinary requests.
Previously, the model would just refuse or accept without explanation. Now, when a refusal happens, the API returns `stop_reason: "refusal"` as a successful HTTP 200 response, with the name of the classifier that triggered the refusal. Developers know exactly why, and enterprise customers can make their own call.
Why the framework matters
Until now, every lab measured jailbreak severity its own way. One would call it "catastrophic", another "minor". There was no shared scale. The public conversation about "is AI dangerous?" was running on vibes.
The new framework tries to fix this with three things:
- A unified numeric severity scale that any researcher, lab, or government can read the same way.
- A clear classification of the payload itself — not just "worked" or "did not work".
- An official disclosure channel (HackerOne) where findings are recorded, triaged, and shared with the people who need to know.
In short: instead of the market judging on impressions, there is now a real yardstick. That makes the export-control debate easier, makes it clearer when a lab should pull a model, and lets researchers work without legal risk.
What changes practically for researchers
Before this, a researcher who found a Claude jailbreak had two bad options:
- Publish it publicly — making it accessible to regular users but also opening the door to problems.
- Send it to Anthropic only — slow, and nobody else ever knows what happened.
The new HackerOne program offers:
- A structured disclosure path with a clear scope.
- Public disclosure once a fix is in place.
- Bounties for high-quality findings — depending on the published scope.
If you are a security researcher or care about AI safety, this door is officially open. You no longer have to reach out informally or worry about legal action.
⚡ Try it yourself
If you are a researcher or advanced user:
- Open Anthropic's HackerOne page and review the scope. What types of reports are accepted, what is not.
- If you have a safe test environment for Fable 5 (not production) and you find a prompt that triggers a refusal, document the prompt and the response in detail.
- Before reporting, read the program terms: what happens with public disclosure, when they will reach out, and whether a bounty applies.
If you are a regular user:
- This news does not change how you use Claude — keep using it as before.
- But if you see follow-up stories about "Anthropic blocked a new jailbreak", you now know that is part of an organized program, not chaos.
One-line takeaway
For the first time, we have a shared severity scale and an official disclosure channel for jailbreak attempts on frontier AI models. The public conversation about AI safety is now running on numbers, not impressions, and researchers have a clear path forward.