Cybersecurity researchers aren’t happy about the guardrails on Anthropic’s Fable

Anthropic has unveiled its new AI model, Fable, which is being marketed as a public and constrained version of the highly anticipated cybersecurity tool, Mythos. However, the launch has sparked dissatisfaction among various cybersecurity researchers and professionals who have taken to social media to express their grievances. Valentina “Chompie” Palmiotti, a prominent security researcher at IBM X-Force, stated that Fable's restrictions significantly hinder its usability. "[Fable] rejects any request that could be tangentially cyber-related, including simple tasks like reading a blog post," she noted. When users attempt to engage in topics associated with cybersecurity or biology, Fable halts the conversation, citing its “safety measures” as the reason. These guardrails were implemented to mitigate the potential misuse of Fable for creating malware or compromising software, a priority for Anthropic. Similarly, concerns regarding biological weapon development have led to restrictions in that domain as well. In April, when Mythos was launched, access was limited to a select group of companies and organizations under what was termed Project Glasswing, aimed at safeguarding critical software and infrastructure. Recently, Anthropic expanded Mythos’s availability to numerous organizations across 15 countries, yet the response from cybersecurity experts remains tepid. Matt Suiche, an experienced figure in the cybersecurity field, highlighted that Fable’s programming often misinterprets requests. He remarked, "If you ask it to write secure code, it assumes it is cybersecurity-related work rather than adhering to software engineering best practices, leading to a downgrade in response quality." Fable defaults to Claude Opus 4.8 when it encounters its guardrails, which appear to be triggered by any terminology related to cybersecurity. While some researchers expressed frustration that even simple requests, such as a code review, activate these guardrails, others, like Suiche, acknowledge the necessity of caution in early model releases. He suggested that as Anthropic and similar companies collaborate with evolving cybersecurity firms, the model's guardrails may become more flexible over time. Anthropic has not yet responded to inquiries regarding these issues. In addition to the internal limitations of its models, Anthropic has established a Cyber Verification Program that cybersecurity professionals must apply to for access. Approved applicants face fewer restrictions when utilizing Claude for cybersecurity tasks. OpenAI has implemented a comparable initiative known as Trusted Access for Cyber.