The quick read: • Anthropic released Claude Fable 5.2 and Mythos 5.2 on Monday, Nov 9, 2026, with a system card. • The system card says Fable 5.2 "falls back to Opus 4.8 more frequently than recent models do in prompt injection scenarios, resulting in a higher attack success rate." Prompt injection is hidden text in an email, web page or file that tries to make an AI agent follow someone else's instructions. • The figures, as reported by Notebookcheck from the system card: in Gray Swan's indirect prompt injection test, attacks succeeded 4.09% of the time against Fable 5.2, versus 1.02% against Fable 5.1 and 0.96% against Opus 5.5. About four times the last version. • Why: when Fable 5.2's safety classifiers flag a message, an older model answers instead (Opus 4.8 for cyber topics). In that test, 53% of attempts on Fable 5.2 were answered by Opus 4.8, versus 23% for Fable 5.1. • Against an adaptive attacker in coding scenarios, 89.82% of attempts succeeded without Anthropic's prompt injection safeguards and 28.16% with them. Opus 5.5 stood at 11.13%. • Anthropic's side: when Fable 5.2 answers an attempt itself, "it is one of our most robust models to date." These are Anthropic's own red-team tests. No real-world attack has been reported. • The switch can be turned off: "Switch models when a message is flagged," in Settings and Capabilities, or in Claude Code's config.
“Anthropic's Own System Card Says Claude Fable 5.2 Is Easier to Hijack Than the Model Before It”
who’s making the noise
Anthropic, Claude Fable 5.2 and Mythos 5.2 system card and launch post, Nov 9, 2026. Figures reported by Notebookcheck, Nov 10. Fallback weakness also reported by Kingy.ai and Mallory, Nov 9.
our take
The headline model got smarter and the system around it got easier to hijack. That is not a contradiction, it is how the safety design works: flag the risky request, hand it to an older model. The older model is the one attackers beat. Hidden instructions in the material an agent reads can be enough to trip the switch, which is the part that should worry anyone running an agent on their inbox, their files or the web. Anthropic's side, stated fairly: it published these numbers itself, in the system card. It says Fable 5.2 on its own is among its most robust models, and with its probes on, the adaptive attack rate falls from 89.82% to 28.16%. We take that as reported. It still means the model answered on its own in less than half of one test's attacks, and 28% is more than double Opus 5.5. The plain move for a small business: if you run Claude agents over email, documents or the web, check the "Switch models when a message is flagged" setting this week. With it off, a flagged request pauses for you instead of going to the older model. Then ask whoever set up your agents which model actually answers when something gets flagged. What to watch: whether Anthropic narrows the fallback for prompt injection, and whether outside testers reproduce the 4.09% figure.