Claude Fable 5.2 fallback models and AI agent security, Digi Mart USA News: Anthropic released Claude Fable 5.2 on November 9. According to the company’s announcement, the model generates output up to 30% faster than Fable 5.1, and early testing showed about 55% fewer blocked requests.
The system card also reports a finding that matters for users who rely on Claude as an agent to read email, operate websites or work on code they did not write. In those settings, Fable 5.2 hands requests to an older model more often, and that older model is easier to attack.
Fable 5.2 shares its underlying model with Claude Mythos 5.2, which Anthropic offers only to vetted organizations. To make Fable broadly available, classifiers check requests for offensive cybersecurity, risky biology and parts of AI development.
When a classifier flags a request, a less capable model answers instead: Claude Opus 4.8 for cyber topics and Claude Opus 5 for biology. Claude shows a notice and labels the response with the model that answered.
According to Anthropic’s help page, the checks review everything the model reads, including memory, connector content, web search results and files. That means text a user never typed can trigger the switch.
In a prompt injection attack, someone hides instructions in an email, web page or file. If an agent reads and follows that text, it might forward private messages to the attacker as if the user had requested it.
On Gray Swan’s indirect prompt injection benchmark, the attack success rate against Fable 5.2 after 15 attempts was 4.09%, compared with 1.02% for Fable 5.1 and 0.96% for Opus 5.5.
Anthropic attributes much of the gap to fallbacks. Of the attempts against Fable 5.2, 53% were served by Opus 4.8, compared with 23% for Fable 5.1. Attacks succeeded 2.05% of the time when Fable 5.2 answered itself and 5.17% of the time when Opus 4.8 did.
In a second test, an adaptive attacker made 200 attempts per coding scenario. Without safeguards, 89.82% of attempts against Fable 5.2 succeeded, and almost all responses came from Opus 4.8. With the prompt injection probes Anthropic runs in its products, the rate fell to 28.16%, while Opus 5.5 reached 11.13% under the same conditions.
None of the 43 requests Fable 5.2 answered itself in this test were compromised.
Automatic model switching is on by default on the web, in the mobile and desktop apps, in Cowork and in Claude Code. Users can turn it off under Settings and Capabilities, or in Claude Code under Config and MODEL & OUTPUT, using the toggle labeled “Switch models when a message is flagged.” A flagged request would then pause rather than go to Opus 4.8, and the user would decide whether to edit the message or choose another model.
That is less convenient, but it stops those requests from being handed to the weaker model when an agent processes inboxes, websites or third-party repositories.
The publisher notes that injected content in coding tools is a practical concern, pointing to a tampered Claude Code extension on Cursor’s marketplace at the end of October. For most tasks, Anthropic recommends starting with Claude Opus 5.5 and moving to Fable only for the most demanding work.
On the Pro plan, Fable normally runs on usage credits, as Fable 5.1 did. As a launch offer, Pro subscribers can use the new model as part of their plan until November 16.
