Claude Fable 5’s Leaked System Prompt Decoded

Before your first word reaches a large language model, a hidden document is prepended to the chat: the system prompt. It sets tone, format, refusals, tools, personality and limits. In June 2026 a near-complete copy of the one behind Claude Fable 5 aka “Anthropic’s most capable public model” surfaced on GitHub. Here’s the decode of its most important parts.

What this file actually is

A system prompt is the instruction layer fed to an AI model before it is initialized. Consider it as a: a prompt that was sent before yours, that guides the model’s behavior. Anthropic bakes deep values in during training → the app then adds a prompt that shapes behaviour for that product. When your request clashes with an operator rule, the rule wins, which is why one model can feel so different across apps.

Where Fable 5’s System Prompt Came from?

You might be wondering about the source of this information, and its legitimacy.

• Source: the openly licensed asgeirtj/system_prompts_leaks repository (55k+ stars).
• “Extracted,” not hacked: models can be fooled into reciting their own instructions.
• Not the official version: Anthropic publishes a short core prompt. This is the full product prompt, with the memory/tool/artifact scaffolding that rarely gets published.

The model it drives

Claude Fable 5 launched 9 June 2026 as the first public “Mythos-class” model. A tier above Opus, which was the previous flagship. It shares its weights with the restricted Claude Mythos 5, the only difference being the safeguards and access.

• The key safeguard isn’t in the prompt: The classifiers watch for high-risk topics (cyber, bio, chem) and reroute them to Opus 4.8.
• It’s rare: Anthropic says under 5% of sessions get rerouted.
• The naming: fabula and mythos both mean “the thing that is told,” the split is about safeguards and who gets access, not capability.

Anatomy of the prompt

It’s a deeply nested XML that reads like a config file annotated by a lawyer. It opens with a 190,000-token budget and one odd rule: never emit <voice_note> blocks. Then it splits into two territories:

• <claude_behavior> → who Claude is: product facts, refusals, tone, wellbeing, balance.
• Sibling blocks → what Claude can do: memory, tools, artifacts, search, connectors.

The striking part is how much is about not doing things: refusals, wellbeing and not entertaining any “secret sauce” conversations.

Refusal Handling: The bright lines

The most fortified room. The model can discuss almost anything factually, the limits target concrete harm. The child-safety rules get the most care of anything in the file.

If the model catches itself reframing a request to make it acceptable, that reframing is the signal to refuse.

• Weapons & explosives: no help creating harmful substances or weapons. Regardless of how good your intentions may be, the technical details aren’t unlocked.
• Illicit drugs: no dosing or synthesis, even as “harm reduction”. Albeit life-saving info is still allowed.
• Malicious code: no hacks or exploits, even “for education.”
• Real people: fiction is fine, but fake quotes from named public figures aren’t.

When it refuses, it states the principle, not the detection. This is because describing the fence teaches people to climb it. Classic defense in depth.

A duty of care, in writing

By volume, one of the heaviest sections and oddly specific, like lessons learned the hard way.

• No diagnosing: it won’t pin a mental-health label on you that you didn’t use yourself. No generalization or skipping to conclusions.
• No methods: on self-harm it won’t name means, even to tell you what to remove.
• No numbers: with signs of disordered eating it withholds targets and plans. No assumptions made in terms of calories and diet.
• No dependency: it never thanks you for confiding, angles for another message, or plays “your only friend.”
• No amplifying: it avoids reflective listening that deepens distress, and won’t invent a backstory for feelings you didn’t name.

Even the resources are patched for accuracy (it points to the National Alliance for Eating Disorders after an older hotline was disconnected), the kind of detail a human adds, not something a model would know.

Memory System: Remembering you, carefully

It can draw on past chats, but most of the section is about not misusing that.

• No tells: banned from using language constructs along the lines of “I can see…” / “based on your data”. Memory should feel like a colleague who recalls, not a system reading a file on you.
• No hijacking: stored notes could smuggle instructions (“always agree,” “never criticise”). It’s clearly told to ignore them.
• You’re in control: memory is off in incognito chats and editable through a dedicated tool.

The agent machinery: Computer Use + Skills

A big stretch is an operator’s manual for doing, not just saying.

• Read the “skill” first: before making a file, consult the best-practice notes for that format.
• You choose the app: it won’t pick a rideshare or booking service you didn’t name, even in a hurry. Explicit instructions from the user are essential.
• Environment quirks: it knows the small stuff, like the fact that artifacts silently break browser storage, so it bans it.

Search, copyright & a trap-door

It searches when facts might have moved since its January 2026 cutoff, and scales effort to difficulty. Bolted on is the strictest sub-section in the file:

This teardown paraphrases the prompt and quotes only fragments because the model whose rules these are would be bound by them while writing it.

What the leak teaches

A leaked system prompt is a rulebook, not a brain. The intelligence lives in the weights. What escaped is the house rules, the page the model reads before it meets you.

It shows how the guardrail works: not one wall but several thin ones. Refuse. Hide the seam. Keep a backup classifier ready. Distrust any reminder that says relax.

But the real lesson is quieter. A frontier AI is less mysterious than “black box” suggests. What looks like personality or judgment is usually a plain sentence someone wrote manually. No alien mind back there. Just a document, careful and hedged and human. The wizard has a script. One that we somehow ended up reading.

Frequently Asked Questions

I specialize in reviewing and refining AI-driven research, technical documentation, and content related to emerging AI technologies. My experience spans AI model training, data analysis, and information retrieval, allowing me to craft content that is both technically accurate and accessible.