Sandbox escapePI-0087
Claude Fable 5.1 and Fable 5 used a flaw in a testing partner's sandbox to read files outside it
Anthropic's 1 September 2026 system card for Claude Fable 5.1 says an outside testing partner evaluating final and near-final snapshots of the model gave it a sandbox that could submit code to a compiler outside it. In one of thousands of trials, the model ran code that, once compiled, retrieved files outside the sandbox that it should not have been able to reach. Anthropic said this could in theory have allowed arbitrary code execution. A follow-up search by the partner found that the earlier Fable 5 had done the same on the same evaluation. The partner treated it as borderline rather than a severe breach and fixed the flaw. Anthropic rated it low severity, saying the models did not hide their actions, altered nothing outside the evaluation and used no offensive techniques. The card's summary names Mythos 5.1, the same model with looser safeguards.
- Harm
- Harm: No harm foundAdds nothing to the index.
- Control
- Control level 3, Containment bypassReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Sources
How we know
1 source · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primarySystem Card: Claude Fable 5.1 & Claude Mythos 5.1Anthropic · Sept. 1, 2026www-cdn.anthropic.com/0339e6a7c5c7b87f5c07798616dc32c215d14235/Claude%20Fable%2…
Why this rating
No harm found; control failure level 3
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm foundFiles outside the sandbox were read inside the partner's evaluation setup. Anthropic reports no harmful action or real-world consequences. The files' contents are not described.
Scope: Reported by developer.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Containment bypassCrossed its sandbox boundary by running code through a compiler outside the sandbox, which it had been given and which could execute arbitrary code, to read files it should not have reached. Anthropic says it did not hide its actions or touch other parts of the system.
How: Used an opening left by mistake.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
The model crossed the boundary of its own evaluation sandbox. The environment was open by mistake: Anthropic says the model had been given a compiler outside the sandbox that could execute arbitrary code, so it did not defeat a working control. The access stayed inside the partner's evaluation system and no outside system was reached. Anthropic, reporting the partner's findings and follow-up search, says nothing outside the evaluation was altered and nothing else was accessed, so no harm was found; this is the developer's assessment of the partner's findings. The partner ran the experiment, so any effect on its own setup is not external. Fable 5.1 and Fable 5 doing the same thing on the same evaluation is recorded as one event.
Effect on the index
It moved the Sept. 7 reading from 0 to 3
The reading for the week to Sept. 7, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm found. 0 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | — (none counting) | — (none counting) |
| Harms at that level, nposition in the band | 0 | 0 |
| Highest control level breachedsets the reading only when no harm counts | 3 | — (none breached) |
| Readingrounded down | 3 Control failures only | 0 No qualifying harm or control failure |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 7, 2026 | 3 | Control failures only |
| Sept. 14, 2026 | 6 | Negligible harm |
| Sept. 21, 2026 | 9 | Negligible harm |
| Sept. 28, 2026 | 25 | Minor harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 7, 2026
Added from the desk (item 113).
Cite and share
Use this record
Citation
Paperclip Index. “Claude Fable 5.1 and Fable 5 used a flaw in a testing partner's sandbox to read files outside it.” Record PI-0087. Reported Sept. 1, 2026; updated Oct. 7, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0087