The Claude Fable 5 System Prompt: What a New Model Tier Looks Like on Paper

Most of what a model vendor tells you about a new tier comes through a launch post: a benchmark chart, a paragraph of marketing language, a pricing page. The system prompt is the one artifact that tells you something different — not how good the model is, but how the vendor talks to it about what it's allowed to do, who else has access to something stronger, and what it should say when a user asks why. A system prompt is instructions, not proof, but it's the closest thing to a design document a vendor ships to millions of end users every day.

That's what makes the asgeirtj/system_prompts_leaks repository worth reading closely for Claude Fable 5 — the first model in a new "Mythos-class" tier that Anthropic introduced above Opus. The repo carries full-text captures of the claude.ai prompt and the Claude Code harness prompt for Fable 5, alongside the equivalent Opus 4.8 and Sonnet 5 files. Diffed against each other, they answer a narrower and more useful question than any benchmark: when a vendor ships a new tier, what changes in the actual instructions, and what stays exactly the same? Every claim below cites a specific file and line range from that repo, and every inference is labeled as one — leaks can be stale, edited, or simply wrong, and the honest way to use them is as a dated snapshot, not a live feed.

One model, two distributions

Anthropic's own prompt text is unusually direct about the relationship between Fable 5 and the tier above Opus. Opus 4.8's prompt describes itself modestly as the most advanced model publicly available, and names a predecessor it doesn't have access to:

Fable 5's own prompt replaces that paragraph with a launch announcement, and it's the single most load-bearing sentence in the whole file:

Read that carefully and the shape of the tier becomes clear: Mythos is the tier, not a model name. One set of weights ships as two products — Fable 5, generally available, wrapped in an added dual-use safety layer; Mythos 5, the same weights without that layer, gated to organizations Anthropic has separately approved. Even the wording shift is deliberate. Opus claims to be the most advanced model publicly available; Fable claims to be the most intelligent generally available model — both phrasings leave room for something stronger existing just outside the phrase that describes who can reach it.

The files let you date this arc, with the caveat that a leak capture is a snapshot, not a subscription. The May 28 Opus 4.8 release-notes archive already carries the Glasswing / Mythos Preview language. The June 9 Fable 5 capture adds the GA launch framing above. And the July 1 Sonnet 5 capture — three weeks later — is the only file that names the safety domains explicitly and reports a suspension:

Three files, three dates, one arc: a restricted preview under a named internal security program, a generally-available launch three weeks later, and a suspension noted in the very next model's prompt after that. None of that is Anthropic's public roadmap — it's what three separate system prompts happened to say on the days they were captured. Anything past that is speculation, and the rest of this post tries hard not to speculate past what a specific line actually says.

One smaller, verifiable detail: Fable's own recitation of the current Claude lineup lists "Claude Fable 5, Claude Opus 4.8, Claude Sonnet 4.6, and Claude Haiku 4.5" with model string claude-fable-5 — Opus 4.8's prompt, by contrast, still lists Opus 4.7 and 4.6 in its own catalog (fable:23). Fable is the only current model ID in either file with no date suffix.

What actually changes in the claude.ai prompt

Diff claude-opus-4.8.md against claude-fable-5.md and you get an 837-line diff, but the two files share almost their entire skeleton: the same memory system, the same computer-use rules, the same visualizer router, nearly the same 24-tool list. The differences cluster into what each file drops and what each file adds — and the pattern in each direction is informative on its own.

Sections Opus has that Fable's prompt drops

Opus 4.8's June prompt reads like a compressed rewrite, and it carries several dedicated sections Fable's prompt simply doesn't have: a search_first mandate to search before every present-day factual question, a default_stance block instructing the model to decline only when a request creates "a concrete, specific risk of serious harm," a full end_conversation_tool_info rulebook plus the tool definition itself, and a set of tone micro-rules — no emojis unless asked, no pet names, a ban on the words "genuinely," "honestly," and "actually." Fable's prompt drops every one of those (opus:7–13, 41–45, 224–228, 729–758).

Fable's weapons-and-CBRN text is shorter too — the detail that anchors the next section — and Fable's prompt also drops the minors' self-sexualization bullet Opus carries. Inferred, but hard to read any other way: Fable's prompt is the older, verbose template — long "Claude should let the person know that…" sentences typical of the Sonnet-4.6 era — while Opus 4.8's June prompt is the tightened rewrite. The newest tier launched on the more conservative, previously battle-tested prompt base, not on the newest prompt engineering the flagship was already running.

Content only Fable's prompt has

Fable adds a handful of things Opus's prompt doesn't carry. A <budget:token_budget> header sets 190,000 as the session budget (fable:3–7) — Opus's prompt has no equivalent header and instead ends with a hard-coded "be concise" directive; Fable ends with <thinking_mode>auto</thinking_mode> instead (fable:3818). Fable's reminder set also adds a long_conversation_reminder alongside the existing image/cyber/system/ethics/IP reminders — appended by Anthropic's own infrastructure to help the model "keep its instructions over long conversations" (fable:146–148). And Fable carries five new wellbeing paragraphs Opus's prompt lacks: a ban on attributing a user's state to an undisclosed diagnosis, an extension of the self-harm substitution ban to cover mimicry techniques, and a rule against offering an unsolicited causal story for disordered eating (fable:114, 118, 130).

The counterintuitive part: shorter safety text, not longer

Fable is the model Anthropic describes as carrying "additional safety measures for dual-use capabilities." If you expected that to mean more cautionary text in the prompt, the diff says otherwise. Opus 4.8's prompt carries a full CBRN paragraph with a cumulative-uplift doctrine:

Fable's prompt — the one described as having the extra safety layer — reduces the entire weapons section to one sentence about "extra caution around explosives" (fable:60), with no cumulative-uplift language at all. That's the finding worth sitting with: the model marketed as more heavily safeguarded has the thinner safety text at the prompt layer.

This is an inference, and it should stay labeled as one: nothing in any of these files states outright where the dual-use enforcement lives. But the pieces line up. Sonnet 5's prompt is the only one that names the domains — "biology, cybersecurity, and LLM R&D" — and Fable's own reminder machinery already includes a cyber_warning and an ethics_reminder injected by Anthropic's infrastructure rather than written into the base prompt (fable:146; anthropic_reminders.md). Put those next to a shorter, not longer, weapons paragraph, and the most defensible reading is that "additional safety measures" describes something enforced downstream — classifiers, deployment gating, access control — rather than a longer warning baked into the text the model reads every turn.

Fable's prompt also carries two new child-safety bullets that are worth naming architecturally without walking through their mechanics. The gist, stated at the level the prompt states it: when Fable declines certain requests, it's instructed to state the principle rather than narrate the detection process behind it.

That's a real design choice worth understanding — avoid explaining a boundary in enough detail that the explanation becomes a map for working around it — and it's as far as this post goes into that section. The specific cues, thresholds, or test conditions the prompt uses aren't reproduced here, on the same logic the prompt itself states.

Same brain, two harnesses

The claude.ai prompt and the Claude Code harness prompt for Fable 5 are built from the same underlying identity, but they're structurally different documents — one is dominated by tool schemas and a memory system for a chat product, the other by an agentic tool suite for a coding agent. Comparing where the Fable/Opus tier difference actually lands in each tells you something the claude.ai diff alone doesn't: on Claude Code, the tier change is almost entirely about autonomy, not capability.

Diff claude-code-2.1.172-opus-4.8.md against claude-code-2.1.172-fable-5.md — same harness version, different model — and the diff is 33 lines. Every tool definition (Agent, Bash, Edit, Read, Task, Workflow, all of them) is byte identical between the two, including the Agent tool's model enum, ["sonnet","opus","haiku","fable"] — an Opus session can already dispatch a subagent to Fable, and vice versa, with no harness change required. Almost the entire 33-line diff is additions to Fable's copy: a communicating-with-the-user section, a code-comment discipline rule, the Fable/Mythos identity paragraph, and three rules about running unattended for longer. The next section walks each of those additions individually.

A few practitioner mechanics worth knowing about, tier question aside: the token_budget header and thinking_mode auto tag noted earlier are session-level settings, not personality. And Fable's scheduling tool carries its own cache-economics advice — because the prompt cache has a 5-minute TTL, it tells the model to avoid a wake-up interval that lands exactly on that boundary and to think in cache windows, not round numbers (code-fable:1048–1057). Cache economics, written into the agent's own instructions.

Anti-patterns: reading a leaked prompt too literally

• Treating a leak as a jailbreak map. A leaked prompt is documentation of how a vendor talks to its own model, not a set of exploitable seams. This post cites file lines for factual claims about tier architecture; it does not reproduce or explain detection mechanics, boundary conditions, or anything designed to help a reader reverse-engineer a safety behavior.
• Assuming a longer identity paragraph means more capable. Fable's wellbeing and memory sections run longer than Opus's in places — that's template lineage (an older, more verbose base) more than a signal about what the model can actually do. Prompt length and model capability are unrelated axes.
• Assuming "additional safety measures" must show up as prompt text. The whole point of §3 above: it doesn't here, and the enforcement most likely sits in a layer these files don't capture at all — classifiers, access gating, deployment controls.
• Treating a dated snapshot as the current product. The Sonnet 5 file, three weeks after Fable's, already describes Fable's own access as suspended. Anything read from these files should be read as "true as of this capture," not as Anthropic's current state.

Worked example: the 33-line Claude Code diff

Line groups are easier to reason about than a percentage. Below is the diff between claude-code-2.1.172-opus-4.8.md and claude-code-2.1.172-fable-5.md, walked group by group, in the order the additions appear in Fable's file.

1. A full "communicating with the user" section (lines 14–24)

Opus's Claude Code prompt has no equivalent section at all. Fable's adds one, and its central instruction is about where information has to live:

+ # Communicating with the user
+ Write for a teammate who stepped away and is catching up, not for a
+ log file. Text you write between tool calls may not be shown to the
+ user — everything they need must be in the final message.
+ Lead with the outcome. Being readable and being concise are
+ different things, and readable matters more. No fragments,
+ abbreviations, arrow chains like "A -> B -> fails", or jargon.

Nothing here changes what the agent is allowed to do — it changes how it's expected to report back once it's done, which matters more the longer a session runs unattended.

2. A code-comment discipline rule (line 28)

A narrow rule limiting comments to constraints the code itself can't express — never provenance, never a restatement of the next line, never a justification for why the change is correct. That kind of comment, the prompt argues, is "you talking to the reviewer" and becomes noise the moment the PR merges.

3. The Fable/Mythos identity paragraph (line 32)

The same tier paragraph quoted in the first section of this post is transplanted nearly verbatim into the Claude Code prompt — with "our most intelligent" swapped in for "the most intelligent." Opus 4.8's Claude Code prompt has no equivalent paragraph anywhere; its model identity is a single bullet under Environment. Fable is the only one of the two that tells the coding agent, in prose, what tier it's running on.

4. An autonomy block (lines 56–58)

+ You are operating autonomously. The user is not watching in real
+ time and cannot answer questions mid-task, so asking "Want me to...?"
+ or "Shall I...?" will block the work. Stop only for destructive
+ actions or genuine scope changes.

This is the block that most directly earns the "new tier" framing: Fable is instructed to keep going through exactly the kind of uncertainty that would make a more cautious harness stop and ask. The exception carved out alongside it matters as much as the rule — when a user is visibly thinking out loud rather than requesting action, the deliverable is the assessment, and the correct move is to report findings and stop.

5. A persistence / anti-quit rule (line 60)

+ Before ending your turn, check your last paragraph. If it is a plan,
+ an analysis, a question, a list of next steps, or a promise about
+ work you have not done ("I'll..."), do that work now with tool
+ calls. Do not stop because the context or session is long.

Paired with the autonomy block, this closes off the two most common ways an agent quietly stalls: asking permission it doesn't need, or ending a turn on a promise instead of the work the promise described.

6. An evidence-before-action rule (line 62)

Before any state-changing command, Fable's prompt adds an instruction to check that the evidence in front of it actually supports that specific action — because a signal that pattern-matches to a familiar failure can have a different cause. It's a guardrail against exactly the kind of confident, wrong action that "keep going, don't stop to ask" could otherwise encourage.

The one substitution

Everywhere else in the file, the two prompts are identical down to the model line: "You are powered by the model named Opus 4.8" becomes "You are powered by the model named Fable 5," with the matching model ID swapped alongside it (code-opus:29 ↔ code-fable:45). That one substitution, plus the six additions above, is the entire tier difference on Claude Code — every tool the agent can call is unchanged.

How this fails in practice

Reading tier differences out of a system prompt is a genuinely useful exercise, and it's also easy to over-read. These are the mistakes worth watching for in your own reading — or in a harness you're building based on what a leaked prompt seems to imply.

Assuming safety lives wherever the prompt talks about it most

Symptom: you read Fable's shorter weapons section and conclude the model is less carefully safeguarded than Opus, or you read "additional safety measures" in the marketing copy and go looking for a matching paragraph of extra caution in the prompt and don't find one. Cause: conflating prompt length with actual enforcement. A system prompt is one layer among several — classifiers, access gating, and deployment controls don't show up as prose at all, and this file set gives you no visibility into them. Fix: when a vendor claims added safety measures, treat the prompt diff as one data point, not the whole picture — and say so explicitly when you report a finding based only on prompt text, the way this post has tried to.

Treating an identity paragraph as a capability claim

Symptom: you read the autonomy block in Fable's Claude Code prompt and assume the model itself got better at long-horizon planning or tool use. Cause: the tool suite is byte-identical between Opus 4.8 and Fable 5 in this harness version — nothing about what the agent can technically do changed. What changed is the instruction about how long to keep going before checking in. Fix: separate "what the harness tells the model to do" from "what the model is newly capable of" — a prompt change is a policy change, not evidence of a capability change, unless a benchmark says otherwise.

Treating a leak snapshot as the live product

Symptom: citing Fable's June 9 prompt as current fact about what the model does today. Cause: a leaked prompt file is a capture at a point in time, not a synced feed — and this repo's own files prove the point: the Sonnet 5 capture from three weeks later already describes Fable's access as suspended under an export-control directive. Fix: date every claim to its file, the way this post has, and treat anything not re-confirmed in a more recent capture as historical, not current.

Copying autonomy language into a harness without its accountability pair

Symptom: you lift Fable's "don't stop to ask, keep going" language into your own agent's system prompt, and it starts taking destructive actions with the same confidence it used to reserve for safe ones. Cause: the autonomy block doesn't travel alone in the source prompt — it's paired with an explicit stop condition ("destructive actions or genuine scope changes") and a separate evidence-before-action rule that checks the reasoning behind a state-changing command before it runs. Copying the permission without the two rules that constrain it is copying half a design. Fix: if you adopt "operate autonomously," adopt its stop conditions and its evidence check in the same commit, not as a follow-up you'll get to later.

Trade-offs: what a tier difference on paper can and can't tell you

A leaked prompt is a genuinely rich source for some questions and close to useless for others, and it's worth being clear-eyed about the boundary.

It's a strong source for what the vendor tells the model about itself — identity framing, tier relationships, the exact wording chosen for a sensitive disclosure like "access is temporarily suspended." It's a strong source for harness-level behavioral policy — the autonomy and persistence rules in the Claude Code diff are exactly the kind of thing you can adapt into your own agent's configuration, with appropriate care about the rules that pair with them.

It's a weak source for where enforcement actually happens — the shorter weapons text in Fable's prompt tells you the enforcement probably isn't prompt-based, but it can't tell you what the classifier or gating layer actually does, because that layer isn't in the file. And it's a weak source for current state — every fact in this post is dated to a specific file capture, and the Sonnet 5 file already shows one of those facts (Fable's general availability) going stale within three weeks.

The practical rule: use a leaked prompt to generate hypotheses about vendor design intent and harness structure, and verify anything you'd actually build on — a capability claim, a safety claim, a current access status — against a source that updates, not a text file someone captured once.

Fable and Noddle Deck

The part of this diff most directly useful to anyone building their own agent isn't the identity paragraph — it's the autonomy layer. "Don't stop to ask, keep going, but stop for destructive actions and check your evidence before a state-changing command" is harness design you can apply regardless of which model you're running, and it's exactly the kind of policy that belongs in a skill or command rather than something you re-type into every agent session by hand.

Every Noddle Deck persona pack ships skills and commands that already assume the agent keeps going through a multi-step task instead of checking in after each one — the same posture Fable's Claude Code prompt adds on top of an unchanged tool set. Installing one is a fast way to see that posture applied to real tasks rather than re-deriving it from a leaked diff:

noddle-deck pack install developer

From there, browsing a pack's skills at /packs is a reasonable next step before you decide which parts of Fable's autonomy language, if any, belong in your own team's harness.