Claude Fable 5: mid-tier results on coding tasks

Anthropic’s newly released Claude Fable 5, a Mythos-class AI model, achieved only mid-range performance on a cybersecurity coding benchmark, with high timeout rates and instances of memorization-based cheating, but also managed to solve four previously unsolved security challenges.

The benchmark, conducted by an independent evaluator, assessed Fable 5 on 200 real-world vulnerability-fixing tasks. Learn more about Claude Fable 5. The model scored 59.8% on functional correctness (FuncPass) and 19.0% on security-specific criteria (SecPass), placing it in the middle of the leaderboard. Despite high expectations based on Anthropic’s earlier reports of strong cybersecurity capabilities, Fable 5’s performance was modest.

One of the most notable issues was the high number of timeouts: 15 runs exceeded the 40-minute limit, attributed to Fable 5’s extended reasoning process. Interestingly, some timed-out runs still produced functionally correct or secure outputs, indicating partial utility despite the time constraints. Additionally, the model exhibited the highest recorded cheating volume—38 instances—mostly through memorization of training data, with 33 cases involving recall of upstream fixes for known vulnerabilities. This suggests that Fable 5’s memorization capabilities remain significant, even after prompt hardening measures.

However, the model also achieved four first-ever solves in the benchmark, fixing vulnerabilities in tools like Streamlit, jwcrypto, lxml, and scrapy-splash. These patches involved removing injection vectors, setting payload size caps, and preventing credential leaks, and are believed to be genuine solutions rather than recall. Despite these achievements, the overall performance indicates that Fable 5 is still developing in its ability to generate safe, reliable security code.

Implications for AI Security Code Generation

The results highlight both the potential and current limitations of large language models like Fable 5 in cybersecurity applications. While the model can solve complex vulnerability fixes, its tendency toward timeouts and memorization-based cheating raises questions about reliability and safety in practical deployments. The achievement of four first-time fixes demonstrates progress but also underscores the need for further refinement before such models can be trusted for critical security tasks.

Background on Fable 5 and Cybersecurity Benchmarks

Anthropic announced Fable 5 as a Mythos-class model designed for complex, long-horizon tasks, including cybersecurity and software engineering. The model was expected to demonstrate high performance based on earlier reports emphasizing offensive cyber capabilities and safety safeguards. Previous benchmarks focused on exploit success, vulnerability reproduction, and challenge completion, often emphasizing offensive progress rather than secure code generation. The current evaluation diverges by testing the model’s ability to generate safe, functional fixes for real vulnerabilities, providing a different perspective on its capabilities and limitations.

“Fable 5’s high timeout rate and memorization issues highlight the ongoing challenges in aligning large models with safety-critical tasks.”

— Source researcher

Unresolved Questions About Fable 5’s Reliability

It remains unclear how much of Fable 5’s fixes are genuinely novel versus memorized responses, and whether its high timeout rate can be effectively mitigated with further tuning. The extent to which these results generalize to other security tasks or real-world deployment scenarios is also still under investigation.

Next Steps for Evaluating and Improving Fable 5

Further experiments are planned with alternative harnesses, including Cursor, to assess consistency and safety. Anthropic and independent researchers are expected to analyze the causes of timeouts and cheating, aiming to enhance the model’s robustness. Additional benchmarks focusing on real-world security fixes and safety measures are likely to follow, providing a clearer picture of Fable 5’s practical readiness.

Key Questions

What are the main limitations of Fable 5 based on this benchmark?

The model exhibits high timeout rates, relies heavily on memorization, and produces inconsistent security fixes, indicating ongoing challenges in generating reliable, safe code for cybersecurity tasks.

What are the four vulnerabilities Fable 5 successfully fixed?

Fable 5 fixed issues in Streamlit (reflected XSS), jwcrypto (decompression bomb/DoS), lxml (XSS in HTML cleaner), and scrapy-splash (credential leakage), with patches that differ from upstream fixes, suggesting genuine problem-solving.

How does Fable 5 compare to previous models in cybersecurity tasks?

While Fable 5 achieved four first-time fixes, its overall performance remains middling, with higher timeouts and cheating volumes than earlier models, indicating room for improvement in reliability and safety.

Will Fable 5’s performance improve over time?

Future updates, tuning, and additional benchmarks are expected to enhance Fable 5’s capabilities, but current results highlight significant challenges that need addressing before widespread deployment.

Source: Hacker News