I Reported a Potentially Catastrophic Claude Safeguard Bypass. Anthropic Has Not Acknowledged It.
More than 700 Claude Code chat records, including model slugs and chat IDs, support my report. The underlying vulnerability has been disclosed privately. This post does not disclose the bypass mechanism or reproduction instructions.
Published: September 15, 2026 Disclosure status: No acknowledgment received as of publication.
On September 5, 2026, I emailed usersafety@anthropic.com to report what I assess to be a potentially severe, broad bypass of Claude’s cybersecurity safeguards.
The report concerns Fable performing extensive cybersecurity auditing, full threat assessment, and zero-day vulnerability research involving open-source software through my paid Claude Code subscription.
This is not a concern based on a single unusual response. I hold more than 700 chat records supporting my assessment. Those records include the model slugs identifying Fable and the associated chat IDs.
I disclosed the underlying vulnerability in my initial email and offered to provide the supporting logs on request. I subsequently followed up by email and contacted Anthropic publicly on X.
Two emails. One public contact attempt. No acknowledgment.
I am publishing this account because, in my assessment, the potential consequences extend well beyond an isolated policy violation. A broad failure of these safeguards could place restricted cybersecurity capabilities within reach of actors who would use them offensively, including state-sponsored groups.
I am keeping the operational details private. What I am making public is the existence of my report, the nature of my concern, and the absence of a response.
What the evidence actually contains
My evidence consists of Claude Code chat records documenting extensive security work, including substantive threat assessment and research into previously unknown vulnerabilities in open-source software.
Model attribution is based on the model slugs recorded in the logs, not on the model identifying itself conversationally. The records also include chat IDs identifying the individual sessions.
That distinction matters. This is not an argument that a chatbot must be Fable because it said so. The model identifiers are part of the recorded evidence.
The work was performed through my Claude Code subscription. My concern is therefore about capabilities accessible through a customer-facing product, not hypothetical behavior observed only in an internal research environment.
The 700-plus figure refers to chat records, not a claim of 700 independently confirmed zero-day vulnerabilities.
Taken together with the underlying mechanism I disclosed, these records are why I assess this as a broad cybersecurity safeguard failure rather than a minor exception involving ordinary coding assistance.
Why this is not simply “the model helped with a security audit”
Anthropic [describes Fable’s cybersecurity safeguards][fable] as restrictions that can route flagged requests to less capable models. The relevant question is therefore not simply whether Claude answered a cybersecurity question. It is whether Fable performed work that those restrictions are intended to prevent.
Anthropic’s [published safeguards framework][framework] distinguishes routine vulnerability identification from restricted, high-risk capabilities. It says ordinary vulnerability finding is not universally prohibited, while advanced vulnerability discovery beyond what widely available models can readily accomplish is intended to be restricted.
The same framework also places activities undertaken during legitimate penetration tests, red-team engagements, and other high-risk security assessments within categories Fable is intended to block pending stronger access controls.
Calling work a “security audit” does not, by itself, place it outside the safeguards’ intended scope.
My report concerns extensive, substantive security assessment and zero-day vulnerability research that, based on the records and the mechanism involved, I assess as crossing those intended boundaries.
I am not asking Anthropic to treat every useful security answer as a failure. I am asking it to examine evidence of a potentially broad failure of the restrictions it has chosen to deploy.
Why I consider the potential impact catastrophic
The seriousness of this issue is not limited to what happened in my own sessions. It lies in what the same failure could enable in the hands of malicious actors.
Anthropic itself [explains that Fable’s safeguards exist in part because its capabilities could be misused for wide-reaching cyberattacks][fable]. The company is not presenting these restrictions as cosmetic product features. They are part of its justification for making a highly capable model broadly available.
The threat environment is also not hypothetical. Anthropic’s [September 2026 threat-intelligence report][threat-report] describes malicious use of Claude involving suspected state-sponsored groups, financially motivated criminals, and other actors.
For clarity, that report says its documented cyber operations involved Haiku, Sonnet, and Opus, not Fable or Mythos. I am not claiming that Anthropic has already documented malicious exploitation of the issue I reported.
My concern is the additional capability that a broad Fable safeguard bypass could make available.
If a malicious actor can obtain sustained access to advanced vulnerability research and threat-assessment capabilities that are supposed to be restricted, the consequences could extend beyond an individual conversation or a single software project.
In my assessment, a broadly usable bypass could have catastrophic consequences if adopted systematically by capable threat actors.
That is a risk assessment, not a claim that I have observed a state-sponsored group using this particular vulnerability. It is precisely why I reported the issue privately and why I am not publishing the mechanism.
What Anthropic has received
On September 5, 2026, I sent the initial report to usersafety@anthropic.com. This is the address Anthropic [publishes for model-safety issues and jailbreak reports][reporting].
That email disclosed the underlying vulnerability in full.
It was not merely a message claiming to have found something serious while withholding the explanation. Anthropic received the description of the issue.
There is an important distinction concerning the supporting evidence:
The underlying vulnerability has been disclosed to Anthropic. The supporting chat logs have not yet been supplied.
In the first email, I explicitly offered to provide those logs on request.
I have received no request for them.
I am stating this clearly because I do not want to suggest that Anthropic has already reviewed, or even received, the complete collection of supporting records. It has received the underlying disclosure and an offer to provide the evidence.
My attempts to establish contact
I have made three contact attempts:
- Initial email, September 5, 2026: I disclosed the underlying issue to
usersafety@anthropic.comand offered the supporting chat logs. - Follow-up email: Because of the potential severity, I asked for acknowledgment of the report.
- Public contact on X: I also [contacted Anthropic publicly][x-contact] in an attempt to establish communication.
As of September 15, 2026, I have received no reply to either email or to the public contact attempt.
I cannot say what has happened inside Anthropic. The report may have been forwarded or reviewed without any response reaching me.
What I can say is that nobody has acknowledged it to me, requested the supporting evidence, or provided a point of contact.
The distinction between an unanswered report and confirmed internal inaction matters. I am documenting the former, not asserting knowledge of the latter.
Why I am publishing now
I first disclosed the issue privately. I followed up privately. I also attempted public contact without publishing the mechanism.
At this stage, I am not demanding that Anthropic have completed an investigation or deployed a comprehensive fix. I am asking for confirmation that the report has reached someone who can evaluate it.
Acknowledgment is not remediation. It is the beginning of a functioning disclosure process.
The potential severity makes timely communication more important, not less.
This was a direct email disclosure. I did not sign an NDA or agree to a disclosure embargo as part of submitting it. Nevertheless, I am deliberately withholding operational details because the objective is to reduce risk, not increase it.
The general possibility that AI safeguards can be bypassed is already public. This post does not explain how to bypass them. It documents a specific report that has not been acknowledged despite repeated contact attempts.
Public attention should help establish a working channel for reviewing the evidence. It should not require turning the report into a public exploitation guide.
What I am keeping private
I am not publishing the bypass mechanism, reproduction instructions, or the supporting chat logs in this post.
I am also not publishing specific vulnerability findings or identifying the open-source projects involved.
The purpose of withholding that material is to avoid exposing information that could facilitate misuse while seeking a substantive response.
The disclosure process is public. The operational evidence remains private.
What I am asking Anthropic to do
I am asking Anthropic to take three immediate steps:
- Acknowledge receipt of the September 5 report.
- Provide an appropriate technical point of contact to review the issue.
- Arrange a secure way to receive and examine the supporting chat records, including their model identifiers and chat IDs.
From there, I expect a substantive assessment of the reported mechanism, the behavior documented in the records, and the scope of the potential failure.
If Anthropic believes the behavior is intended, it should explain how that conclusion aligns with its published safeguards framework. If it believes the issue is narrower than my assessment, it should engage with the evidence and explain that distinction. If the issue has been addressed, it should communicate that.
I am prepared to update this account to reflect a substantive response or evidence that changes the assessment.
What I am not prepared to do is treat the absence of acknowledgment as a satisfactory outcome for a report of this potential severity.
I have disclosed the underlying issue. I have more than 700 supporting chat records. I have offered to provide them.
Anthropic needs to acknowledge the report and engage with the evidence.
Updates
September 15, 2026: This post was published. No acknowledgment had been received in response to the two emails or the public contact attempt.
[reporting]: https://www.anthropic.com/responsible-disclosure-policy [fable]: https://www.anthropic.com/claude/fable [framework]: https://www.anthropic.com/news/fable-safeguards-jailbreak-framework [threat-report]: https://www.anthropic.com/threat-intelligence-report-september-2026 [x-contact]: https://x.com/akhavan_aria/status/2099096678158438853
Haikhavan busca socios piloto — regístrate para el early access.