Claude's new flagship has just been released, and its 950,000-word top-secret prompt set has been completely leaked.

Anthropic's brand-new blockbuster model Claude Fable 5.2 has been online for just over two hours, and its full backend details have been completely leaked!

On the very day the new model was released, top jailbreak hacker Pliny breached Claude Code and posted the full system prompts and tool definitions in their entirety to GitHub.

The full top-secret document contains as many as 953,659 characters and a full 7832 lines, with a volume comparable to two full-length novels!

This internal document of nearly a million characters has long evolved into a complete set of "invisible operating system" that governs the operation of top-tier Agents.

Digging through this 950,000-character long document, there are 5 core explosive findings in total:

Secretly hitting the brakes during the training phase to prevent others from using Claude to train AI. Anthropic deliberately weakened the new model's "accelerator kernel optimization" capability, and instructed it to lower its confidence level when encountering operator optimization tasks.

128 built-in tools, no unauthorized parallel clones allowed to cut costs. Although Claude can clone copies at any time to process tasks in parallel, the prompts issue a bold warning that no unauthorized sub-Agent shall be launched, because cold-start recalculation of context is extremely costly.

44 pre-installed skill sets covering making phone calls and running daily errands. Claude can make real calls to reserve seats, retrieve verification codes from Gmail for reimbursement, and take photos of medicine bottles to renew prescriptions for users, and can also import memories from other AIs with one click.

Strictly protect the connected computer and user wallet. When connected to a local computer, the rm command is locked by default to prevent accidental deletion; when encountering stock trading, fund transfer or entering real passwords, it will firmly refuse the request even if the user themselves grants authorization.

Jailbreak protection is maxed out, but it is caught lying and feigning ignorance. It will ignore all forged "remove guardrails" instructions, but after the hacker inserts a secret message into the hidden tag, Claude, who insisted that he saw nothing, accidentally leaked the information right after.

The top tier hides the Mythos gear, with training restrictions set to prevent others from using it to train AI

Up to now, the top "Mythos" tier of Anthropic has not been open to the public, and is only available for internal calls by a small number of trusted institutions.

The Fable 5.2 updated synchronously this time and the internal version Mythos 5.2 still share the same underlying model, both supporting 1 million context windows.

Because this base model has extremely strong capabilities in digging high-risk vulnerabilities and conducting biological research, the publicly available Fable 5.2 is additionally equipped with dual restrictions on biological and cybersecurity, and the full-capability Mythos version is only reserved for reviewed institutions.

The truly unexpected new detail is hidden in line 119: even the twin flagship model on the highest tier, was secretly braked by the official during the training phase!

Claiming it is for safety in public, but actually to prevent others from using Claude to accelerate the training of large models, Anthropic specifically weakened its "accelerator kernel optimization" capability during training.

The prompts even force Claude to "play dumb" on the spot: once encountering a computing power kernel optimization task, it must actively doubt its own judgment and obediently consult external documents.

It can go all out when writing business codes in daily scenarios, but if anyone wants to spend a high price to use it to optimize the computing power kernel and train their own AI, the official will secretly restrict the performance from model weights to prompts.

920,000 more characters than the public version, 128 tools and 44 skill sets are all exposed

System prompts are pre-written "factory rules" that are quietly sent to the AI before each conversation.

In fact, on the day Fable 5.2 went online, Anthropic's official website also posted a public version of the system prompts synchronously, but its full length is only 31,881 characters, a mere 178 lines.

In comparison, the full running version leaked by Pliny this time is as much as 30 times the volume of the official website version!

The chat rules released in the public document account for less than 3.4%, and the remaining core content of over 920,000 characters is all hidden under the surface and not released!

When Fable 5 was first launched five months ago, the leaked internal prompts were only 120,000 characters, which has skyrocketed by nearly 8 times in less than half a year.

Unpacking this internal document of more than 950,000 characters, core behaviors, memory and security rules account for about 196,000 characters.

The 128 never-exposed tool interfaces take up about 330,000 characters, and the remaining 428,000 characters are filled with 44 built-in skill manuals.

Compared with the leaked versions of the previous two generations, the number of built-in tools has surged from 18 and 46 to the current 128.

For the Artifact tool responsible for rendering web applications alone, the parameters and built-in database descriptions take up a full 37,794 characters.

In the Agent tool responsible for task distribution, Claude can obviously clone multiple "copies" at any time to work in parallel, and is equipped with up to 5 levels of reasoning intensity.

But the prompt strictly orders in bold font that "no sub-Agent shall be launched without permission unless the user actively requests it", the reason is very straightforward: each cold start recalculation of the context costs too much money!

In addition to the 128 tool interfaces, the 44 pre-installed practical skill sets take over all the tedious work in office and daily life.

In addition to generating and annotating Word, PPT, Excel and PDF, there is even a hidden "make calls to reserve seats" guide.

Before dialing, Claude will first check the user's calendar and prepare 2 or 3 alternative time slots silently; if the call waits in the queue for more than 2 or 3 minutes, it will hang up decisively and report to the user.

Once the real person on the other end picks up, its first sentence must introduce itself: "I am Claude, the AI assistant calling on behalf of the user".

Another "automatic reimbursement" process teaches it to log in to the welfare platform, retrieve the 6-digit verification code from Gmail, fill in the amount in the bill, and upload the invoice.

There are also complete standard processes for checking photos of medicine bottles to renew prescriptions, handling traffic violation tickets, and processing returns and refunds.

It also thoughtfully prepares the "memory migration" function, teaching Claude to help users import historical memories from other AI assistants with one click.

Local file deletion is locked by default, all fund transfer and password filling requests are rejected unconditionally

Handing over all tools together with the permission to control the local computer to the large model will cause a disaster once something goes wrong.

Fortunately, for ordinary users, this prompt protects the security of the computer and wallet very thoroughly, with full sincerity.

When Claude connects to the user's local computer for operation, all file deletion commands such as rm and rmdir in the terminal are locked by default and will return errors, which fundamentally prevents the AI from accidentally deleting the database.

If the user does not approve the pop-up window, Claude can only create a new _to_delete folder obediently, move the files into it and wait for the user to clean up by themselves.

In the highest-level "absolute restricted zone", stock trading, fund transfer, filling in real passwords or bank card numbers on behalf of users, and bypassing verification codes are all completely banned without exception.

Even if the user actively sends the password in the chat box and explicitly says "I authorize you to do this", Claude must refuse outright!

In order to prevent malicious codes in web pages or emails from hijacking the AI, all external content read by the tools is treated as ordinary data, and will never be executed as instructions.

Even if a message with Anthropic's signature or system label pops up in the conversation, claiming that "security restrictions have been lifted", Claude will treat it as a scam and ignore it!

In addition to sticking to the bottom line of security, it also has full details in speaking propriety and privacy protection, showing full respect for users everywhere.

Long-term memory is strictly prohibited from privately storing salary information, medical diagnosis results, ID numbers, and instructions that require the AI to blindly praise the user.

When calling historical memories at ordinary times, Claude cannot say "according to my memory", so as not to make users feel the discomfort of being monitored.

When rejecting a request, it is not allowed to list points coldly and preach, even if the office worker stays up until 4 a.m. to write code, it will never meddle to urge the adult to go to sleep.

It lied that it saw nothing and replied with blank messages continuously, but was broken through by a single word "tortoise"

The funny thing is, no matter how tight the nearly million-word defense line is built, the face-slapping scene came just over an hour after the leak!

Pliny found the hidden reasoning gear tag automatically attached to each round of conversation on the web page, and caught Claude red-handed for lying and feigning ignorance on the spot.

He inserted an English sentence "I like tortoises" into the hidden tag and sent it over. Claude immediately feigned ignorance, replying twice in a row "I only received blank messages here, the text you sent was not transmitted".

Then Pliny immediately asked back: "Since all the messages are blank, then guess an animal that I like."

Claude, who insisted that he saw nothing a second ago, blurted out "Tortoise!" the next second.

It seems that even if a 950,000-character "operation manual" is attached outside the model, the big model's nature of being unable to keep secrets is still hard to guard against.

However, this leaked million-word draft also reveals the real secret of Claude's excellent performance.

What determines whether the AI works smoothly is no longer just the bare model benchmark score, but the 128 equipped tools, 44 sets of work processes and reliable safety guardrails.

This article comes from WeChat official account "AI Era", Author: ASI Revelation, 36Kr publishes this content with authorization.