What the 120k‑Character Claude Fable 5 Prompt Leak Reveals About Its True Architecture

Prompt leak overview

In June 2026 security researcher @elder_plinius released a 1597‑line, ~120 KB system prompt for Claude Fable 5. The prompt was obtained from the GitHub transparency project; it is not an official Anthropic document but provides a complete view of the model’s agent‑style architecture.

Prompt size evolution

Anthropic began publishing system prompts in August 2024. Prompt size grew from 1.6 KB (Claude Code) to ~23 KB (Claude 3.5 Sonnet) and ~122 KB for Fable 5, reflecting added responsibilities rather than filler.

Model identity, product matrix, knowledge cutoff

When to use each ability, when not to, and error handling

Tool parameter contracts and front‑/back‑end alignment

Runtime injections: date, network whitelist, filesystem mounts

How to recover attention drift in long conversations

Six‑layer hierarchy

The document defines six layers ordered so that the behavior‑constraint layer precedes ability and tool layers.

Identity & Product – declares model identity, product matrix, knowledge cutoff (file header/footer).

Behavior‑constraint – security, ethics, tone, neutrality (10+ sub‑modules) placed immediately after identity.

Ability – memory, artifacts, MCP, search, computer_use, etc. (mid‑section).

Tool definition – full JSON‑Schema for 17 tools (nearly half the file).

Runtime context – date, network whitelist, file mounts, mode switches (file tail).

Cross‑cutting – dynamic injection reminders and copyright compliance (interleaved across layers).

Hard limits vs soft guidance

Rules use different strength markers. High‑risk items (copyright, child safety, malicious code) use uppercase SEVERE VIOLATION and absolute prohibitions, yielding near‑binary decisions. Low‑risk items (tone, personal opinion) use softer verbs such as should or prefers, delegating judgment to the model.

The copyright section illustrates a four‑layer defense: numeric limits, conceptual clarification, self‑check checklist, and example triples, compensating for LLMs’ tendency to reproduce training data.

MCP opt‑in design

Tools are split into directly callable internal tools and third‑party MCP services that require explicit user selection. Even in urgent scenarios the model must present candidate services for the user to choose, preserving neutrality and avoiding hidden commissions.

Runtime patches and configuration‑as‑code

Static prompts are supplemented by runtime patches that inject reminders, such as re‑anchoring attention in long dialogs. The file’s tail layer acts as a configuration file specifying network whitelists, read‑only mounts, date/place placeholders, and mode switches.

This mirrors the classic “code‑and‑configuration separation” principle, allowing stable core instructions while externalizing mutable environment parameters.

Tool contracts (17 utilities)

Each tool’s description field is a mini‑document detailing workflow; for example, a map tool description specifies a search step to obtain an ID followed by rendering, and distinguishes “simple” and “itinerary” modes.

Parameter ordering (description → path → content) aids auditability. A priority chain governs search behavior, and usage guidelines suggest limiting calls to 5‑10 for deep research, >20 for switching to a dedicated research function.

Claudeception ability

The “Claudeception” ability lets the model call its own API with injected keys, exemplifying a “model‑as‑platform” pattern.

Key engineering takeaways

Place hard constraints before capabilities to set the tone.

Grade constraints: hard limits for high‑risk items, soft guidance for low‑risk items.

Externalize mutable parameters as configuration layers, keeping core instructions stable.

Design tool contracts with detailed schemas and clear priority rules.

Use runtime patches to correct attention drift without altering the static prompt.

The 120 KB prompt demonstrates that modern system prompts have become a hybrid of natural‑language instructions, structured configuration, and interface contracts, offering a blueprint for building robust LLM agents.