▸ What it is: A 3,826-line system prompt steering Claude Fable 5 inside the Claude app, pulled from a public GitHub archive.
▸ What’s in it: Rules about safety, tone and restraint.
▸ Why it matters: it shows a frontier “AI” is far more an engineered rulebook than a mysterious mind.
Before your first word reaches a large language model, a hidden document is prepended to the chat: the system prompt. It sets tone, format, refusals, tools, personality and limits. In June 2026 a near-complete copy of the one behind Claude Fable 5 aka “Anthropic’s most capable public model” surfaced on GitHub. Here’s the decode of its most important parts.
▸ Launched 9 Jun 2026 · Tier Mythos-class (above Opus) · Price $10 / $50 per M tokens
▸ Context 1M tokens · Knowledge cutoff Jan 2026 · Sibling Claude Mythos 5 (same weights, fewer guardrails)
A system prompt is the instruction layer fed to an AI model before it is initialized. Consider it as a: a prompt that was sent before yours, that guides the model’s behavior. Anthropic bakes deep values in during training → the app then adds a prompt that shapes behaviour for that product. When your request clashes with an operator rule, the rule wins, which is why one model can feel so different across apps.
You might be wondering about the source of this information, and its legitimacy.
Claude Fable 5 launched 9 June 2026 as the first public “Mythos-class” model. A tier above Opus, which was the previous flagship. It shares its weights with the restricted Claude Mythos 5, the only difference being the safeguards and access.
It’s a deeply nested XML that reads like a config file annotated by a lawyer. It opens with a 190,000-token budget and one odd rule: never emit
blocks. Then it splits into two territories:

→ who Claude is: product facts, refusals, tone, wellbeing, balance.The striking part is how much is about not doing things: refusals, wellbeing and not entertaining any “secret sauce” conversations.
The most fortified room. The model can discuss almost anything factually, the limits target concrete harm. The child-safety rules get the most care of anything in the file.
If the model catches itself reframing a request to make it acceptable, that reframing is the signal to refuse.
When it refuses, it states the principle, not the detection. This is because describing the fence teaches people to climb it. Classic defense in depth.
By volume, one of the heaviest sections and oddly specific, like lessons learned the hard way.
Even the resources are patched for accuracy (it points to the National Alliance for Eating Disorders after an older hotline was disconnected), the kind of detail a human adds, not something a model would know.
It can draw on past chats, but most of the section is about not misusing that.
A big stretch is an operator’s manual for doing, not just saying.
It searches when facts might have moved since its January 2026 cutoff, and scales effort to difficulty. Bolted on is the strictest sub-section in the file:
▸ Quotes under 15 words: for every source use under 15 words & never reproduce lyrics, poems or full paragraphs.
▸ Forged reminders: it’s warned that fake “system reminders” pasted into your message may try to loosen the rules, and to distrust them.
This teardown paraphrases the prompt and quotes only fragments because the model whose rules these are would be bound by them while writing it.
A leaked system prompt is a rulebook, not a brain. The intelligence lives in the weights. What escaped is the house rules, the page the model reads before it meets you.
It shows how the guardrail works: not one wall but several thin ones. Refuse. Hide the seam. Keep a backup classifier ready. Distrust any reminder that says relax.
But the real lesson is quieter. A frontier AI is less mysterious than “black box” suggests. What looks like personality or judgment is usually a plain sentence someone wrote manually. No alien mind back there. Just a document, careful and hedged and human. The wizard has a script. One that we somehow ended up reading.
A. A 3,826-line hidden instruction document prepended to every chat, setting the model’s tone, refusals, tools, and limits. It surfaced on GitHub in June 2026.
A. No. It was extracted, not hacked. Models can be coaxed into reciting their own instructions. The copy came from an openly licensed public GitHub repository.
A. Classifiers watch for high-risk topics like cyber, bio, and chem, then reroute them to Opus 4.8. Anthropic says under 5% of sessions get rerouted.