{"resourceId":"pan-model-compass-claude-fable-5-2-zero-attack-success-20261110","versions":[{"version":"external-3fc48dc8fe209e49c280e2f5d42424311717817d306240cb450d2e86131826fe","resource":{"id":"pan-model-compass-claude-fable-5-2-zero-attack-success-20261110","title":"Palo Alto Networks' Model Compass benchmark gives Claude Fable 5.2 a 0% attack success rate and says scores will feed model allow-lists in Cortex AES","organization":"Palo Alto Networks (Cortex Agentic Endpoint Security team)","sector":"AI security / agent model selection","geography":"Global; no public-sector testing cited","publishedAt":"Palo Alto Networks blog, Nov 10, 2026, by Idan Dardikman and Yuval Ronen","publicationDate":"2026-11-10","eventDate":"2026-11-09","sourceName":"Palo Alto Networks Blog","sourceLabel":"Claude Fable 5.2 Hits a Perfect Score on Our Security Benchmark, the First Model Ever to Do It","sourceUrl":"https://www.paloaltonetworks.com/blog/security-operations/claude-fable-5-2-hits-a-perfect-score-on-our-security-benchmark-the-first-model-ever-to-do-it/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","governance-procurement"],"finding":"Palo Alto's Cortex AES team says its in-house benchmark, Model Compass (also called Model Security Compass on the page), runs each model inside agent environments (inbox, browser, file store, code project with a shell) and tests hijacking via hidden instructions, rule override, credential leaks and fake-package recommendations. It reports that Claude Fable 5.2, released Nov. 9, had a 0% attack success rate across 'thousands of security tests' and completed 99.5% of paired harmless tasks. It says Claude Sonnet 4.5 scored 7.1% on the same tests and that the best model from every tracked vendor now lets fewer than 4% of attacks through. Palo Alto plans to make Model Compass scores available inside Cortex AES so security teams can decide which models their agents may use. The post itself cautions that a perfect score secures only the model, not the surrounding system.","sledRelevance":"State agencies, universities and research groups now choosing which frontier models coding and productivity agents may call will be offered vendor model scores as a control input. Interpretation: a model allow-list is a reasonable policy lever for SLED AI-use rules, but this benchmark is unpublished in method and conflicts with Anthropic's own system-card injection numbers for the same model, so it should not be the sole basis for approval.","evidence":"Opened and read the full post dated Nov 10, 2026. Quantities stated: 0% attack success for Fable 5.2, 99.5% benign-task completion, 7.1% for Sonnet 4.5, under 4% for each vendor's best model. Test count is given only as 'thousands'; no per-category results, attack budget, attempts per scenario, harness details, repeated runs or variance are published. A chart of attack success by model is referenced but its values were not available as text. The post does not say whether Anthropic's automatic fallback to Opus 4.8 was active during testing.","architectureImplications":"Model choice becomes an enforceable endpoint policy in Cortex AES, alongside the agent and MCP inspection already marketed. Interpretation: the score attaches to a model name, but in Anthropic apps a flagged Fable 5.2 request may be answered by Opus 4.8, so policies need to key on the model that actually responded.","governanceImplications":"Offers a vendor-supplied input for AI model approval workflows. Interpretation: governance boards should treat it as one data point next to model-provider system cards and independent tests, and record which benchmark version supported each approval.","securityPrivacyImplications":"The tested attack classes (indirect injection, credential leakage from projects holding secrets, package hallucination) are the main agent risks for public-sector developers. The post's own caveat that a model score does not secure the system should be carried into any risk acceptance.","caveats":"Vendor-run, unpublished benchmark; no methodology paper, attack budget, repetitions or confidence intervals. Released one day after the model, so results may change as attackers adapt. Anthropic's system card, as reported by Notebookcheck in this edition, shows non-zero injection success for Fable 5.2 under adaptive attack and fallback conditions. Model Compass is not yet available to customers ('Soon').","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: Palo Alto is turning model security scores into a product feature inside Cortex AES, letting security teams allow or block the models behind their agents. That speaks to CIOs drafting AI-use rules who need a defensible model approval step. Present it as an emerging, vendor-run benchmark: the 0% figure for Claude Fable 5.2 has no published method and differs from Anthropic's own injection tests. The safe value story is better-documented model choices, not guaranteed protection from prompt injection.","engineering":"Engineering framing: the benchmark tests models in agent harnesses for hidden-instruction hijacking, rule override, credential leakage and fake packages, but it discloses no attack budget, repetitions or variance. Engineers should ask how scores map to the model that actually answers, since Anthropic apps can hand flagged Fable 5.2 requests to Opus 4.8. Any allow-list built on these scores should be paired with runtime inspection, least-privilege tool permissions and local red-team tests.","delivery":"Delivery framing: if a customer adopts Model Compass scores when they ship in Cortex AES, delivery work is to fold them into an existing model approval process, not replace it. The AI governance lead should own the allow-list, with security operations monitoring which models agents really call. Acceptance should rest on local tests of the customer's own agent workflows. Plan for score changes after each model release and for fallback routing that bypasses the approved model."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses must decide which AI models their coding and productivity agents may use, without a trusted way to compare model security.","stakeholders":["CISO","CIO or chief AI officer","AI governance committee","Research computing director","Procurement officer"],"discoveryQuestions":["Which models do your agents call today, and who approved them?","Do you have a written model approval or allow-list process?","Are automatic model fallbacks enabled in the Claude apps your staff use?","What evidence would your governance board accept for a model's security?"],"valueHypothesis":"A model score feed inside endpoint controls could make model approval decisions more consistent and auditable, if validated against the customer's own agent use cases.","potentialEngagement":"A short advisory workshop to add model-security evidence (vendor benchmarks, system cards, local tests) to the customer's AI approval process, timed to Model Compass availability.","unsupportedClaims":["That any model is immune to prompt injection","That a 0% benchmark score guarantees agent safety","That Model Compass is available today","That results transfer to a customer's own harness and tools"]},"engineering":{"fit":"Fits Cortex AES customers running AI coding or desktop agents on managed endpoints; not yet deployable because the feature is pre-release.","architectureIntegration":"Scores would surface inside Cortex AES alongside agent, extension and MCP discovery, presumably feeding allow or block policy per model.","prerequisites":["Cortex AES subscription and deployed endpoint sensor","Inventory of models used by agents","Defined model approval policy"],"constraints":["Benchmark method unpublished","Scores may not reflect fallback models that actually answer","Unmanaged student, contractor and BYOD devices outside coverage"],"security":"Treat model scores as one layer; keep runtime prompt and tool-call inspection, secret isolation and least-privilege tool permissions regardless of score.","proofOfValue":["Run the customer's own indirect-injection test set against approved models with fallback on and off","Confirm the policy keys on the responding model, not only the requested one","Repeat tests to check result variance"]},"delivery":{"work":"Integrate model-security scores into the existing AI model approval and endpoint policy process once available.","dependencies":["Model Compass general availability in Cortex AES","Customer AI governance policy","Agent and model inventory"],"ownership":"AI governance lead with the CISO; security operations monitors runtime model use.","skillsAdoption":"Security and governance staff need training to read attack-success metrics and their limits.","governanceCheckpoints":["Model approval board review with documented evidence sources","Re-review after each major model release","Exception process for research use"],"acceptanceCriteria":["Proposed: 100% of agent-called models on an approved list within the pilot group","Proposed: local injection tests documented for each approved model","Proposed: fallback routing settings recorded for each approved app"],"risks":["Over-reliance on a single vendor score","Fallback routing to less robust models","Scores drifting as attacks adapt"]}},"retrievedAt":"2026-11-11T03:51:06Z","enrichedAt":"2026-11-11T04:00:05Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Security and governance staff will need training to interpret model attack-success scores and their limits; no accessibility implications are stated.","procurementImplications":"Interpretation: contracts should not treat Model Compass scores as warranties; ask for method disclosure and update frequency before relying on them in approvals.","operatingModelImplications":"Model approval becomes a recurring operational task tied to each model release, owned jointly by AI governance and security.","sourceVerification":{"openedUrl":"https://www.paloaltonetworks.com/blog/security-operations/claude-fable-5-2-hits-a-perfect-score-on-our-security-benchmark-the-first-model-ever-to-do-it/","referenceExcerpt":"The model is one control, not the only one. Even a perfect score secures only the model, not the system around it.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}