From the Palo Alto Networks edition of November 10, 2026
Notebookcheck: Anthropic's system card shows Claude Fable 5.2 fallbacks to Opus 4.8 raise prompt-injection success for agents, contradicting a single 'perfect' score
Notebookcheck (reporting on Anthropic's Claude Fable 5.2 system card) · AI security / agent deployment · Global
- Publisher
- Notebookcheck
- Original publication
- Notebookcheck, published 11/10/2026, by Steffen Zahn
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-09
What happened
Notebookcheck reports figures from Anthropic's Fable 5.2 system card. When safety classifiers flag a request, a less capable model answers (Opus 4.8 for cyber topics), and the checks review everything the model reads, including connector content, web results and files. On Gray Swan's indirect prompt-injection benchmark, attack success after 15 attempts was 4.09% for Fable 5.2 versus 1.02% for Fable 5.1 and 0.96% for Opus 5.5; 53% of attempts against Fable 5.2 were served by Opus 4.8. Attacks succeeded 2.05% of the time when Fable 5.2 answered and 5.17% when Opus 4.8 did. In an adaptive coding test with 200 attempts per scenario, 89.82% succeeded without safeguards (almost all answered by Opus 4.8), falling to 28.16% with Anthropic's product injection probes. Automatic switching is on by default in Anthropic's apps and can be turned off.
Why it matters
Public-sector staff using Claude in Cowork, Claude Code or the browser to read email, web pages or third-party code are the exposed users. Interpretation: it directly tempers Palo Alto's same-day 0% claim for the same model: model-level scores depend on test conditions, attack budget and routing, and SLED AI policies should address fallback settings explicitly.
Evidence and measured results
Opened and read the full article dated 11/10/2026. All numbers are attributed to Anthropic's system card and help page; Notebookcheck did not run its own tests. The system card itself is already archived on the site (Anthropic stream) and was not re-opened in this run; a second independent write-up (Kortress, Nov. 10) reports the same figures and adds that API fallback is off by default.
Limitations and uncertainty
Secondary reporting of vendor (Anthropic) measurements; not independent testing. Benchmarks use specific harnesses and attack budgets that differ from Palo Alto's, so the two results are not directly comparable. The article is consumer-oriented and does not address enterprise admin controls beyond the user toggle.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Customers see conflicting security claims for the same AI model and need to know which controls actually reduce agent risk.
- Stakeholders
- CISO
- Application owners for Claude deployments
- AI governance committee
- Help desk and endpoint admins
- Discovery questions
- Which Claude surfaces do staff use for agent tasks?
- Is automatic model switching on or off, and who decided?
- Do agents read external email, web or repository content?
- Do you log which model answered each request?
- Value hypothesis
- Explicit fallback settings plus logging and least privilege can reduce exposure to injection on fallback paths, at the cost of more paused requests.
- Potential engagement
- A configuration and risk review of the customer's Claude agent deployments, covering fallback, logging and tool permissions.
- Unsupported claims
- That Fable 5.2 is immune to injection
- That turning off fallback eliminates injection risk
- That Anthropic and Palo Alto figures are directly comparable
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any SLED tenant running Claude agents on untrusted content, with or without Palo Alto controls.
- Architecture and integration
- Fallback is an app and API setting; endpoint and gateway controls should read the responding-model field to apply policy.
- Prerequisites
- Inventory of Claude surfaces in use
- Admin access to app settings or API configuration
- Logging of model identifiers
- Constraints
- User-level toggle may not be centrally enforceable on all surfaces
- API fallback behavior differs by platform
- Vendor-measured numbers only
- Security
- Restrict tool permissions on fallback-served responses and keep injection probes or inspection enabled.
- Proof of value
- Measure local fallback rate on representative agent tasks
- Compare injection test results with fallback on and off
- Verify logs capture the responding model
Delivery
Role takeaway
- Work
- Review and document model fallback settings and logging for each Claude deployment used for agent work.
- Dependencies
- Anthropic admin controls per surface
- Logging pipeline to SIEM
- Customer AI-use policy
- Ownership
- Application owner for each Claude deployment, with CISO approval of exceptions.
- Skills and adoption
- Admins and power users need guidance on what the switching notice means and when to pause or change models.
- Governance checkpoints
- Settings baseline approved before rollout
- Quarterly review of fallback rates
- Re-check after each model release
- Acceptance criteria
- Proposed: fallback setting documented for 100% of agent-enabled surfaces
- Proposed: responding-model field captured in logs for pilot users
- Proposed: injection test run on both routing paths
- Risks
- Silent routing to weaker models
- User friction leading to shadow tools
- Settings drift after updates
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The model that answers an agent request can differ from the one selected. Interpretation: architectures should log the responding model, and policy engines (including endpoint controls) should evaluate that model, not only the requested one.
Governance
Who approves, reviews and stays accountable for outcomes?
AI-use policies should state whether automatic model switching is allowed for agents that process untrusted content, and who may change that setting.
Security and privacy
What data, permissions and controls need testing?
Higher injection success on fallback paths means agents reading inboxes, websites or repositories may be more exposed than headline scores imply; data exfiltration via injected instructions is the described harm.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Users may see more paused requests if switching is turned off; help desks need guidance to avoid users moving to unapproved tools.
Procurement
What should contracts, pricing and exit terms secure?
AI platform agreements should confirm admin control over fallback routing and access to responding-model logs.
Operating model
Which teams own the service once it runs?
Application owners should treat fallback configuration as part of baseline settings, reviewed at each model release.
Publication history
- 2026-11-10Palo Alto Networks · Issue 117 resources
Stable resource ID: notebookcheck-claude-fable-5-2-fallback-prompt-injection-20261110