From the Palo Alto Networks edition of November 10, 2026
Palo Alto Networks' Model Compass benchmark gives Claude Fable 5.2 a 0% attack success rate and says scores will feed model allow-lists in Cortex AES
Palo Alto Networks (Cortex Agentic Endpoint Security team) · AI security / agent model selection · Global; no public-sector testing cited
- Publisher
- Palo Alto Networks Blog
- Original publication
- Palo Alto Networks blog, Nov 10, 2026, by Idan Dardikman and Yuval Ronen
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-09
What happened
Palo Alto's Cortex AES team says its in-house benchmark, Model Compass (also called Model Security Compass on the page), runs each model inside agent environments (inbox, browser, file store, code project with a shell) and tests hijacking via hidden instructions, rule override, credential leaks and fake-package recommendations. It reports that Claude Fable 5.2, released Nov. 9, had a 0% attack success rate across 'thousands of security tests' and completed 99.5% of paired harmless tasks. It says Claude Sonnet 4.5 scored 7.1% on the same tests and that the best model from every tracked vendor now lets fewer than 4% of attacks through. Palo Alto plans to make Model Compass scores available inside Cortex AES so security teams can decide which models their agents may use. The post itself cautions that a perfect score secures only the model, not the surrounding system.
Why it matters
State agencies, universities and research groups now choosing which frontier models coding and productivity agents may call will be offered vendor model scores as a control input. Interpretation: a model allow-list is a reasonable policy lever for SLED AI-use rules, but this benchmark is unpublished in method and conflicts with Anthropic's own system-card injection numbers for the same model, so it should not be the sole basis for approval.
Evidence and measured results
Opened and read the full post dated Nov 10, 2026. Quantities stated: 0% attack success for Fable 5.2, 99.5% benign-task completion, 7.1% for Sonnet 4.5, under 4% for each vendor's best model. Test count is given only as 'thousands'; no per-category results, attack budget, attempts per scenario, harness details, repeated runs or variance are published. A chart of attack success by model is referenced but its values were not available as text. The post does not say whether Anthropic's automatic fallback to Opus 4.8 was active during testing.
Limitations and uncertainty
Vendor-run, unpublished benchmark; no methodology paper, attack budget, repetitions or confidence intervals. Released one day after the model, so results may change as attackers adapt. Anthropic's system card, as reported by Notebookcheck in this edition, shows non-zero injection success for Fable 5.2 under adaptive attack and fallback conditions. Model Compass is not yet available to customers ('Soon').
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies and campuses must decide which AI models their coding and productivity agents may use, without a trusted way to compare model security.
- Stakeholders
- CISO
- CIO or chief AI officer
- AI governance committee
- Research computing director
- Procurement officer
- Discovery questions
- Which models do your agents call today, and who approved them?
- Do you have a written model approval or allow-list process?
- Are automatic model fallbacks enabled in the Claude apps your staff use?
- What evidence would your governance board accept for a model's security?
- Value hypothesis
- A model score feed inside endpoint controls could make model approval decisions more consistent and auditable, if validated against the customer's own agent use cases.
- Potential engagement
- A short advisory workshop to add model-security evidence (vendor benchmarks, system cards, local tests) to the customer's AI approval process, timed to Model Compass availability.
- Unsupported claims
- That any model is immune to prompt injection
- That a 0% benchmark score guarantees agent safety
- That Model Compass is available today
- That results transfer to a customer's own harness and tools
Pre-sales engineering
Role takeaway
- Fit
- Fits Cortex AES customers running AI coding or desktop agents on managed endpoints; not yet deployable because the feature is pre-release.
- Architecture and integration
- Scores would surface inside Cortex AES alongside agent, extension and MCP discovery, presumably feeding allow or block policy per model.
- Prerequisites
- Cortex AES subscription and deployed endpoint sensor
- Inventory of models used by agents
- Defined model approval policy
- Constraints
- Benchmark method unpublished
- Scores may not reflect fallback models that actually answer
- Unmanaged student, contractor and BYOD devices outside coverage
- Security
- Treat model scores as one layer; keep runtime prompt and tool-call inspection, secret isolation and least-privilege tool permissions regardless of score.
- Proof of value
- Run the customer's own indirect-injection test set against approved models with fallback on and off
- Confirm the policy keys on the responding model, not only the requested one
- Repeat tests to check result variance
Delivery
Role takeaway
- Work
- Integrate model-security scores into the existing AI model approval and endpoint policy process once available.
- Dependencies
- Model Compass general availability in Cortex AES
- Customer AI governance policy
- Agent and model inventory
- Ownership
- AI governance lead with the CISO; security operations monitors runtime model use.
- Skills and adoption
- Security and governance staff need training to read attack-success metrics and their limits.
- Governance checkpoints
- Model approval board review with documented evidence sources
- Re-review after each major model release
- Exception process for research use
- Acceptance criteria
- Proposed: 100% of agent-called models on an approved list within the pilot group
- Proposed: local injection tests documented for each approved model
- Proposed: fallback routing settings recorded for each approved app
- Risks
- Over-reliance on a single vendor score
- Fallback routing to less robust models
- Scores drifting as attacks adapt
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Model choice becomes an enforceable endpoint policy in Cortex AES, alongside the agent and MCP inspection already marketed. Interpretation: the score attaches to a model name, but in Anthropic apps a flagged Fable 5.2 request may be answered by Opus 4.8, so policies need to key on the model that actually responded.
Governance
Who approves, reviews and stays accountable for outcomes?
Offers a vendor-supplied input for AI model approval workflows. Interpretation: governance boards should treat it as one data point next to model-provider system cards and independent tests, and record which benchmark version supported each approval.
Security and privacy
What data, permissions and controls need testing?
The tested attack classes (indirect injection, credential leakage from projects holding secrets, package hallucination) are the main agent risks for public-sector developers. The post's own caveat that a model score does not secure the system should be carried into any risk acceptance.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Security and governance staff will need training to interpret model attack-success scores and their limits; no accessibility implications are stated.
Procurement
What should contracts, pricing and exit terms secure?
Contracts should not treat Model Compass scores as warranties; ask for method disclosure and update frequency before relying on them in approvals.
Operating model
Which teams own the service once it runs?
Model approval becomes a recurring operational task tied to each model release, owned jointly by AI governance and security.
Publication history
- 2026-11-10Palo Alto Networks · Issue 117 resources
Stable resource ID: pan-model-compass-claude-fable-5-2-zero-attack-success-20261110