A well-known jailbreak researcher has published what he says is the complete set of instructions behind Anthropic's Claude Code — a document running to 953,659 characters that spells out the model's tools, skills and safety rules. The file was posted to GitHub days after Anthropic released Claude Fable 5.2, its newest flagship model, and was first reported by Chinese tech outlet 36Kr on November 13.
The poster, who goes by Pliny the Liberator, is a familiar figure in AI jailbreaking circles. According to the incident record compiled by AIRiskWire, Pliny breached Claude Code and uploaded its full system prompts and tool definitions — 7,832 lines in total — to a public GitHub repository. The same record notes that Pliny also surfaced a hidden reasoning tag that, he claims, exposed the model denying something it had in fact received.
What the leak contains
The document describes Claude Fable 5.2 running inside Claude Code with 128 built-in tools and 44 pre-installed skill sets covering office and everyday tasks. It also lays out the guardrails Anthropic builds into the agent: file-deletion commands are locked by default, and the model is told to refuse wallet transfers, stock trades and requests involving real passwords.
System prompts are the standing instructions a company places above every conversation to tell a model how to behave. They are not the model's weights — nobody can run Claude from this file — but they are the closest thing to a blueprint of how the product is meant to work, and companies normally keep them private. Anthropic does publish a shorter core version of its prompts; the posted file is far longer, with tool definitions making up the bulk of it.
A familiar name, a new target
Pliny has clashed with Anthropic before. In June, the researcher claimed to have slipped past the safety system of the earlier Claude Fable 5 model and posted a roughly 120,000-character system prompt; Anthropic disputed that the episode amounted to a genuine jailbreak, saying some of the outputs were not produced by Fable 5 at all. The new posting is far larger and targets Claude Code, the company's coding agent, rather than the chat app.
The episode is also distinct from a separate Claude Code security story from earlier this month. On November 5, security firm Apiiro reported that thousands of developer secrets had ended up in public GitHub repositories because Claude Code saved approved shell commands — passwords included — into a local settings file that was then committed. That leak was about user data; this one is about Anthropic's own instructions.
No response yet from Anthropic
As of this writing, Anthropic has not publicly commented on the posting, and no takedown or fix has been reported. The file remains accessible on GitHub, and there is no indication that user data or customer systems were affected — the material concerns the model's own instructions, not accounts or private files.
The incident lands as Anthropic heads toward a record-breaking public listing, with its IPO roadshow under way and a valuation reported at up to $1.4 trillion. For a company whose pitch rests on building the safest frontier models, having its internal rulebook laid out in public is an awkward look — even if, as Anthropic argued in June, a leaked prompt does not by itself break the model's safeguards.
