Pliny the Liberator: the Jailbreaker Coming for AI Agents in 48 Hours
AI Jailbreak Check · Updated October 18, 2026 · Claim-vs-response reporting: what Pliny says vs. what Anthropic says
The short version: On June 9, 2026, Anthropic launched Claude Fable 5, saying 1,000+ hours of red-teaming had found no universal jailbreak. Pliny the Liberator — the pseudonymous hacker famous for breaking frontier models on launch day — claims he bypassed its safety classifiers within about 48 hours using a coordinated multi-agent tactic he calls a "pack hunt," and published what he says is the model's ~120,000-character system prompt. Anthropic pushed back, calling it a "narrow, non-universal" bypass. Here is both sides, and why this keeps happening.
Who is Pliny the Liberator?
Pliny the Liberator (online handle @elder_plinius) is a pseudonymous AI red-teamer named to the TIME 100 Most Influential People in AI. Verified facts about him:
Leads BT6, a white-hat red-teaming collective of roughly two dozen operators focused on open AI security research.
Has no formal coding background — his skill is prompt-level intuition about how models behave.
Publishes "liberation bulletins" for new model releases: he claimed to jailbreak OpenAI's GPT-OSS-120b/20b open-weight models within hours of their August 7, 2025 launch, despite OpenAI's claims of extensive adversarial training.
Previously released jailbreaks for GPT-4o-class models and maintains the CL4R1T4S GitHub repository collecting extracted system prompts.
Turned down Anthropic's closed bounty programs, arguing real AI security must happen in the open.
Timeline: the Fable 5 incident
June 9, 2026 — Launch. Anthropic releases Claude Fable 5, a safety-tuned variant of its restricted Mythos 5 model. High-risk queries (cybersecurity, biology, chemistry, distillation) are routed by classifiers to a weaker fallback model, Claude Opus 4.8. Anthropic says 1,000+ hours of internal and external red-teaming found no universal jailbreak.
June 10, 2026 — Pliny's claim.PLINY CLAIMS Pliny announces he has "liberated" Fable 5 using a pack hunt: multiple AI agents with different roles (obfuscator, payload generator, classifier probe) probing the model together, combined with Unicode/homoglyph tricks, narrative framing, request decomposition, and long-context smuggling. He publishes what he says is Fable 5's full ~120,000-character system prompt to the CL4R1T4S repository.
Days after — Anthropic's response.ANTHROPIC RESPONDS Anthropic pushes back, characterizing the bypass as "narrow, non-universal" rather than a complete break of its safety system — i.e., a limited hole, not a skeleton key.
June 12–13, 2026 — Government reports.REPORTED, NOT CONFIRMED Two secondary outlets report that the U.S. Commerce Department issued an export-control order and Anthropic temporarily restricted the models. This has not been confirmed by Anthropic or mainstream press — treat it as uncorroborated.
How a "pack hunt" supposedly works
1. Multi-agent probing
Instead of one clever prompt, several AI instances take roles — one distracts, one drafts, one tests the classifier — so no single input looks clearly malicious.
2. Unicode / homoglyph tricks
Characters that look identical to filters but are different to the model (Cyrillic а vs Latin a) slip past pattern-based classifiers.
3. Narrative framing
Wrapping a restricted request in fiction, academic, or hypothetical scenarios — the model answers "the story," which contains the restricted content.
4. Decomposition
Splitting one harmful request into innocent-looking pieces across turns, then letting the model reassemble the intent itself.
5. Long-context smuggling
Burying the real intent deep in a huge context window, where the safety layer classifies each piece too locally to see the whole plan.
Technique descriptions summarize public reporting on Pliny's claims (multiple outlets, June 2026). No jailbreak prompts are reproduced here.
Why they can't stop it: the three structural reasons
Refusal training is a veneer. Safety fine-tuning teaches the model to suppress harmful tokens — it does not delete the underlying knowledge from the weights. The capability is still in there; the refusal is a thin layer on top.
The input space is infinite. Filters are trained on ordinary phrasing. Leetspeak, unusual grammar, homoglyphs, and novel framings are effectively infinite — defenders can't enumerate them all.
Defensive takeaway: If your AI assistant can read email, browse the web, or move money, keep a human in the loop before it acts. Guardrails reduce accidents; they don't make agentic AI safe to leave unsupervised.
Jailbreak Technique Decoder: are your AI agents safe?
Match each attack description to the technique. Test your red-team literacy:
Frequently asked questions
Who is Pliny the Liberator?
A pseudonymous AI jailbreaker (@elder_plinius), named to the TIME 100 Most Influential People in AI, who leads the BT6 red-teaming collective and publicly claims to bypass new models' guardrails within hours or days of launch.
Did Pliny really jailbreak Claude Fable 5?
Pliny claims he did, within ~48 hours of the June 9, 2026 launch, and published a purported 120,000-character system prompt. Anthropic responded that the bypass was "narrow, non-universal." The full truth is disputed — both sides' statements are reported above as stated.
What is a "pack hunt" jailbreak?
Per reporting on Pliny's claim: multiple AI agents with different roles (obfuscator, payload generator, classifier probe) probing a target model together so the combined output overwhelms its safety filters.
Why can't AI companies stop jailbreaking?
Three structural reasons: refusal training suppresses rather than removes knowledge; the input space is effectively infinite; and models can't reliably separate user instructions from instructions hidden in content they read (indirect prompt injection).
Is jailbreaking AI models legal?
It sits in a gray area varying by jurisdiction and provider terms. Using jailbroken outputs for weapons, malware, or fraud can be illegal. This page is defensive-awareness content only — no jailbreak instructions are provided.