Anthropic has recently unveiled its latest model, Fable, which is positioned as a public and limited iteration of its highly anticipated cybersecurity model, Mythos. Released on Tuesday, Fable aims to enhance cybersecurity capabilities, but it has sparked discontent among some experts regarding its restrictive features.
Several cybersecurity professionals have expressed their concerns online, noting that Fable imposes stringent limitations. Valentina "Chompie" Palmiotti, a prominent security researcher at IBM X-Force, remarked that Fable often declines requests related to cybersecurity, stating, "Even innocuous tasks like reading a blog post" are flagged.
When a user prompt activates its guardrails, Fable interrupts the conversation, indicating that its "safety measures flagged this message for cybersecurity or biology topics." These guardrails were implemented to mitigate the risks associated with potential misuse of the model for creating malware or compromising software--a significant concern for Anthropic.
The restrictions on biological topics stem from similar apprehensions about the development of biological threats. Previously, when Mythos was introduced in April, its access was limited to select organizations as part of Project Glasswing, aimed at securing essential software and infrastructure. Recently, Anthropic expanded Mythos's availability to hundreds of organizations across 15 countries.
Despite the intention behind these measures, many cybersecurity experts find the execution problematic. Veteran cybersecurity specialist Matt Suiche pointed out that Fable misinterprets requests for secure code as cybersecurity-related tasks, resulting in a downgrade of responses. He noted that the model's reliance on keyword triggers leads to overzealous restrictions.
Suiche acknowledged that these challenges are part of the early development phase, stating, "I am sure they are going to evolve over time." He emphasized the importance of refining the guardrails as Anthropic collaborates with the new generation of cybersecurity firms to enhance functionality.
Another researcher highlighted that even simple requests, such as asking for a code review, activate Fable's guardrails, further illustrating the model's overly cautious approach.
Anthropic has not yet responded to inquiries regarding these concerns. Additionally, the company has established a Cyber Verification Program for cybersecurity professionals, allowing approved applicants fewer restrictions when utilizing Claude for cybersecurity tasks. A parallel program exists at OpenAI called Trusted Access for Cyber.
The ongoing evolution of AI models like Fable reflects a commitment to balancing innovation and security. As these technologies advance, they hold the potential to redefine cybersecurity practices and enhance digital safety across various sectors.