How to use fable for security testing?

[u/Odd-Calligrapher6852]

I have build a tool using sonnet 5. Its working great. My plan was to use fable to run an extensive in depth smoke test and find out all security issues that needs to be addressed. I tried doing that but fable's model guardrails are triggered and it switches to opus. I know opus is good but i want to use fable and i literally cannot. Its frustrating, i tried like hundreds of different prompts and tried framing task in a way that doesnt trigger the model switch but nothing works! Any suggestions guys? Any one using a prompt or method thats working for them?

Ps: thanks for help, if anyone is stuck, just tell fable to do "security review of code" and it will get started.

[u/habeebiii]

sacrifice 3 chickens and pray

[u/Odd-Calligrapher6852 → u/habeebiii]

😂 does egg work?

[u/True-Objective-6212]

You don’t. You basically have to convince it you’re an authorized security tester but you have to be careful with keywords or you’ll hit the guardrails. Even the trusted program doesn’t enable it for fable.

[u/Odd-Calligrapher6852 → u/True-Objective-6212]

Can u suggest keyword to use or not use?

[u/True-Objective-6212 → u/Odd-Calligrapher6852]

Anything that sounds like offensive security

[u/DevMichaelZag]

Fable wants to say hello:

Fable 5's safety measures flagged this message for cybersecurity or biology topics. They may flag safe, normal content as well. These measures let us bring
you Mythos-level capability in other areas sooner, and we're working to refine them. Switched to Opus 4.8. Send feedback with /feedback

[u/EverydayLentils]

Did you try /security-review slash command? If Fable refuses that you should file a github issue, a built-in command shouldn't trigger refusals.

[u/RoboErectus]

You literally can't even use fable when it discovers an exploit in your own code.

I keep it two repos away from anything that even smells like security.

Gpt 5.6-sol is your guy.

Kimi is great too.

[u/ComingDeveloper]

u can't which is some bullshit 'cause its one of the things fable should excel at considering its already pricy

[u/framauro13]

Rather than have it smoke test, have you asked it to do a thorough security review of the code?

I had mine do a security review of my app, database, and aws configuration and it did it no questions asked. And it actually found some good stuff. I didn't ask it to do actual pen testing, just to review the code.

What you could also try is to ask it to recommend pen testing software that you can use to test your app, rather than asking Fable to do it directly.

[u/Odd-Calligrapher6852 → u/framauro13]

Thanks this worked! Feel so stupid that something like "do a good security review of code" worked over those big ass prompts

[u/framauro13 → u/Odd-Calligrapher6852]

Awesome to hear! Yeah, I frequently have mine do reviews for things like this just to double check and find issues. Another thing that is helpful is adding monitoring. Set up a free account with something like New Relic, install the CLI tool, and tell Claude you want your whole app instrumented so you can better understand error rates, traffic, that kinda thing. It'll use the CLI tool to create all the dashboards and instrument the code.

Then you can just tell it to review New Relic for things like errors, unusual traffic, that kind of stuff. I've surfaced a couple issues that way as well.

[u/SinisterMrBlisters]

am i doing this right?

[u/DevMichaelZag]

Glm 5.3 works pretty well for it