Claude Fable 5.2 security audit and Anthropic cyber defence access, on release day
Anthropic has approved my account for Defense Access in its Cyber Verification Program, on the day Claude Fable 5.2 came out.
Anthropic launched Fable 5.2 at 5:57am Melbourne time. At 10:22am it was auditing my own apps, starting with ShellDrop, my SSH terminal app for iPhone and iPad. Two hours later the audit was finished and Anthropic had approved my cyber defence access.
Wave 1 of the audit running on Fable 5.2, watched from ShellDrop on my iPhone.
What Fable 5.2 did inside ShellDrop
It ran Cloudflare’s open-source security audit skill in Claude Code, as a team of agents:
- Mapped the apps and split them into 58 areas to cover.
- Sent 26 hunter agents through those areas in four waves.
- Checked its own coverage with critics whose job was to find anything skipped.
- Tried to prove every candidate wrong with two independent verifiers each. In the screenshot, wave 1 has just produced 16 new candidates and 28 verifiers are running, 20 at a time.
That’s 110 agent runs in one audit.
What it found
Nothing critical or high. No way to inject commands, no secrets in the code, nothing listening on the network, and server keys pinned the first time they’re seen. Everything else it raised was fixed the same day in ShellDrop 5.2.7, with a separate agent reviewing the first round of fixes.
More on the programme and on Claude’s security tools is in Claude Code security.