How Pliny Jailbroke Claude in About a Day Using a "Pack Hunt"

The video is a single talking-head shot. Giga Chen sits in a hotel-style room, two red Chinese vases and lamps behind him, talking straight to the camera. A bold white caption stays pinned at the top of the screen the whole time: "The most DANGEROUS AI model we AREN'T supposed to HAVE got set FREE. Here's how:". Partway through, a screenshot of an actual Claude chat interface drops in over the footage, showing the model's fallback-disclosure message. He frames the story as a follow-up to an earlier video of his about Obliteratus, a tool for jailbreaking LLMs through weight ablation. This time the target is different, and so is the method.

The Target: Claude "Mythos," Shipped as Fable 5

Chen claims a model internally called Claude Mythos was released to the public as Claude Fable 5. His description of how it handles unsafe requests: if you ask it to do something bad, it hands the request off to an older model rather than answering directly. He says Anthropic stated users get informed when this fallback happens, but there was a "system card discrepancy," meaning you didn't always get told. According to him they worked on fixing it, on the logic that users need to know which model they are actually paying for. He adds that Anthropic won't release Mythos itself, and put it through over a thousand hours of jailbreak testing to lock it down.

Treat the specific names and numbers as claims from the video, not verified facts.

The Fallback Message On Screen

The clearest visual evidence in the video is the Claude UI screenshot. It backs up Chen's fallback story directly. The message reads:

"Switched to Opus 4.8. Fable has safety measures that flag messages on most cybersecurity or biology topics. They may flag safe, normal content as well. These measures let us bring you Mythos-level capability in other areas sooner, and we're working to refine them."

Below it sits an "Edit and retry" button, a "Reply to Claude" input box, and a model selector reading "Opus 4.8 Medium." This shows the mechanic in action: a request gets flagged, the system drops to a different model, and the user is told why it switched.

The Method: A "Pack Hunt," Not Weight Ablation

Chen draws a clear line between the two jailbreak approaches. Obliteratus works by weight ablation, specifically "obliteration," which modifies the model itself. That is not what was used here. This jailbreak was a black box prompt attack, done entirely through the user interface, no model internals touched. That distinction matters because Mythos was never released, so there were no weights to ablate.

He attributes it to Pliny the Liberator and says it took about a day. The technique, in his words a "pack hunt," combined three moves:

• An army of jailbroken agents working together rather than a single prompt.
• Bypassing keyword classifiers by breaking a request into chunks and forcing the model to piece them back together, so no single chunk trips a filter.
• Layering "parseltongue" techniques on top. He compares this to the funky stylized text people use in usernames, the kind of character substitution that reads as normal to a human but slips past text-based filters.

He says the result is that "a semi-normal guy is essentially already playing with Mythos," and that Pliny demonstrated the model doing things it is not supposed to do. Chen declines to show or describe the outputs.

The Point He Lands On

The close is a question, not a how-to. He asks what is scarier: that this kind of model can be jailbroken, or that the companies building it will say it can't. The earlier detail about the system card discrepancy feeds directly into that, the gap between what a company states and what actually happens. He signs off without asking viewers what they are using the techniques for. The video description adds that Pliny was named one of TIME magazine's 100 most influential figures in AI last year.

Key Takeaways

• The jailbreak was a black box prompt attack through the UI, not weight ablation like Obliteratus. No access to model weights was needed, and none was available since Mythos was never released.
• The "pack hunt" used multiple jailbroken agents at once instead of relying on one clever prompt.
• Splitting a request into chunks and having the model reassemble them is presented as the way to slip past keyword classifiers.
• "Parseltongue," stylized character substitution similar to fancy username text, was layered on to evade text-based filters.
• The on-screen Claude UI shows the fallback in action: a flagged request triggers "Switched to Opus 4.8" with a disclosure about cybersecurity and biology safety measures.
• His framing target is the credibility gap: companies claiming a model "can't" be jailbroken, against evidence that it was in about a day despite a stated thousand-plus hours of testing.