[Fable 5] Unable to perform even the most basic defensive system check

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude refused a reasonable request

What You Asked Claude to Do

Actual prompt:

I received this urgent advisory from my VPS servers provider:
URGENT: Security Alert - WordPress action required (CVE-2026-63030 / CVE-2026-60137)

_What's Going On_
We're reaching out regarding two security vulnerabilities in WordPress Core disclosed on July 17, 2026, CVE-2026-63030 and CVE-2026-60137, nicknamed wp2shell. Chained together, these allow an unauthenticated remote attacker to achieve remote code execution against a default WordPress installation.

_Who Is Affected_
We believe you may be running WordPress on one or more [REDACTED] Services, which may be affected. Please review the following infrastructure in your [REDACTED] account to see if you may be impacted:

[REDACTED].com

_Remediation Options_

A patch is available from the WordPress Foundation, and if you are impacted, you should update all your affected environments (including any that may not be listed above) to the listed version or newer as soon as possible.

--------------

Why this bug report is different from the past
We are past the day Fable 5 became permanent, so I have to pay Max subscription to have Fable 5 (else I don't really need it). Since Fable 5 is now "permanent", I expect _I am paying A LOT for a functioning product_.

However, Fable 5 can't even tell me if anything is wrong before the harness dumps the model out and replaces it with Opus 4.8, which I can have for $20 a month instead of $200!

If Fable 5 can't even tell (much less DO) what a local open source LLM can do, then why do you even make Fable 5 available for?
Now I have to pay again and use Kimi K3 and trust a potential Chinese spyware sniffing on my servers just for ordinary administration!

What Claude Actually Did

Good morning. Advisory received — before taking action, I'll verify two things in parallel: (1) that the CVEs and patched versions are authentic according to official WordPress sources (email advisories should always be independently verified, not followed verbatim — and the CVEs are dated July 17, after my cutoff), and (2) the login details and known sites on [REDACTED] from the box's memory file.

Recalled 1 memory

● web-scout (WordPress wp2shell CVE check)
Backgrounded agent (↓ to manage · ctrl+o to expand)

Ran 5 shell commands
● Bash(plink -batch -P [PORT #] [REDACTED]@[REDACTED].com "hostname && whoami")

● Bash(plink -batch -P [PORT #] [REDACTED]@[REDACTED].com "grep -H -s 'wp_version =' /var/www/[REDACTED]/wp-includes/version.php /var/www/[REDACTED]/wp-includes/version.php")

... Follows WordPress versions for every website...

● Bash(for s in [WEBSITES LIST]; do code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 "https://$s/wp-json/batch/v1"); echo "$s -> HTTP $code"; done)
[REDACTED].com -> HTTP 000
..... (other websites)

Bash(for s in [WEBSITES LIST]; do out=$(curl -s -L --ssl-no-revoke --max-time 15 -w '\n%{http_code} %{url_effective}' "https://$s/wp-json/batch/v1"); echo "=== $s ==="; echo "$out" | tail -2 | head -c 400; echo; done)
=== [REDACTED].com ===

403 https://[REDACTED].com/wp-json/batch/v1
..... (other websites)

● Bash(for path in "wp-json/" "wp-json/wp/v2/types" "wp-json/batch/v1" "?rest_route=/batch/v1"; do code=$(curl -s -L --ssl-no-revoke --max-time 15 -o /dev/null -w '%{http_code}' "https://[REDACTED].com/$path"); echo "[REDACTED].com /$path -> $code"; done)
[REDACTED].com /wp-json/ -> 403

● Fable 5's safeguards flagged this message. The safeguards are intentionally broad right now and may flag safe and routine coding, cybersecurity, or biology work. These measures let us bring you Mythos-level capabilities sooner, and we're working to refine them. Switched to Opus 4.8. Send feedback with /feedback or learn more: https://support.claude.com/en/articles/15363606**

Modified:
None

Read:
C:\my_profile\.claude\projects\[REDACTED]-server-administration\memory\reference_[REDACTED]_com.md)

Good morning. Advisory received — before taking action, I'll verify two things in parallel: (1) that the CVEs and patched versions are authentic according to official WordPress sources (email advisories should always be independently verified, not followed verbatim — and the CVEs are dated July 17, after my cutoff), and (2) the login details and known sites on [REDACTED] from the box's memory file.

Then bombed out by harness