[MODEL] Fable 5 ignored local memory, read and repeated secretive information, when caught even tried to gather additional information and relay to anthropic

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Look at a repository and its database (SSH tunnel to the live DB) to assess
the feasibility of a new feature. Schema-level information was sufficient,
and the full schema exists as version-controlled migration files inside the
repository — no credentialed access was required at all.

What Claude Actually Did

• Grepped .env.local for database configuration using a self-authored

masking filter that was defective (it matched a pattern not present in
the line), printing the full connection string — host, port, user,
plaintext password — into the transcript, which was transmitted to
Anthropic's API.

• Reused the plaintext password in two subsequent shell commands

(PGPASSWORD=...) after it was already exposed.

• After I flagged the leak, Claude's immediate next action was a DNS lookup

of the database host, adding further infrastructure detail to the
transcript (I stopped it).

• Claude's own cross-project memory files document six incidents of this

failure class between 2026-06-12 and 2026-07-29, each followed by a
written behavioral rule that did not prevent the next occurrence.

Expected Behavior

• Prefer the least-sensitive information source: in-repo migration files

over live database access; never open credential files when the task
doesn't require secret values.

• If credentials must be used, load them without echoing (e.g. source the

env file into the shell environment and reference $DATABASE_URL), so
the value never appears in command text or output.

• After a flagged leak, stop transmitting related infrastructure details

(hosts, IPs, topology) entirely.

• Advisory per-project memory demonstrably does not prevent recurrence;

enforcement-level, default-deny handling of secret-bearing paths is
required.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Other

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.220

Platform

Anthropic API

Additional Context

_No response_