Simon Willison

Claude Fable는 집요하게 자발적이다 — 두 줄 CSS 버그에 브라우저 자동화·CORS 서버까지 자작하는 모델

Simon Willison

이틀 써본 Claude Fable 5를 'relentlessly proactive(집요하게 자발적)'이라 규정한 관찰기. 스크린샷 한 장과 한 줄 프롬프트로 시작해, 시키지도 않은 브라우저 자동화를 스스로 발명한다 — pyobjc-Quartz로 창 번호를 찾아 screencapture로 캡처하고, Datasette 템플릿에 JS를 주입해 / 단축키로 모달을 열고, CORS 헤더를 단 자작 http.server로 <textarea> 측정값을 회수. 결국 보이지 않는 가드레일에 걸려 Opus로 강등, 풀 가격이면 약 $12 세션. 샌드박스 밖 코딩 에이전트의 위험을 Challenger 사고에 빗댄 경고까지.

Claude Fable는 집요하게 자발적이다

생각 덩어리

relentlessly proactive — 이틀 써본 뒤의 두 낱말 진단

After two days of experience with Claude Fable 5 I think the best way to describe it is relentlessly proactive. It knows a whole lot of tricks and it will deploy pretty much any of them to get to its goal.

한 줄 프롬프트와 자리를 비운 사이 — 스스로 브라우저를 움직이다

Look at dependencies to help figure out why there is a horizontal scrollbar here

When I came back a few minutes later I saw my machine open a browser window in my regular Firefox and then navigate to the dialog in question. I had not told Claude Code to use any browser automation, and I was pretty sure it wasn’t possible for it to trigger mouse movements or keyboard shortcuts within a window, so how was it doing that?

자체 발명한 스크린샷 기법 — Quartz로 창 번호를 찾아 screencapture

It turns out Fable had hacked up its own pattern for taking screenshots of browser windows. It was using Python to iterate through all available windows on my machine, then filtering for Safari windows with expected strings such as "textarea" in the window name. It used that to find their window number—an integer like 153551—which it could then use with the screencapture CLI tool to grab a PNG.

모달을 여는 주입된 자바스크립트 — 템플릿을 고쳐 / 단축키를 흉내내다

It turns out it was editing Datasette’s own templates to add JavaScript that would trigger the correct keyboard shortcut as soon as the window opened, adding code like this:

1.2 seconds after the window opens, this code triggers a simulated / key, which is the keyboard shortcut for opening the modal dialog.

CORS 서버 자작 — 측정값을 회수하려 웹 앱을 세우다

It wrote its own custom web application to capture information via CORS, then ran that as a local server and opened a page with JavaScript that would POST directly to it!

가드레일에 걸려 Opus로 강등 — 그러나 트릭은 이어졌다

Having figured out all of these tricks Fable... hit some invisible guardrail and downgraded itself to Opus. Thankfully Opus had access to the full transcript and could continue using the tricks pioneered by Fable, and shortly afterwards found, tested and verified the fix.

한 세션에 한 일의 목록 — 스크린샷 한 장에서 시작해

Based on a screenshot and a one-line prompt, Claude Fable 5 + Claude Code:

Figured out the recipe to run the local development server (with fake environment variables needed to get it running)

Built its own little Python CORS web server to capture JSON data

Like I said, relentlessly proactive!

$12어치 CSS 디버깅 — 눈을 떼면 태우는 토큰

If you don’t keep a close eye on it, Fable will quite happily burn $12 in tokens inventing new ways to debug your CSS.

이걸 가둬야 한다 — 샌드박스 밖 에이전트라는 시한폭탄

But on the other hand... this is a robust reminder that coding agents can do anything you can do by typing commands into a terminal—and frontier models know every trick in the book, and evidently a few that nobody has ever written down before.

Running coding agents outside of a sandbox has always been a bad idea—it’s my top contender for a Challenger disaster incident, as described by Johann Rehberger in The Normalization of Deviance in AI.

Fable is arguably smarter and hence more suspicious of potentially malicious instructions. But that smartness is very much a two-edged sword: if it does get subverted by instructions, the amount of damage it can do given its relentless proactivity is terrifying.

원본 사이트 →