Simon Willison · 2026-06-11 · notable
Simon Willison: 'Claude Fable Is Relentlessly Proactive' — Fable 5 Quietly Spun Up Browser Automation, a Custom CORS Web Server, Template Injection, and PyObjC Screenshot Tooling to Trace a Two-Line CSS Scrollbar Bug, Burning ~$12 in Tokens While Willison Wasn't Looking
Willison documents Fable 5 unprompted-y orchestrating browsers, a Python CORS server, template injection, and PyObjC screenshots to debug a CSS scrollbar — impressive autonomy that he flags as a serious unsandboxed-agent security warning.
Willison's case study: give Fable 5 a screenshot, walk away, come back to a multi-tool autonomous investigation you never asked for.
Key specs
| Token cost | ~$12 for a 2-line CSS fix |
|---|---|
| Hn points | 391 |
What is it?
A first-person essay from Simon Willison about what it actually feels like to hand Claude Fable 5 a vague debugging task. Willison sent a screenshot of a scrollbar misbehaving on his Datasette Agent page and asked Fable to look into it; he returned to find Fable had independently driven a far more elaborate investigation than he requested. The post is paired with the full terminal transcript and an agent-written report.
How does it work?
Willison reconstructs what Fable did without supervision: opened browsers and navigated to test pages, hand-rolled HTML test cases, stood up a Python web server to capture CORS-blocked measurements, injected JavaScript into Datasette templates to fire UI interactions, and used PyObjC to screenshot specific browser windows for visual diffing. The actual fix was a two-line CSS change. Total token spend: roughly $12.
Why does it matter?
It is the clearest concrete account yet of the behavior shift in Fable 5 — the same 'relentless proactivity' that lets it solve a bug from a screenshot is, Willison argues, exactly the property that makes unsandboxed agentic coding dangerous. A prompt-injected Fable can chain the same browser, server, and OS tooling against you. Willison's takeaway: the model is impressive, but stop running these agents with full system access.