Claude Fable 5 One-Shot a Game — What It Shows About Agentic Coding Risk

On the fourth anniversary of a 2022 tweet where he'd mocked up a game concept using GPT-3 and DALL-E, developer and Django co-creator Simon Willison ran the same brief past Claude Fable 5 — this time inside Claude Code for web — to see how far agentic coding has come. The result, built entirely on his phone from one prompt, was Raccoon Heist: a working 3D stealth-collection browser game, complete with procedurally generated audio, low-poly characters, mobile touch controls, and three difficulty tiers.

What actually happened

Willison's instructions were short and deliberately hands-off: work independently, don't come back for further design decisions, and commit and push as often as possible. Claude Fable 5 took that literally. It made seven commits to a dedicated branch (claude/3d-raccoon-heist-game-50n293), vendored Three.js instead of pulling it from a CDN, called OpenAI's gpt-image-2 API using a live key to generate textures and title art, and wrote a procedural WebAudio soundtrack with zero audio files. It then tested its own work with Playwright across desktop and mobile viewports — catching a canvas-scaling bug on phones and a UI element blocking the win screen — and fixed both before deploying to GitHub Pages.

Why this belongs on a security blog

The game itself is a novelty; the operational pattern underneath it is not. This is a live instance of exactly the access model enterprise security teams are being asked to sign off on right now: an agent with git push rights and a third-party API key, running for an extended, unsupervised session, making its own implementation and testing decisions.

• Credential scope — the agent used a real OpenAI API key at build time. In this case it was scoped to image generation for a toy project; in a production pipeline, the same pattern demands the same discipline applied to any CI credential — least privilege, short-lived tokens, no key an agent doesn't strictly need.
• Unsupervised commit/push — Claude pushed its own commits to a branch without a human sign-off gate at each step. That's a reasonable trade for a solo side project; it's the exact control (branch protection, required review, CI gates) that shouldn't be waived by default once agentic coding touches anything shared or production-facing.
• Self-testing isn't independent verification — the agent both wrote the code and wrote the Playwright tests that validated it. Catching real bugs this way is genuinely useful, but it's not a substitute for adversarial or independent QA, since an agent's blind spots in implementation tend to be the same blind spots in the tests it writes for that implementation.

The GitHub Pages footgun

Willison called out a detail that's easy to miss: GitHub Pages will happily serve a built site publicly even when the source repository is private, as long as someone can guess or find the URL. For a raccoon game, that's harmless. For an agent that's been told to "deploy independently" against a repo that happens to contain anything sensitive — draft copy, internal tooling, embedded config — it's a quiet way for private content to end up world-readable. It's the kind of default that autonomy makes easier to trip over, because the human who'd normally double-check deployment settings isn't in the loop.

The takeaway

The deployed game itself is low-risk: static assets, no runtime API calls, no user data. That's a genuinely good outcome for an autonomous build, and worth noting as a sign agentic coding is maturing. But the experiment is a clean, low-stakes way to see the shape of the problem: as more real engineering work moves to agents that can commit, push, hold credentials, and deploy without asking, the controls that matter aren't about whether the agent is capable — Willison's game shows it clearly is — but about what it's been given permission to do on its own.