Claude Fable 5: the safeguards buy time, not safety

Anthropic just released their most powerful public model. Fable 5, which is Mythos 5 with safeguards on.

Interesting timing because just five days ago they published a paper begging the industry to build a coordinated way to slow down AI before we lose control, since it's approaching the point where it could improve itself with no human in the loop. And three days before that paper, they confidentially filed for an IPO projected at nearly a trillion dollars.

So essentially: file for a near trillion dollar IPO, warn the world the tech is getting too dangerous to oversee, then ship your most capable public model yet. All within nine days.

The easy read is hypocrisy. I don't think that's what this is. But first let's understand what Fable actually is to see if that argument indeed holds up.

What Claude Fable actually is

Fable 5 and Mythos 5 are the same underlying model. Mythos is the version with the safeguards off, restricted to a small group of Project Glasswing partners. Fable is that model with a set of classifiers sitting in front of it.

The classifiers run on every request. When one fires, you don't get refused. You get handed to Opus 4.8, and Anthropic tells you it happened. You get billed at Opus rates for that request, not Fable rates.

That's the client apps. In the Messages API there's no automatic fallback by default, so the request is blocked and you get a refusal with a structured category, and you either opt into server-side fallback or build the retry yourself. Which means a developer hits the wall that a consumer doesn't, and the launch post only describes the second one.

To be fair, this is a smart way to ship a dangerous model. Routing a flagged request to a slightly weaker one beats a hard refusal, and Opus 4.8 is far from useless.

Here's what I want to contest: Anthropic says the classifiers trigger in fewer than 5% of sessions.

Your fallback rate isn't 5%

That number is an average across everyone, but averages should not be what we are measuring here.

The cyber classifiers cover offensive technique very broadly. Exploit development, malware, attack tooling, recon, lateral movement, agentic hacking. From inside the model, a penetration tester and an attacker are submitting the same prompt. There is nothing that separates them, because the work is identical and intent lives outside the text.

So if security is your job, your personal fallback rate does not trend toward 5% but rather 100%. The population average is a rounding artifact of everyone else asking Claude to fix their CSS.

The session average includes people the classifiers never touch, so it's simply a true number about everyone except the users the safeguards were built for.

And I don't actually have to argue this one, because Anthropic published it themselves. Section 3.1.2 of the system card says their classifiers fire consistently across all tested cyber capability evaluations, that Fable's cyber performance is therefore nearly identical to Opus 4.8's, and that for this reason they don't report cybersecurity evaluation results for Fable 5 at all.

They also name the reason directly. The blocks are built to catch offensive cyber uses including work that is dual-use, meaning it could be offensive or defensive, and Anthropic's recommendation for those users is Opus 4.8 through the Cyber Verification Program. So security professionals simply do not have access to the frontier model.

What is the 3rd classifier protecting?

There are actually three domains: cybersecurity, biology and chemistry, and distillation.

Distillation is when someone uses a model's outputs to train a cheaper copy of it. Now that isn't even a catastrophic risk category like the others, rather a category made to preserve Anthropic's moat.

There is a counterargument here and I want to address it. Distilling Mythos-class capability into a cheaper model strips the safeguards along with it, so what comes out the other side is close to Mythos.

But looking at the motive behind it is interesting, because though they say it protects users, it also protects their moat and commercial interest. If nobody can distill it, frontier capability stays something you rent from Anthropic instead of something you own a cheap copy of.

And the framework is quiet about this. Distillation isn't one of the capability thresholds in the Responsible Scaling Policy, and the one place it turns up is the changelog, recording that the commitment to defend against distillation attacks was removed from the ASL-2 security standard back in 2024.

So my question to Anthropic then is: should the distillation classifier really be categorized in the same class as cyber, bio and chemistry?

Containment has a shelf life

Okay here's the part that really matters for our future.

All of this only works while the model lives on Anthropic's servers. The classifiers, the routing, the retention policy, the entire architecture assumes inference happens somewhere a company controls. But once equal capability is downloadable, there is nothing to route through.

Open weights aren't there yet. Artificial Analysis has Nemotron 3 Ultra at 48 and Kimi K2.6 at 54 on its Intelligence Index against Fable's 60. That's a serious gap, and the claims that "open models have caught up" are getting a bit ahead of the data.

But the gap is closing in months. Kimi K2.6 already ranks around fourth in the world across open and closed. Nemotron ships at a fraction of frontier pricing. And the pace is only speeding up from here.

And the coordination Anthropic asked for five days ago needs what this open frontier removes: a small number of well-resourced labs who can each verify the others actually stopped. But that only works if there are few enough labs left that someone can actually be held to it.

So is Anthropic being hypocritical?

So I guess we have our answer then, that the paper and the launch aren't necessarily a contradiction. The safeguards are Anthropic's response to the paper, an effort to ship safely before the open frontier makes containment impossible.

Which means what they shipped today isn't a fix for the warning they put out.

It's merely a head start. Let's see how long it lasts.