What are Fable 5's safeguards?
The safeguards are separate classifier systems — automated screening models that sit in front of Fable 5, not the model itself. They inspect requests for a small set of high-risk categories and, on a match, hand the response to Claude Opus 4.8. They also watch for jailbreak attempts designed to talk the model past its own guardrails. Anthropic's framing is deliberate: Fable 5 is "Mythos-class capability paired with novel safeguards," where the capability and the containment ship as one product rather than the model being dumbed down.
What triggers a fallback to Opus 4.8?
Public reporting and Anthropic's own materials describe four categories the classifiers watch for:
| Category | What it covers | API signal |
|---|---|---|
| Cybersecurity offense | Offensive security work — the capability Mythos is gated for | cyber |
| Biology & chemistry | CBRN-adjacent risk; currently the widest net | bio |
| Model distillation | Bulk response harvesting to copy the model's capabilities | reasoning_extraction |
| Frontier-AI development | A narrow "competitive use" band around building frontier AI | frontier_llm |
On the API, a routed request surfaces as a refusal stop reason — returned as a successful response, not an error — with a stop_details object naming the category. The check runs both when the request arrives and as the response is generated, so the layer is defence-in-depth rather than a single gate at the door.
The design choice that defines Fable 5 is that a flagged request doesn't dead-end — it's answered by Opus 4.8, itself a highly capable 1M-token model. Anthropic's reasoning is that a slightly more constrained answer is a far better experience than a flat "I can't help with that." Most users never notice the seam; the fallback fires in under 5% of sessions.
How does this fit Anthropic's Responsible Scaling Policy?
The safeguards are the concrete expression of Anthropic's Responsible Scaling Policy (version 3.0, effective February 2026), which defines graduated AI Safety Levels (ASL) modeled loosely on the biosafety-level standards used for handling dangerous biological materials. The rule of proportional protection is simple: as a model's capacity for catastrophic misuse rises, the required safety and deployment measures get stricter. Mythos 5 has cyber and biology capabilities that exceed the thresholds Anthropic set for itself — so releasing anything from that line to the public required the classifier layer, and the raw model (Mythos) stays gated behind Project Glasswing entirely.
Why the biology and chemistry net is the widest
For now, bio and chemistry trigger the most fallbacks. Reporting describes the classifier flagging chemical and physical separation processes — especially queries naming specific compounds, yields, or equipment configurations, or technical specificity about separating bioactive or controlled chemical classes. That breadth is intentional under a proportional-protection framework: the cost of a false positive (a benign chemistry question answered by Opus instead of Fable) is low, while the cost of a false negative in a CBRN-adjacent area is exactly what ASL-3 standards exist to prevent.
What it means for developers
If you build on Fable 5, treat the fallback as normal operating behaviour, not an error. Check stop_reason before reading content, and configure the server-side fallback so a routed request is served by Opus 4.8 in the same call. Fable 5 also requires 30-day data retention and isn't available under zero-data-retention — a deployment safeguard in its own right. And to be clear about the boundary: deliberately structuring prompts to slip capability past these classifiers is a violation of Anthropic's usage policy, and the whole point of the defenders-first Glasswing channel is that legitimate access to this class of capability has a sanctioned route that doesn't depend on working around the guardrails.