Question: were you under the impression that Anthropic’s “models,” Fable and Mythos, were two separate models? Yes, perhaps built on the same weights, but still two separately operating models? If so, you were justified. Why else would a company give one underlying model two separate product names?

The distinction was not that Fable was a different class, a safer version, or a watered-down model. The distinction was routing. Fable was the commercial/public access name for Mythos when classifier routing was active. When a request touched certain restricted areas, including cybersecurity, biology, chemistry, health, or distillation, the system routed the request away from Mythos and toward Claude Opus 4.8.

That is the whole architectural issue. Fable was not Mythos-class in the ordinary sense of being a separate model in the same family. Fable was Mythos behind routing. The name “Fable” made that access condition look like a model identity.

Let’s go through the communications around Mythos, Glasswing, and Fable at every stage of this release to unpack what the public was told and what was actually happening. The question is not only whether Anthropic disclosed the underlying truth somewhere in the documentation. It is whether the company’s naming and launch language made a routing configuration look like a separate public model.

You may have thought you were interacting with the model called Fable, a reasonable conclusion. You in fact were not. You were interacting with Mythos through a classifier-routing layer, and as anyone could have foreseen with this information, the routing was challenged very quickly, almost immediately, almost before the product was even launched to the public. In other words, from the day “Fable” launched, ordinary paying Anthropic users were not accessing a separate safer model. They were accessing Mythos through classifier routing, with certain categories of traffic diverted away from Mythos and toward Opus 4.8.

We know the technology behind the classifier is token based. It is operating over language tokens or token-derived representations, it is making a probabilistic classification judgment about the request. That means it can misclassify. It can over-trigger on harmless requests, miss dangerous ones, or be confused by decomposition, obfuscation, context shifts, euphemism, indirection, or multi-step prompting. It’s not architecturally possible for it to be “locked down.” Anthropic’s documentation estimates that there will be fallbacks in fewer than 5% of classifications. But the classifier is probablistic. It will not be completely accurate.

When the same capability is grave enough to justify a restricted, government-collaborative access program
in April and unremarkable enough to wave off in June, the thing that changed is not the model, but the framing the company needed the public to believe at each moment. What follows is the timeline of Claude Fable 5 told through the communications attached to each stage: the date, what was announced, how precise the language actually was, and what happened next.

Reasonable questions to be asked of Anthropic at this juncture:

• Why give two model names to what the documentation describes as the same underlying model?
• Why describe Fable as a model rather than as guarded public access to Mythos?
• Why did the company’s launch framing encourage the public to understand Fable as a safer model identity when the operational distinction was classifier routing?
• Did Anthropic believe classifier routing could reliably prevent misuse of Mythos-level capability in general release?
• If the safety case depended on routing, why was that routing not made the headline of the launch?
• Why did the company imply degraded or constrained capability when the actual mechanism was not a reduced model but traffic diversion to Opus 4.8?
• Was Anthropic’s position that Mythos was safe enough for public access when routed, or that Mythos was too dangerous for public access but the routing layer would be sufficient?

Basically, what on earth were y’all thinking?

April 2026: the capability is too dangerous for general release

Anthropic launched the first Claude Mythos Preview
to a limited group of cyber defenders and critical software infrastructure providers through Project Glasswing, in collaboration with the US government. The framing was unambiguous. This was capability the public could not have. The company stated that it hoped to eventually release Mythos-level capabilities to all users, but only once it had developed safeguards strong enough to reliably prevent misuse.

The specificity worth marking: the bar set in April was reliably prevent. Not reduce, not make expensive, not detect-and-shut-down. Reliably prevent. That is the standard the company itself put on the record as the precondition for ever opening this capability to the public.

What happened: the model stayed restricted for roughly two months, and the “too dangerous for open access” framing did its work. It established Mythos in the public mind as the model serious enough to keep behind a government program.

June 9, 2026: Anthropic states the capability is now safe for everyone

Anthropic launched Claude Fable 5 under a single headline sentence that framed guarded access to Mythos as a “Mythos-class model” made safe for general use. The emphasis across the announcement fell on capability and reassurance. State of the art on nearly every benchmark, months of engineering compressed into days, and classifier routing described as so conservative that they would sometimes catch harmless requests.

The specificity of the comms matters here most, because the launch material contradicts itself, and the contradiction is the whole story of how the public came to misunderstand what it was being given.

In the alignment section, Anthropic states that Fable and Mythos are one model. The sentence is direct: given that they are the same underlying model, Fable 5’s level of alignment will be similar to Mythos 5’s. Same model. The alignment data for one is offered as the alignment data for the other on exactly that basis.

In footnote two, the same company describes them as two. The wording is its own: the safeguards are what distinguish the two models, Fable and Mythos, and are why they have been given different names. Two models. Differing, by this sentence, only in their safeguards.

Both statements are Anthropic’s, in the same post. One model in the alignment paragraph. Two models in the footnote. The technical reality is the first sentence. The marketing is the second. And a company does not assign a separate proper noun, a separate mythological register, and its own product identity to a set of security parameters. You give a thing a new name when you want it perceived as a new thing. By calling Fable a model rather than a configuration, and by writing “the two models” in its own comms, Anthropic did not merely allow the separate-model impression to form. It authored it.

The architecture underneath the naming is singular. Fable is Mythos behind classifier routing. The classifiers are separate systems that sit before the model and, when they detect a request touching cybersecurity, biology and chemistry, health, or distillation, divert the request away from Mythos and toward the weaker Claude Opus 4.8 instead. Mythos 5, offered to Glasswing partners the same day, is described as the same underlying model with with the routing layer inactive for specified domains. One model. A routing layer in front of it. Which product you experience is determined by whether that routing layer is active on your traffic.

That is not what the public heard, and the comms are why. The reasonable reaction, and the one many people had, was that an incredibly capable model the company had hyped as dangerous for months was now in everyone’s hands, and the equally reasonable instinct that followed was disbelief that a company would actually do that. The disclosure of the underlying truth was technically present, in an alignment paragraph and a footnote. The framing that buried it, a new name and the phrase “two models,” sat at the front. The misimpression was not a failure of public attention. It was built into the language.

One detail belongs at this stage and was easy to miss. The company claimed no universal jailbreak had been found across more than 1,000 hours of external testing. In the same section, Anthropic disclosed that the UK AISI had made progress toward a universal jailbreak within a brief initial testing window; footnote four then defined what Anthropic meant by a universal jailbreak.

June 10 to 11, 2026: the safe model is silently weaker, and the company apologizes

Within two days the launch message met its first public contradiction, on the better-documented of the two fronts. Researchers and developers reported that some legitimate work was being routed away from Fable to Opus 4.8 without clear visibility to the user.
This was a transparency failure rather than a capability one, and it cut directly against the “we made it safe and it mostly behaves like Mythos” message.

According to developer-facing reporting, Anthropic acknowledged the tradeoff and changed the behavior
so that flagged requests visibly fall back to Opus 4.8, letting users at least see when they are getting the weaker model. The comms had moved from confident launch to apology and patch inside 48 hours.

Separately and more loudly, the red-teamer known as Pliny the Liberator claimed to have bypassed Fable’s classifiers using a coordinated multi-step approach, and posted what he described as restricted outputs along with the model’s roughly 120,000-character system prompt. The “PWNED” packaging was performance. The underlying claim, that the classifier fronting the model could be defeated, was what mattered.

June 12, 2026, daytime: the routing layer holds and that was not a real jailbreak

Anthropic disputed the bypass. It said the demonstration did not constitute a true jailbreak, that a true jailbreak would have to defeat the core safeguards and deliver meaningful assistance toward high-risk activity like bioweapons development or sophisticated cyberattacks, and that getting the model past its conversational refusals does not disable the independent classifiers that enforce the most important protections.

The company drew a line between defeating refusals, which it conceded is a known and longstanding limitation of nearly all language models, and defeating the classifiers, which it maintained had held. As of midday June 12, the posture was still that the protection worked.

June 12, 2026, 5:21pm ET: “the vulnerability was never serious anyway”

The US government, citing national security authorities, issued an export-control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including Anthropic’s own foreign-national employees. The directive’s understanding, per Anthropic, was that the government had become aware of a method of bypassing Fable. Anthropic complied and disabled both models for all customers.

And the framing of the danger inverted a final time. Having spent two months establishing Mythos as too dangerous for open access, and three days insisting Fable’s routing held, Anthropic was now facing both public bypass claims and a government directive premised on a possible jailbreak. The company now argued the breach was minor. It said the cited bypass was narrow, that it surfaced only a small number of previously known and relatively simple vulnerabilities, and that other publicly available models, including OpenAI’s GPT-5.5, can find the same flaws without any bypass at all. It argued that recalling a model Anthropic claims was deployed to hundreds of millions of people over a narrow potential jailbreak would, if the standard were applied across the industry, halt all frontier model deployment.

Read the arc as one line. In April the capability is grave enough to lock inside a government program. On June 9 it is safe enough for everyone. On June 12 at noon the routing is intact. By that evening, once breached, the same capability is reframed as nothing other models cannot already do. The model’s danger was described as whatever each stage required.

What the sequence actually establishes

Two things hold up, and they are enough.

The public was, in effect, getting routed access to Mythos. Not a separate safer model, not a lower-capability class, and not a watered-down version: the same underlying model Anthropic also called Mythos, with classifier routing determining whether a request reached that model or was diverted to Opus 4.8. The model the company had called too dangerous for open release, sitting behind a classifier gate. The directive is strong evidence that the state treated the models as non-ordinary, even if it does not prove the technical validity of the alleged bypass. A government does not suspend worldwide access, reaching into a company’s own workforce by nationality, over a model it considers ordinary. The shutdown confirms that the state treated the stakes as high, even while leaving the technical basis opaque.

And within days, the classifier-routing layer was under serious enough challenge that the US government acted on a suspected or claimed bypass, even as Anthropic disputed whether the evidence showed a true jailbreak. Anthropic’s own April standard was reliably prevent. Its June position is that perfect jailbreak resistance is not currently possible for anyone, that every industry safeguard is vulnerable to non-universal jailbreaks, and that universal ones will likely be found eventually. That is a substantial retreat from the bar the company set for itself as the precondition for public release. The standard apparently moved to fit the launch.

The harder question sits underneath all of it, and it is a governance question rather than a comms one. The capability was real enough to justify restriction, classifier routing was the bet to contain it, that bet came under challenge inside a week, and the entity that pulled the model was not the company but the state, acting through an opaque directive that gave no specific technical basis, reached across borders, and could not be appealed through any clear statutory process. The risk that the launch framing minimized turned out to be real. The mechanism that addressed it was its own kind of failure. Both can be true, and on this record both are. Fable was not a class, version, or separate safer model. Fable was Mythos behind classifier routing.