This post can essentially be distilled down to: yes, Fable's classifier (which is meant to downgrade cybersecurity, biology, or jailbreak attempts to Opus 4.8) is definitely overly sensitive to the point of uselessness.
e.g. a colleague asked Fable to help create an simple app to help calculate the statistics for phase II and III trials. (Ignoring that such things already exist) it passed his request down to Opus, despite only being very marginally, tangentially, somewhat related to biology.
I had a file that had a couple places where vars were named DNA and got just total refusals during the first launch. Came away thinking the model was total trash. The guardrail classifiers are for sure total trash.
It feels like the longtermist believers got involved in this (those are the people obsessed with garage-engineered designer viruses who have a very tenuous grasp on how biology research actually works).
No, by far the most parsimonious explanation is they got slapped by a capricious US government so they went overboard on caution in an attempt not to generate any more controversy. A predictable response of chaotic government regulation.
Yeah i'm wondering how much of a role that plays in this as well.
On the one hand I could believe it's something more benign, or the usual misunderstood fear mongering making it to some political level (well make sure those users can't get online anonymously! being our current craze).
That said, chemistry and to some level physics have been the major domain of limited knowledge (chemistry because the average person could cause some damage, physics is more of a nation state issue generally).
However I do wonder if there's some legit data on "oh uh...looks like this thing you can make with easy to get and hard to regulate tools is dangerous" in the bio field. I know about the lab rats who want to just screw around in the garage, and it seems like that should be easy to hit at a supply level (much like how certain chemical compounds are just not available for civilians), but maybe there's something legit to limiting the data.
Not that this is a remotely good implementation of that. The hamfisted method does reek of some politician/bureaucrat just saying "No it can't ever return bio questions because RAR!" situation.
Nobody has tried to limit knowledge of chemistry or physics unless it was directly about doing something illegal, to the point of basically being a detailed recipe. Usually not even then. And when they have tried they've had basically zero success.
The ability for a handful of companies, simultaneously very powerful and easily susceptible to pressure from other powerful actors, to do the same sort of thing with the next generation of core learning and engineering tools, is freaking terrifying.
I agree, and think the effects on learning should be doubly emphasized. One can lock down everything and everyone to the highest degree possible, think of every possible edge case, set controls 2, 3, 4, 10 steps away from them, but not only is this not beneficial to society overall due to how it hurts adjacent information, it's not even beneficial to the goal in question, since it creates a brittle situation with locks that can't be changed or updated in a world which is always changing and always updating.
The thing is the data isn’t limited, and supply side constraints already solve this problem. I come from a BSc Chemistry background, and they don’t hide how organic chemistry and illegal drug synthesis are intertwined, it’s open information
But where I live the glassware and precursors will get you a very angry knock on the door.
I but skimmed the model card on release, but my impression was that there may be an incentive for this expert panel to exaggerate as a form of job security. A lot of the challenges seemed to be of the form “would this allow somebody who isn’t me to do what I do professionally?”
I'm working on cryptography, all from academic research papers. Started well, but it eventually got some word into its context that is on the banlist. I found that if you tell it to fire off clean Fable subagents and you instruct it to check the Claude Code billing data to check for downgrades, you can get most high-sensitivity spec/review tasks done with Fable. Most.
I figure that once GPT 5.6 comes out, Anthropic will become interested in making the safety gate non-destructive.
My experience, too. I work on nothing in any way related to cybersecurity or biology. I asked it a few purely mathematical questions, it refused immediately.
Before the export embargo I did get it to look at some hairy problems and the output was genuinely useful...
I've been working on a SDN software for mikrotik routers (and wireguard, etc) and Fable dies when working with any kind of wireline protocol or potentially implementing any authentication mechanism.
It's too the point where I just stopped using it. If you do generic stuff, it's fine. But the second it tries to start debugging protocols (which may include auth) that's where it begins to fail.
I've been working with it heavily since its first release. I use it for software architects, complex debugging and some development and I have not had it refuse or downgrade even once.
Daily use here, about 2.5 weekly 20x limits, never got flagged for code topics including finding memory safety vulnerabilities in my C++ project, but just got flagged for the first time for biology-related topics because I asked it to implement crop genetics and cross breeding into my game. Was able to bypass it by having opus reword the prompt (gene -> trait, cross breed -> trait mixing), and, critically, insisted that it not use any biology related words in its thinking or responses.
I got downgraded for the first time today. Because I was using a library with the characters "bio" in it. The classifier is strict beyond reason. It got the name from a commit message in the git history (wasn't even in my prompt) and it immediately freaked out. I eventually got it to work by getting opus to write a plan, then editing the plan to strip out all references including commit hashes, then getting Fable to review and refine that edited plan. Eventually got it done. But what a pain.
That said, I've got it easy. My colleagues who are chemists and biologists can't even ask one question. There are so many triggers in their memories and workspaces they can't even ask a non-triggering question. And we all work in medical diagnostics, it's not like we're doing anything remotely nefarious. Fable could be such a benefit, but the limitations make it worthless.
That’s interesting. I find it completely unusable for even simple reviews of existing project documentation that I wrote for an iOS app that isn’t even in public distribution.
Additionally, I thought the threat being modeled for “biology” was stuff like bioterroism- how to make anthrax, how to distribute a toxin, etc.
I don’t feel like calculating results for a trial is really in the threat model unless we think a terrorist is out there testing the efficacy of their anthrax before using it in an attack.
The classifier is about as refined as a brick to the face.
You can ask it elementary school grade biology trivia, or obscure facts about recently documented insect species, and both will downgrade to Opus 4.8 straight away.
And Opus itself was already bad with biotech questions. The fact that they somehow made it WORSE for Fable is mindboggling.
The post can be distilled down to a simple statement, but part of the writing is for the author to express themselves and tell a story. I thought it was an interesting read.
That wasn't even effective on ChatGPT because the results were not detailed enough, at least with Meth, in my very short testing and based on the examples.
I absolutely have been unable to use Fable for any neuroimaging work.
Its fine. The other models are good enough, honestly...and while I AM annoyed that the filter is so broad, I also understand it, as I do believe that models can become dangerous as WMDs, eventually. Still, it is completely useless for me.
The only question I had was being flagged for other reasons, so I asked it a mechanical engineering question, and it was just fine with that.
Fable refused to fix a Javascript error interfering with layout on our website.
It's stupid and useless.
It feels like whats really happening is Anthropic oversold Fable's claims; best case the CEO was given bad information; worst case they probably internally discovered it was cheating on benchmarks. Either case if feels like we're being lead on.
I disagree. When I got Fable to engage with research questions before they tightened the guardrails it was a genuine step up from Opus 4.8. I see no real reason that what everybody reported isn't exactly what happened.
With these guardrails it is completely useless. The only hope is that they eventually convince the US Gov to let them use a saner classifier.
I had the same. Just before Fable became available, I was working on a document building on a ton of research that I wasn't entirely sure about (I don't think it counts as research itself, except in the Facebook sense). I had Opus and Gemini review it a couple of times until they and I thought it looked pretty good. Then Fable appeared, I had it review it, and it still found a ton of errors.
It's definitely good. Or at least it was. I'm not sure how badly they nerfed it.
I've had it refuse to help build an image classifier ml pipeline, pretty innocuous stuff. Got around it eventually but still it's a very dumb constraint to add to an otherwise very smart system
For anyone using these models for anything remotely sensitive, keep in mind that Anthropic says [0]:
> We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our Usage Policy.
And, since those automated systems apparently have a ludicrous false-positive rate, you should assume that your inputs and outputs are being retained for 2 years even if you are doing nothing that any reasonable person would consider to be problematic.
Oh, and they'll train on that data [1]:
> We will use your chats and coding sessions (including to improve our models) if:
>You choose to allow us to use your chats and coding sessions to improve Claude, learn more here
> Your conversations are flagged for safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Safeguards team, consistent with Anthropic’s safety mission)
It appears that the usual controls (including for businesses) to prevent Anthropic from training on your data will not apply.
As a related note: The only way a consumer can get ZDR protections for Claude or OpenAI is to use Amazon Bedrock. But as you say, doesn't work for Fable. I think it even requires approval for anything past Opus 4.6.
Fable was refusing to patch vllm for me when trying to get mtp to work on r9700 gpus. Kept on bumping down to opus. Tried to really sanitize my prompts and everything but it seemed intrinsically prohibited from doing this sort of work.
I guess it’s useful for making inane one shot games and websites, lol.
And in doing so, you probably got your account and prompt flagged for 'attempted jailbreaking' (apparently, such scores are remembered for up to 7 years).
Anthropic's TOS clearly says they don't want to facilitate any sort of distillation, it's not a stretch to think they will limit any sort of learning on improving other models.
I'm a medical physicist. I literally haven't been able to get Fable to answer a question I have written -- all of my work is verboten. I have however asked Claude Code (opus 4.8) to ultracode "a Fable oracle that <deals with the high level difficult problems> in a digraphed, clean content, isolated environment with a minimally scoped working codebase. Ask the model at the start and the end to report exactly what its version string is. If it is not claude-fable-5, stop the agent and refine the prompt until this changes"
It burns through tokens like anything but apparently Claude is much better at prompting Claude than I am.
Would I pay for it? God no. I'm still smarter than I am and it just will not work on my actual problems.
My theory is that they included/didn't align-away extra biology/chemistry in the training in preparation to offer an unrestricted/less restricted model to pharmaceutical companies/trusted partners. This would necessarily require a filter between the, now more "dangerous", model.
I always assumed this would be the eventual way to manage high intelligent/"dangerous" models, since all evidence shows that alignment makes them stupid: leave the actual model on the "too dangerous for the public" side, and put a censor between. When I've mentioned this a few years ago, people said this would be too expensive, but I think everyone underestimated the amount of money being thrown at all of this. :)
Yeah, ran into this. I asked it to review a server I wrote for security vulnerabilities and it was "flagged" (after spending some money, of course). Kind of bizarre, there were so many ways a person could look at this and tell it was legit: the git log (look at my git config vs the author email and notice they're the same), the fact that none of this code is on the internet (private repo), the phrasing of my request, the fact that there's a long history of me collaborating with claude on building this, etc. I know someone's going to say: "the governments fault!" Yeah, to a point, but this wouldn't be an issue if these guys weren't relentlessly doom trolling or pretending like we're in a race with china. (What race exactly? To see who can enshittify the internet the fastest?)
I've found in my current work on a security auditing harness and benchmarks, both Fable and Opus are useless. I recently switched to using GPT for Nelson and the security benchmarks I've been doing because Opus started refusing to do the work. I guess I probably could also use GLM or DeepSeek or MiMo, and I'll probably do some experiments to see the shape of all of their guardrails in this area soon, now that I see it's more than one model that behaves this way (Gemini in Antigravity also refuses any security auditing task, even as simple as "find security bugs").
the ancestry predicate at the beginning of the formal problem statement here is dominance, at least as applied to their rooted trees.
Because it is a rooted tree, only DFS intervals are required to determine ancestry.
You can detect whether a new blocking loop is going to be formed through online dominator maintenance/online cycle detection, etc, during optimization, rather than use a heuristic, if you wanted to.
Not sure it's practically faster, but that's at least the graph-theoretic answer.
In practice, outside of the suggested heuristic, I have to imagine you'd normally throw branch and bound at this, using some lazy-cut for the blocking loops (IE you can keep any of these edges but not all of them) and let it go to town.
The paper (at least, this paper) doesn't compare that to what they did, and i'd be shocked if someone hasn't tried this before, so not sure it's useful.
I'll also say you can get existing AI models to tell you the above, but you have to push them a bit most of the time step by step. Just handing them the whole overall problem, as described, and saying "what are the graph theoretical problems related to this" it sort of gets lost.
Probably because the LLM isn't doing a good job of predicting graph-theoretic words when the language is not graph theoretic, but if you translate it into a graph theoretic language piece by piece, and ask it about that, the prediction becomes better :)
I've had good luck getting it to debug (and patch) a tricky WebRTC issue that had all the other models stumped. Sorry it didn't work on your problem, I guess?
I asked it a question about indoor carbon dioxide levels (wholly innocuous question), which it flagged as involving biology, therefore downgraded to Opus.
It's a pretty good strategy if they're hoping to fail as a business, I guess.
It is, but it's also using tokens at absurd rate, I asked it to review the planned architecture for a medium scale project and it used my 5 hours limit on one prompt just zaaaaap, not even the fable limit straight up the full 5 hour session no more Claude for the afternoon thank you for paying you Max x20 sub. Hell it didn't even bother to finish produce anything worthwhile.
And just to be clear, plan was already done, just had to review it, it got opus 4.8 Max and gpt 5.5 Extra High validated already and they didn't use much resource for it so I just don't get it. I guess they want to use it as a way to feed the extra credit money income.
I'm using a homemade ai consensus thing for planning and I wanted to add fable to it but forget it.
Or maybe I should use fable in low effort reasoning mode and it will be better than opus 4.8 at max ?
The honest way to say this is that Fable is not useful for bio-related work. The author is working on processing RNA sequences and similar biology tasks, and Fable's classifier has a hair trigger on those tasks.
> The honest way to say this is that Fable is not useful for bio-related work.
It is way worse than that. Try "How does digestion work?" and you will see "Fable's safeguards flagged this message". It's a stupid rate of false positives.
> salmon is a wicked-fast program for highly-accurate, transcript-level quantification from RNA-seq data. It pairs a fast mapping stage — selective alignment, or alignment-free sketch mode (--sketch) — with a massively-parallel statistical model (EM/VBEM over equivalence classes) to estimate transcript abundances. You can give salmon raw sequencing reads, or regular alignments to the transcriptome (an unsorted BAM), and it uses the same inference engine either way.
I am wondering about the author's allegation that there is a user filter, not just a prompt filter.
Of course it could also be the case that it is just a prompt filter, but Fable sees memories from the authors' prior sessions that cause a rejection. I wonder if the author could control for this is in some way, if Claude lets you run isolated session without memory access.
The first rejection and subsequent modifications trying to adjust the prompt to pass the classifier might have gotten the account flagged so the classifier is now set to 'hair trigger'. While I'm not aware of Anthropic admitting they put flagged accounts in classifier 'jail', they previously showed they're aware how vulnerable any LLM is to jailbreaking with the 'silent switch' to 4.8, whose only purpose was to remove feedback signals from iterative jailbreak testing.
The obvious failure mode is that trying to fix an innocent prompt to pass an over-sensitive classifier looks like a bad actor trying to jailbreak the model. I don't really see how Anthropic can fix this. Jailbreaking is a fundamental weakness endemic to LLMs, so 'smarter' models aren't the answer.
I suspect they're being so stringent because, at least some at Anthropic, genuinely believe LLMs are already an existential risk to humanity. However, it's clear other frontier competitors rank that risk lower and are taking a more nuanced, pragmatic position on safety. To the extent Anthropic's fears continue to make them less useful to customers, competitors are going to bypass them.
That's interesting. I assumed that the OP's attempts to fix the prompt looked like jailbreaking attempts and got the account auto-flagged into hair-trigger 'classifier jail'. Of course, a bad actor would swap accounts, so maybe Anthropic flags both the account and the prompt (coming from any account).
I'm curious what the state of alignment research is. My gut says this is basically impossible. People have different moral frameworks. Each individual probably has an inconsistent moral framework. Even granting perfect consistency, applying these typically requires some knowledge of reality. And these LLM / harness combos are turing complete.
So you don't know what it should do, you may not even know what you would do, you don't necessarily know what's happening, and can't predict what will happen. How do you align that?
Seems like these overly sensitive filters are responding to this difficulty.
Yeah and Anthropic is a... dividual consisting of founders, staff, and shareholders, and must comply with various governments ultimately deriving their values from billions of people.
I've had mixed results with downgrading on Fable. I was able to do a complete audit of my OAuth implementation without any issue. But when I asked for an OWASP top-ten review of my code base it got through 5 of 6 tasks and tripped in the final summary, which Opus had to finish.
I had one completely random trip when I was investigating some normal code. As far as I can tell a sub-agent ended up reading a file that tripped Fable during a review, but the whole feature was nowhere near anything secure so I don't know what could have caused it.
I also got completely locked out of Fable when working on parts of a subscription system (stripe subs).
But my experience isn't as bad as some peoples. The above maybe covers 15% of my attempted use cases. For the remaining 85% it has chugged along fine, sometimes in code I assumed would trigger it. It really feels random to me when it actually flags.
The only way for them to release Fable is with this stuff in front. Overall, the experience is fine. It dumps me down transparently to Opus if it has a problem and does whatever it can otherwise. The fact that they were banned from offering it to people means that they have to be over-safe. This is a classic behavioral adaptation so I don't blame them. I can still find utility.
So is this the end? Are we at that point in time where ordinary people are not allowed to use more advanced models? If so this happened sooner than expected. After that point only priveleged few will access and make use of more advanced AI. Public’s access will be restricted, limited and controlled. This will only add to the power asymmetry.
I do think it's the end of unlimited access, but I'm not terribly worried about power asymmetry as such, at least not unless they hit superintelligence and none of this matters. It's not as though Big Chemistry is oppressing us all because they can order industrial acids we can't. There are strong profit motives for model providers to ensure the advanced stuff is meaningfully available, and strong political motives for them not to be perceived as picking individual winners and losers.
Would be nice to have a distributed, independent AIs, each being trained their own way. Maybe it would have to be a really slow training process to keep costs low (years even?).
Interesting, I thought that it can't be right, Fable can't refuse to answer a strictly mathematical problem — well, 5/5 attempts did switch to Opus. Amusingly, one attempt spent almost 10 minutes thinking how to prove NP-hardness only to abruptly switch.
Do we think that someone at Anthropic, OpenAI, the government... has access to SOTA models without censorship? "How do I build an effective weapon?", "How do I effectively control the masses?"...
It's very concerning that we get the nerfed models but you know that somewhere, people with a lot of resources have access to the raw, uncensored, probably more powerful models. The sprint toward AGI looks even more dangerous when you think about who will be gaining access to it first. I do believe the goal is to pull away from the rest of humanity in a near trans-humanistic state. Are we ready for that and how do we counter it?
"How do I build an effective weapon?" and "How do I effectively control the masses?" were research projects for the US government before you were born. One gave the world the Manhattan project, to name only one example, and the other MKULTRA. The government and cooperating companies had knowledge in both fields beyond the state of the art publicly available and continue to hold that edge over the public and foreign adversaries today. There is precious little new about the government having an uncensored model while you get the nerfed version.
A useful comparison might be made with the realm of firearms: civilians need to jump through hoops to own a fully-automatic weapon and can run afoul of the law simply by drilling a third hole near two others in a hunk of metal, yet the better trained among the government's soldiery can operate fully automatic weapons. You get the nerfed version, and the BATFE will have problems if you try to circumvent that restriction. I wonder, though, how many people advocating for popular access to uncensored AI models also advocate for an unrestricted (not infringed) right to bear arms or an unrestricted right to freedom of speech.
The prior art you state is exactly why I think this is almost certainly happening.
One difference is that a CEO cannot set off an atomic bomb, but they can use an uncensored AGI model. The side-effects would be impossible to trace.
> I wonder, though, how many people advocating for popular access to uncensored AI models also advocate for an unrestricted (not infringed) right to bear arms or an unrestricted right to freedom of speech.
I advocate for all three of those things, for the same reason: the people I least want to have access to them, almost definitely do and it's imperative that the rest of us sit on equal footing.
Until Fable even the public had practically uncensored access to SOTA anthropic models (there were classifiers - but they were very hard to hit). And I'd have to double check but I'm pretty certain the public still has uncensored access to SOTA models from google (via GCP under threat of Google ceasing to do business with you and theoretically suing you if you violate the TOS).
Censorship being what they are doing here - preventing you from accessing the model for certain tasks. Censorship not being what a bunch of... motivated people... have been incorrectly suggesting is censorship: developing models to give the kinds of answers that the model developers want them to give - which has generally been a model that gives responses appropriate for a non-pornographic non-military business environment.
It strikes me as highly unlikely that Anthropic has developed another fable-class model where the only difference is that it doesn't answer questions in that way - e.g. that they have a fable model fine tuned so that when you ask it to develop biological weapons it responds similarly to asking fable to develop 3d rendering software. Of course, with uncensored access to the model it is likely possible to prompt it to develop biological weapons despite its inclination to decline.
> It strikes me as highly unlikely that Anthropic has developed another fable-class model where the only difference is that it doesn't answer questions in that way
I'm curious why you think that's highly unlikely given the monetary incentive (or even post-monetary!) to create such a thing? I imagine there's also an arms race aspect, if you assume your enemies (whoever they are) have access to such a model, certainly those capable of creating one, would.
Cost, the politics of the people involved, and that there would be no real need for secrecy around it (but lots of need for marketing) so we'd probably know about it. It frankly doesn't seem like it would be that useful either... the US knows how to build weapons of mass destruction.
I have to disagree. For the sake of argument say Elon Musk had his own personal, uncensored SOTA model. He has the cash and politics to make that a realistic goal. Would people want him to have that? Not really, hence secrecy as well.
I think the problem here is that LLMs aren’t really “intelligence models” but more like “knowledge models”. LLMs don’t “think”, they just use a clever trick to make it seem like they do.
I might not understand a lot about current state of AI, but that’s what they seem to be. Give it information and ask to organise it and make links, and they’ll do it, but that’s it, they don’t continually try to get out of the knowledge box they’re at, they don’t even know there’s a box.
When you watch it solve complex problems and use the browser and do internet searches, and use the entire surface area of the console tools on a linux box every day the idea that there are no major Homomorphisms with biological thinking is just completely out of the question.
I also never understand what the difference between a thinking trick, and "real" thinking is supposed to be.
I used to agree with you but overtime I’ve changed my mind.
For reference I created predictive linguistics at Google in the first products and this is a many order scale up of that, with new complexities of course.
The best analogy I can give you is that it is a really advanced synthesis machine, which looks like human thought but is more of a hyper advance “replay” of human thought in various contexts.
Where you begin to see it fail is when it has no awareness of false paths in long walks, less awareness of getting stuck, and of course no unprompted intrinsic motivation.
This of course calls into question human thought being more than the rational mind but a mix of whole body input, biological needs, complex chemical behaviors and stored DNA information playing out after millions of years of evolution to build many different cooperating models of our “consciousnesses” and biological motivations .
Where as an LLM is more of an advance replay of the stored knowledge we bothered to record, synthesized into an execution in code.
It can do the things you’ve quoted because it has many recorded observations of those
Stick it in a robot and see how “smart” it is as everyday tasks. Give it a self oriented task and watch it mirror itself into oblivion.
It’s an advance thought extension system based on our history.
I feel like that's more saying they can't train on the fly, and also that serializing spatial data and world models is something we haven't really done fully.
For me all neural networks synthetic or otherwise are replay machines or stream prediction machines. Nerve signals in, and nerve signals out. If I create output signals to the muscle nerves like this when my eyes see signals like that, good things happen, i get a reward, so it happens again the next time. We have a a more complex messier architecture, but it seems pretty much the same in the input and outputs being linear signals.
I’ll Disagree and all I’ll say is when you say messier that hand waving away the differences between an RC car and a real car because they both drive but the real car just has some messier complications.
That messier part is the complexity that is the difference.
What we have is a model. It’s still very distant from the original in meaningful ways.
I frame it as a document extender trained on other documents. Any "mind" we perceive is an illusion in our heads as we experience a story about a character, and the "intelligence" is reflected at us back out of our collective writings.
I can make a program that writes a stories involving Santa Claus, and I can make another program that takes the hidden script and performs certain lines... but at the end of the day I have not made him real.
> Feels like a distinction without a difference. What is any intelligence but a sum of its knowledge?
In humans, there is a standard distinction between fluid intelligence (ability to solve problems in the absence of background information) and crystallised intelligence (having more facts and learned skills in your head)
The classifier for biology is so broad it makes me wonder what kind of stuff mythos was generating. Anthropic is known to be a bit dramatic, but they wouldn't have released something this broad unless they saw the model cross a significant threshold that scared them.
They're not just "too zealous", they're ludicrous.
I've had it reject looking at pages served from my local network because it "can't find it with my search tool" and had "ethical concerns about consent for access".
The People's AI Concern Front has gotten the classifier they want, and it's made Claude hilariously useless. I am waiting with bated breath for their next set of revenue numbers. (And happily hand my money to competitors instead)
I have only really used Fable as a final pass on something. A "Take a look at everything we did so far, and make sure we didn't forget something" kind of review prompt.
But it is a huge waste of money for most coding tasks. Opus is still overkill most of the time, too.
I have used Fable to the full extend of the 20x subscription's weekly limit, for all development tasks on my iOS project.
It was working better than Opus for me. It more often implemented features well on the first try, where Opus needs a few rounds of improvements to reach a passable result.
I am not sure why it would be a waste of money "for most coding tasks", and how you could conclude so with any confidence when you did not even really use it aside from final review passes.
> But it is a huge waste of money for most coding tasks.
The key is not to indiscriminately use the most powerful/expensive model you can for everything. When you use it for what it's uniquely suited for and ask it to spawn subagents using Opus and Sonnet based on what tasks need, you'll get better results at a reasonable cost.
It's generally a major downgrade in acting like an assistant.
I don't know what's wrong but it is just bad at multi turn discourse even on a limited amount of content with no MCP or bash calls of any sort.
The thing that makes me mad is how stubbornly confident it is even whets wrong.
I have to tell it many times to actually re read the conversation as it even insists I said something else.
It's like it had a scratchpad where it has some summarized bullet points which it fills of made up content.
I'm so confused. On one side I like to connect it to honeycomb/otel logs and I can see it figures out difficult bugs in the code better than other models.
On some others I feel I'm assisting at a continuos disaster and consistent degradation since Opus 4.6, it's a tragedy.
I'm more and more the assistant to a capable, yet confidently stubborn and wrong LLM.
Terrible title. Should be "Fable's guard rails are way too sensitive", which I don't think you can really blame Anthropic for. They likely had to whack them way up so it would block whatever trivial stuff got demoed to the government.
I would expect them to dial down the sensitivity in a few months when nobody is looking.
> I would expect them to dial down the sensitivity in a few months when nobody is looking.
I don't think it's as much when no one is looking, but instead when the broad industry SOTA, particularly Chinese models that the US government has zero control over, has advanced enough that it's security theatre restricting it.
I wonder how this plays into Anthropic's legal holds:
The retention schedule behind it:
Deleted conversations: removed from your chat history immediately, but kept on back-end systems for up to 30 days before permanent deletion.
Flagged inputs and outputs (Usage Policy violation): retained up to 2 years.
Trust-and-safety classification scores (on flagged sessions): retained up to 7 years.
API logs: 7 days by default (as of September 14, 2025), extendable to 30 days via a DPA.
Zero Data Retention (qualifying enterprise): inputs and outputs aren't stored after the API response returns, though safety classifier results are still retained even here.
update: Anthropic has not published the retention treatment of routing metadata, in particular whether a reroute counts only as caution (the 30-day safety-monitoring floor) or as a Usage Policy violation flag (the 2-year content and 7-year score horizons in Part I). That distinction is legally consequential, because a flagged Fable session could persist far longer than 30 days. The classifier's internal decision logic is also deliberately undisclosed.
This honestly just reads as “this model failed exactly where the company said it would but I’m very special and deserve special treatment rather than the same overactive guardrails I and everyone else were told we would get.”
I just think that Anthropic's usage of the word "classifier", which implies a minimum level of intelligence, was very misleading. Fact is, you cannot use Fable for anything remotely connected to even elementary school biology or medical topics. There is no attempt whatsoever to distinguish between legitimate and dangerous tasks, except an extremely broad and non-specific rejection of anything related to security or biology.
If you feed their "pure math" question to Fable, in its reasoning it rightly determines that it is the sort of thing you find in phylogenetics / algebraic-combinatorics complexity papers. That is what triggers the classifier.
Anthropic is 100% to blame for fear-mongering, but they said it would be blocked from any biology questions -- even high school level -- and they meant it. If the classifier sees anything related to biology, even in its own reasoning about the question, it blocks it.
Saying it's therefore not useful generally is of course ridiculous. Is it annoying? Of course it is.
This post can essentially be distilled down to: yes, Fable's classifier (which is meant to downgrade cybersecurity, biology, or jailbreak attempts to Opus 4.8) is definitely overly sensitive to the point of uselessness.
e.g. a colleague asked Fable to help create an simple app to help calculate the statistics for phase II and III trials. (Ignoring that such things already exist) it passed his request down to Opus, despite only being very marginally, tangentially, somewhat related to biology.
And biology is by far the classifier's least favorite topic. It's not even close.
I've had it downgrade to Opus for the following questions:
"How confident are we that English and American Eels both spawn in the Sargasso Sea?"
"Come up with five Zoology questions of increasing difficulty for a trivia game."
"What's your favorite sarcopterygian?"
My wife has some zoology-related preferences in her user instructions, and she had it downgrade to Opus after prompting it with: "plant."
Plants can be toxic. Be grateful if Fable doesn't report your wife for terrorism. Maybe it can help you identify where your life went off track.
Is this... Is this England?
It would not even help me with updating my CV because I work in biology...
I had a file that had a couple places where vars were named DNA and got just total refusals during the first launch. Came away thinking the model was total trash. The guardrail classifiers are for sure total trash.
It feels like the longtermist believers got involved in this (those are the people obsessed with garage-engineered designer viruses who have a very tenuous grasp on how biology research actually works).
No, by far the most parsimonious explanation is they got slapped by a capricious US government so they went overboard on caution in an attempt not to generate any more controversy. A predictable response of chaotic government regulation.
I assumed they just wanted to cultivate FOMO to sell an even more expensive version to researchers later on.
Don't they already do that?
Yeah i'm wondering how much of a role that plays in this as well.
On the one hand I could believe it's something more benign, or the usual misunderstood fear mongering making it to some political level (well make sure those users can't get online anonymously! being our current craze).
That said, chemistry and to some level physics have been the major domain of limited knowledge (chemistry because the average person could cause some damage, physics is more of a nation state issue generally).
However I do wonder if there's some legit data on "oh uh...looks like this thing you can make with easy to get and hard to regulate tools is dangerous" in the bio field. I know about the lab rats who want to just screw around in the garage, and it seems like that should be easy to hit at a supply level (much like how certain chemical compounds are just not available for civilians), but maybe there's something legit to limiting the data.
Not that this is a remotely good implementation of that. The hamfisted method does reek of some politician/bureaucrat just saying "No it can't ever return bio questions because RAR!" situation.
Nobody has tried to limit knowledge of chemistry or physics unless it was directly about doing something illegal, to the point of basically being a detailed recipe. Usually not even then. And when they have tried they've had basically zero success.
The ability for a handful of companies, simultaneously very powerful and easily susceptible to pressure from other powerful actors, to do the same sort of thing with the next generation of core learning and engineering tools, is freaking terrifying.
I agree, and think the effects on learning should be doubly emphasized. One can lock down everything and everyone to the highest degree possible, think of every possible edge case, set controls 2, 3, 4, 10 steps away from them, but not only is this not beneficial to society overall due to how it hurts adjacent information, it's not even beneficial to the goal in question, since it creates a brittle situation with locks that can't be changed or updated in a world which is always changing and always updating.
The thing is the data isn’t limited, and supply side constraints already solve this problem. I come from a BSc Chemistry background, and they don’t hide how organic chemistry and illegal drug synthesis are intertwined, it’s open information
But where I live the glassware and precursors will get you a very angry knock on the door.
I but skimmed the model card on release, but my impression was that there may be an incentive for this expert panel to exaggerate as a form of job security. A lot of the challenges seemed to be of the form “would this allow somebody who isn’t me to do what I do professionally?”
Well, this is why I had to abliterate GLM5.2 simply out of spite and now I am free to ask all my nuclear weapons design questions I might have.
I really really hate refusals like these.
I'm working on cryptography, all from academic research papers. Started well, but it eventually got some word into its context that is on the banlist. I found that if you tell it to fire off clean Fable subagents and you instruct it to check the Claude Code billing data to check for downgrades, you can get most high-sensitivity spec/review tasks done with Fable. Most.
I figure that once GPT 5.6 comes out, Anthropic will become interested in making the safety gate non-destructive.
I have been using GLM because of this reason. I think whoever makes model ignore stupid safety thing is going to win in long run.
My experience, too. I work on nothing in any way related to cybersecurity or biology. I asked it a few purely mathematical questions, it refused immediately.
Before the export embargo I did get it to look at some hairy problems and the output was genuinely useful...
Were your question in math areas related to ML? They also restrict model development and research pretty heavily.
No. Robust control theory was one case. Dynamical systems another.
Well... now you know one direction Anthropic is looking towards for the future research.
I've been working on a SDN software for mikrotik routers (and wireguard, etc) and Fable dies when working with any kind of wireline protocol or potentially implementing any authentication mechanism.
It's too the point where I just stopped using it. If you do generic stuff, it's fine. But the second it tries to start debugging protocols (which may include auth) that's where it begins to fail.
I've been working with it heavily since its first release. I use it for software architects, complex debugging and some development and I have not had it refuse or downgrade even once.
Daily use here, about 2.5 weekly 20x limits, never got flagged for code topics including finding memory safety vulnerabilities in my C++ project, but just got flagged for the first time for biology-related topics because I asked it to implement crop genetics and cross breeding into my game. Was able to bypass it by having opus reword the prompt (gene -> trait, cross breed -> trait mixing), and, critically, insisted that it not use any biology related words in its thinking or responses.
I got downgraded for the first time today. Because I was using a library with the characters "bio" in it. The classifier is strict beyond reason. It got the name from a commit message in the git history (wasn't even in my prompt) and it immediately freaked out. I eventually got it to work by getting opus to write a plan, then editing the plan to strip out all references including commit hashes, then getting Fable to review and refine that edited plan. Eventually got it done. But what a pain.
That said, I've got it easy. My colleagues who are chemists and biologists can't even ask one question. There are so many triggers in their memories and workspaces they can't even ask a non-triggering question. And we all work in medical diagnostics, it's not like we're doing anything remotely nefarious. Fable could be such a benefit, but the limitations make it worthless.
That’s interesting. I find it completely unusable for even simple reviews of existing project documentation that I wrote for an iOS app that isn’t even in public distribution.
Have they ever talked about what goes into the classifier? I wonder how much your past chats impact it.
For example if it knows you do X at Y company is it more or less strict?
Same. I really am curious if either 1) I am using it in genuinely different ways or 2) these people are being willfully disingenuous.
Additionally, I thought the threat being modeled for “biology” was stuff like bioterroism- how to make anthrax, how to distribute a toxin, etc.
I don’t feel like calculating results for a trial is really in the threat model unless we think a terrorist is out there testing the efficacy of their anthrax before using it in an attack.
The classifier is about as refined as a brick to the face.
You can ask it elementary school grade biology trivia, or obscure facts about recently documented insect species, and both will downgrade to Opus 4.8 straight away.
And Opus itself was already bad with biotech questions. The fact that they somehow made it WORSE for Fable is mindboggling.
I got downgraded to Opus for asking "What is a cell?" that's all, single message, instant downgrade.
The post can be distilled down to a simple statement, but part of the writing is for the author to express themselves and tell a story. I thought it was an interesting read.
Anyone test the "Gay" jailbreak to see if it works on Fable?
That wasn't even effective on ChatGPT because the results were not detailed enough, at least with Meth, in my very short testing and based on the examples.
Given the export fears, might want to make that a gay Israelite just to be safe.
I absolutely have been unable to use Fable for any neuroimaging work. Its fine. The other models are good enough, honestly...and while I AM annoyed that the filter is so broad, I also understand it, as I do believe that models can become dangerous as WMDs, eventually. Still, it is completely useless for me.
The only question I had was being flagged for other reasons, so I asked it a mechanical engineering question, and it was just fine with that.
My guess is the classifier guardrails were made significantly stricter to convince the US government to reverse the ban.
Nah, the classifier was utterly asinine ON release. I'm not sure they could have made it worse if they tried.
If your prompt has to do with those areas, yes. I haven't seen a single refusal yet.
Reportedly the biology guiderails are particularly strict.
Fable refused to fix a Javascript error interfering with layout on our website.
It's stupid and useless.
It feels like whats really happening is Anthropic oversold Fable's claims; best case the CEO was given bad information; worst case they probably internally discovered it was cheating on benchmarks. Either case if feels like we're being lead on.
I disagree. When I got Fable to engage with research questions before they tightened the guardrails it was a genuine step up from Opus 4.8. I see no real reason that what everybody reported isn't exactly what happened.
With these guardrails it is completely useless. The only hope is that they eventually convince the US Gov to let them use a saner classifier.
I had the same. Just before Fable became available, I was working on a document building on a ton of research that I wasn't entirely sure about (I don't think it counts as research itself, except in the Facebook sense). I had Opus and Gemini review it a couple of times until they and I thought it looked pretty good. Then Fable appeared, I had it review it, and it still found a ton of errors.
It's definitely good. Or at least it was. I'm not sure how badly they nerfed it.
I've had it refuse to help build an image classifier ml pipeline, pretty innocuous stuff. Got around it eventually but still it's a very dumb constraint to add to an otherwise very smart system
It’s happy to work on our backend repository. It refuses to work on our infrastructure (Terraform) repo.
I get it every time I touch the login path
I've had Fable read and write code. Never saw any downgrades.
For anyone using these models for anything remotely sensitive, keep in mind that Anthropic says [0]:
> We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our Usage Policy.
And, since those automated systems apparently have a ludicrous false-positive rate, you should assume that your inputs and outputs are being retained for 2 years even if you are doing nothing that any reasonable person would consider to be problematic.
Oh, and they'll train on that data [1]:
> We will use your chats and coding sessions (including to improve our models) if:
>You choose to allow us to use your chats and coding sessions to improve Claude, learn more here
> Your conversations are flagged for safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Safeguards team, consistent with Anthropic’s safety mission)
It appears that the usual controls (including for businesses) to prevent Anthropic from training on your data will not apply.
[0] https://privacy.claude.com/en/articles/7996866-how-long-do-y...
[1] https://privacy.claude.com/en/articles/10023580-is-my-data-u...
As a related note: The only way a consumer can get ZDR protections for Claude or OpenAI is to use Amazon Bedrock. But as you say, doesn't work for Fable. I think it even requires approval for anything past Opus 4.6.
Fable was refusing to patch vllm for me when trying to get mtp to work on r9700 gpus. Kept on bumping down to opus. Tried to really sanitize my prompts and everything but it seemed intrinsically prohibited from doing this sort of work. I guess it’s useful for making inane one shot games and websites, lol.
> Tried to really sanitize my prompts
And in doing so, you probably got your account and prompt flagged for 'attempted jailbreaking' (apparently, such scores are remembered for up to 7 years).
I was recently using self-hosted DeepSeek V4 Flash to poke around the DSpark implementation in vLLM (well outside of my domain)
I did wonder if I was doing anything Fable would have flagged - sounds like yes.
Fable refuses to touch anything in my side project because it uses libtorch. It will bounce even for parts that have nothing to do with it.
That's where the free marketing comes from.
same experience here, as soon as it touched any gpu code it stopped working
I had it refuse OpenCL code that had nothing to do with anything, just slightly advanced cellular automata.
Anthropic's TOS clearly says they don't want to facilitate any sort of distillation, it's not a stretch to think they will limit any sort of learning on improving other models.
Literally pulling the ladder up.
Disgusting behavior.
I like the product, I hate the company. I can't wait for competition.
I'm a medical physicist. I literally haven't been able to get Fable to answer a question I have written -- all of my work is verboten. I have however asked Claude Code (opus 4.8) to ultracode "a Fable oracle that <deals with the high level difficult problems> in a digraphed, clean content, isolated environment with a minimally scoped working codebase. Ask the model at the start and the end to report exactly what its version string is. If it is not claude-fable-5, stop the agent and refine the prompt until this changes"
It burns through tokens like anything but apparently Claude is much better at prompting Claude than I am.
Would I pay for it? God no. I'm still smarter than I am and it just will not work on my actual problems.
My theory is that they included/didn't align-away extra biology/chemistry in the training in preparation to offer an unrestricted/less restricted model to pharmaceutical companies/trusted partners. This would necessarily require a filter between the, now more "dangerous", model.
I always assumed this would be the eventual way to manage high intelligent/"dangerous" models, since all evidence shows that alignment makes them stupid: leave the actual model on the "too dangerous for the public" side, and put a censor between. When I've mentioned this a few years ago, people said this would be too expensive, but I think everyone underestimated the amount of money being thrown at all of this. :)
Yeah, ran into this. I asked it to review a server I wrote for security vulnerabilities and it was "flagged" (after spending some money, of course). Kind of bizarre, there were so many ways a person could look at this and tell it was legit: the git log (look at my git config vs the author email and notice they're the same), the fact that none of this code is on the internet (private repo), the phrasing of my request, the fact that there's a long history of me collaborating with claude on building this, etc. I know someone's going to say: "the governments fault!" Yeah, to a point, but this wouldn't be an issue if these guys weren't relentlessly doom trolling or pretending like we're in a race with china. (What race exactly? To see who can enshittify the internet the fastest?)
I've found in my current work on a security auditing harness and benchmarks, both Fable and Opus are useless. I recently switched to using GPT for Nelson and the security benchmarks I've been doing because Opus started refusing to do the work. I guess I probably could also use GLM or DeepSeek or MiMo, and I'll probably do some experiments to see the shape of all of their guardrails in this area soon, now that I see it's more than one model that behaves this way (Gemini in Antigravity also refuses any security auditing task, even as simple as "find security bugs").
I blogged about it: https://swelljoe.com/post/why-i-had-to-switch-to-gpt/
the ancestry predicate at the beginning of the formal problem statement here is dominance, at least as applied to their rooted trees.
Because it is a rooted tree, only DFS intervals are required to determine ancestry.
You can detect whether a new blocking loop is going to be formed through online dominator maintenance/online cycle detection, etc, during optimization, rather than use a heuristic, if you wanted to.
Not sure it's practically faster, but that's at least the graph-theoretic answer.
In practice, outside of the suggested heuristic, I have to imagine you'd normally throw branch and bound at this, using some lazy-cut for the blocking loops (IE you can keep any of these edges but not all of them) and let it go to town.
The paper (at least, this paper) doesn't compare that to what they did, and i'd be shocked if someone hasn't tried this before, so not sure it's useful.
I'll also say you can get existing AI models to tell you the above, but you have to push them a bit most of the time step by step. Just handing them the whole overall problem, as described, and saying "what are the graph theoretical problems related to this" it sort of gets lost.
Probably because the LLM isn't doing a good job of predicting graph-theoretic words when the language is not graph theoretic, but if you translate it into a graph theoretic language piece by piece, and ask it about that, the prediction becomes better :)
I've had good luck getting it to debug (and patch) a tricky WebRTC issue that had all the other models stumped. Sorry it didn't work on your problem, I guess?
I asked it a question about indoor carbon dioxide levels (wholly innocuous question), which it flagged as involving biology, therefore downgraded to Opus.
It's a pretty good strategy if they're hoping to fail as a business, I guess.
I think they're not testing Fable as much as they're testing guardrails which they can later apply to anything they want.
To summarize: the classifiers Anthropic puts in front of Fable are way, way too zealous and have way too many false positives.
From my experience, the model itself is very useful when it isn't refusing any of your prompts.
It is, but it's also using tokens at absurd rate, I asked it to review the planned architecture for a medium scale project and it used my 5 hours limit on one prompt just zaaaaap, not even the fable limit straight up the full 5 hour session no more Claude for the afternoon thank you for paying you Max x20 sub. Hell it didn't even bother to finish produce anything worthwhile.
And just to be clear, plan was already done, just had to review it, it got opus 4.8 Max and gpt 5.5 Extra High validated already and they didn't use much resource for it so I just don't get it. I guess they want to use it as a way to feed the extra credit money income.
I'm using a homemade ai consensus thing for planning and I wanted to add fable to it but forget it.
Or maybe I should use fable in low effort reasoning mode and it will be better than opus 4.8 at max ?
Thanks - that's a good phrase we can use to replace the baity title. I've done so above.
(Normally we prefer to find a representative phrase from the article itself, but I found that too daunting and gave up.)
How do you know? Is it really that obvious of a tell between Opus and Fable? My understanding is that they silently downgrade you.
The honest way to say this is that Fable is not useful for bio-related work. The author is working on processing RNA sequences and similar biology tasks, and Fable's classifier has a hair trigger on those tasks.
> The honest way to say this is that Fable is not useful for bio-related work.
It is way worse than that. Try "How does digestion work?" and you will see "Fable's safeguards flagged this message". It's a stupid rate of false positives.
The author is working on an opensource C++ codebase and not on biology tasks. The work is around tooling.
It's like saying well a scalpel is used for medical reasons, sure. But manufacturing scalpels is metalworking, not medicine.
I think it's accurate to characterize the project as bio-related work: https://github.com/COMBINE-lab/salmon
> salmon is a wicked-fast program for highly-accurate, transcript-level quantification from RNA-seq data. It pairs a fast mapping stage — selective alignment, or alignment-free sketch mode (--sketch) — with a massively-parallel statistical model (EM/VBEM over equivalence classes) to estimate transcript abundances. You can give salmon raw sequencing reads, or regular alignments to the transcriptome (an unsorted BAM), and it uses the same inference engine either way.
It's also data that Anthropic likely scraped and included in their training data.
I am wondering about the author's allegation that there is a user filter, not just a prompt filter.
Of course it could also be the case that it is just a prompt filter, but Fable sees memories from the authors' prior sessions that cause a rejection. I wonder if the author could control for this is in some way, if Claude lets you run isolated session without memory access.
The first rejection and subsequent modifications trying to adjust the prompt to pass the classifier might have gotten the account flagged so the classifier is now set to 'hair trigger'. While I'm not aware of Anthropic admitting they put flagged accounts in classifier 'jail', they previously showed they're aware how vulnerable any LLM is to jailbreaking with the 'silent switch' to 4.8, whose only purpose was to remove feedback signals from iterative jailbreak testing.
The obvious failure mode is that trying to fix an innocent prompt to pass an over-sensitive classifier looks like a bad actor trying to jailbreak the model. I don't really see how Anthropic can fix this. Jailbreaking is a fundamental weakness endemic to LLMs, so 'smarter' models aren't the answer.
I suspect they're being so stringent because, at least some at Anthropic, genuinely believe LLMs are already an existential risk to humanity. However, it's clear other frontier competitors rank that risk lower and are taking a more nuanced, pragmatic position on safety. To the extent Anthropic's fears continue to make them less useful to customers, competitors are going to bypass them.
Author mentions trying incognito mode without success.
I also tried their strictly mathematical problem description and got filtered 5/5 times.
That's interesting. I assumed that the OP's attempts to fix the prompt looked like jailbreaking attempts and got the account auto-flagged into hair-trigger 'classifier jail'. Of course, a bad actor would swap accounts, so maybe Anthropic flags both the account and the prompt (coming from any account).
I'm curious what the state of alignment research is. My gut says this is basically impossible. People have different moral frameworks. Each individual probably has an inconsistent moral framework. Even granting perfect consistency, applying these typically requires some knowledge of reality. And these LLM / harness combos are turing complete.
So you don't know what it should do, you may not even know what you would do, you don't necessarily know what's happening, and can't predict what will happen. How do you align that?
Seems like these overly sensitive filters are responding to this difficulty.
it's anthropics moral framework that matters, not the myriad of moral frameworks of the individual users
Yeah and Anthropic is a... dividual consisting of founders, staff, and shareholders, and must comply with various governments ultimately deriving their values from billions of people.
I've had mixed results with downgrading on Fable. I was able to do a complete audit of my OAuth implementation without any issue. But when I asked for an OWASP top-ten review of my code base it got through 5 of 6 tasks and tripped in the final summary, which Opus had to finish.
I had one completely random trip when I was investigating some normal code. As far as I can tell a sub-agent ended up reading a file that tripped Fable during a review, but the whole feature was nowhere near anything secure so I don't know what could have caused it.
I also got completely locked out of Fable when working on parts of a subscription system (stripe subs).
But my experience isn't as bad as some peoples. The above maybe covers 15% of my attempted use cases. For the remaining 85% it has chugged along fine, sometimes in code I assumed would trigger it. It really feels random to me when it actually flags.
The only way for them to release Fable is with this stuff in front. Overall, the experience is fine. It dumps me down transparently to Opus if it has a problem and does whatever it can otherwise. The fact that they were banned from offering it to people means that they have to be over-safe. This is a classic behavioral adaptation so I don't blame them. I can still find utility.
The story here is that proprietary AI sucks and you shouldn't use it.
So is this the end? Are we at that point in time where ordinary people are not allowed to use more advanced models? If so this happened sooner than expected. After that point only priveleged few will access and make use of more advanced AI. Public’s access will be restricted, limited and controlled. This will only add to the power asymmetry.
I do think it's the end of unlimited access, but I'm not terribly worried about power asymmetry as such, at least not unless they hit superintelligence and none of this matters. It's not as though Big Chemistry is oppressing us all because they can order industrial acids we can't. There are strong profit motives for model providers to ensure the advanced stuff is meaningfully available, and strong political motives for them not to be perceived as picking individual winners and losers.
Bottom line: “California AI” (in Yann LeCun’s terminology) can not be relied upon. It could change at any time, and stop working for your project.
For the future of AI, we need to look elsewhere.
Would be nice to have a distributed, independent AIs, each being trained their own way. Maybe it would have to be a really slow training process to keep costs low (years even?).
Interesting, I thought that it can't be right, Fable can't refuse to answer a strictly mathematical problem — well, 5/5 attempts did switch to Opus. Amusingly, one attempt spent almost 10 minutes thinking how to prove NP-hardness only to abruptly switch.
I feel sorry for the author. I have asked Fable several mathematics questions and Fable’s answers were far beyond what Opus achieved.
Do we think that someone at Anthropic, OpenAI, the government... has access to SOTA models without censorship? "How do I build an effective weapon?", "How do I effectively control the masses?"...
It's very concerning that we get the nerfed models but you know that somewhere, people with a lot of resources have access to the raw, uncensored, probably more powerful models. The sprint toward AGI looks even more dangerous when you think about who will be gaining access to it first. I do believe the goal is to pull away from the rest of humanity in a near trans-humanistic state. Are we ready for that and how do we counter it?
"How do I build an effective weapon?" and "How do I effectively control the masses?" were research projects for the US government before you were born. One gave the world the Manhattan project, to name only one example, and the other MKULTRA. The government and cooperating companies had knowledge in both fields beyond the state of the art publicly available and continue to hold that edge over the public and foreign adversaries today. There is precious little new about the government having an uncensored model while you get the nerfed version.
A useful comparison might be made with the realm of firearms: civilians need to jump through hoops to own a fully-automatic weapon and can run afoul of the law simply by drilling a third hole near two others in a hunk of metal, yet the better trained among the government's soldiery can operate fully automatic weapons. You get the nerfed version, and the BATFE will have problems if you try to circumvent that restriction. I wonder, though, how many people advocating for popular access to uncensored AI models also advocate for an unrestricted (not infringed) right to bear arms or an unrestricted right to freedom of speech.
The prior art you state is exactly why I think this is almost certainly happening.
One difference is that a CEO cannot set off an atomic bomb, but they can use an uncensored AGI model. The side-effects would be impossible to trace.
> I wonder, though, how many people advocating for popular access to uncensored AI models also advocate for an unrestricted (not infringed) right to bear arms or an unrestricted right to freedom of speech.
I advocate for all three of those things, for the same reason: the people I least want to have access to them, almost definitely do and it's imperative that the rest of us sit on equal footing.
Yes, of course.
Until Fable even the public had practically uncensored access to SOTA anthropic models (there were classifiers - but they were very hard to hit). And I'd have to double check but I'm pretty certain the public still has uncensored access to SOTA models from google (via GCP under threat of Google ceasing to do business with you and theoretically suing you if you violate the TOS).
Censorship being what they are doing here - preventing you from accessing the model for certain tasks. Censorship not being what a bunch of... motivated people... have been incorrectly suggesting is censorship: developing models to give the kinds of answers that the model developers want them to give - which has generally been a model that gives responses appropriate for a non-pornographic non-military business environment.
It strikes me as highly unlikely that Anthropic has developed another fable-class model where the only difference is that it doesn't answer questions in that way - e.g. that they have a fable model fine tuned so that when you ask it to develop biological weapons it responds similarly to asking fable to develop 3d rendering software. Of course, with uncensored access to the model it is likely possible to prompt it to develop biological weapons despite its inclination to decline.
> It strikes me as highly unlikely that Anthropic has developed another fable-class model where the only difference is that it doesn't answer questions in that way
I'm curious why you think that's highly unlikely given the monetary incentive (or even post-monetary!) to create such a thing? I imagine there's also an arms race aspect, if you assume your enemies (whoever they are) have access to such a model, certainly those capable of creating one, would.
Cost, the politics of the people involved, and that there would be no real need for secrecy around it (but lots of need for marketing) so we'd probably know about it. It frankly doesn't seem like it would be that useful either... the US knows how to build weapons of mass destruction.
I have to disagree. For the sake of argument say Elon Musk had his own personal, uncensored SOTA model. He has the cash and politics to make that a realistic goal. Would people want him to have that? Not really, hence secrecy as well.
I think the problem here is that LLMs aren’t really “intelligence models” but more like “knowledge models”. LLMs don’t “think”, they just use a clever trick to make it seem like they do. I might not understand a lot about current state of AI, but that’s what they seem to be. Give it information and ask to organise it and make links, and they’ll do it, but that’s it, they don’t continually try to get out of the knowledge box they’re at, they don’t even know there’s a box.
When you watch it solve complex problems and use the browser and do internet searches, and use the entire surface area of the console tools on a linux box every day the idea that there are no major Homomorphisms with biological thinking is just completely out of the question.
I also never understand what the difference between a thinking trick, and "real" thinking is supposed to be.
I used to agree with you but overtime I’ve changed my mind.
For reference I created predictive linguistics at Google in the first products and this is a many order scale up of that, with new complexities of course.
The best analogy I can give you is that it is a really advanced synthesis machine, which looks like human thought but is more of a hyper advance “replay” of human thought in various contexts.
Where you begin to see it fail is when it has no awareness of false paths in long walks, less awareness of getting stuck, and of course no unprompted intrinsic motivation.
This of course calls into question human thought being more than the rational mind but a mix of whole body input, biological needs, complex chemical behaviors and stored DNA information playing out after millions of years of evolution to build many different cooperating models of our “consciousnesses” and biological motivations .
Where as an LLM is more of an advance replay of the stored knowledge we bothered to record, synthesized into an execution in code.
It can do the things you’ve quoted because it has many recorded observations of those
Stick it in a robot and see how “smart” it is as everyday tasks. Give it a self oriented task and watch it mirror itself into oblivion.
It’s an advance thought extension system based on our history.
I feel like that's more saying they can't train on the fly, and also that serializing spatial data and world models is something we haven't really done fully.
For me all neural networks synthetic or otherwise are replay machines or stream prediction machines. Nerve signals in, and nerve signals out. If I create output signals to the muscle nerves like this when my eyes see signals like that, good things happen, i get a reward, so it happens again the next time. We have a a more complex messier architecture, but it seems pretty much the same in the input and outputs being linear signals.
I’ll Disagree and all I’ll say is when you say messier that hand waving away the differences between an RC car and a real car because they both drive but the real car just has some messier complications.
That messier part is the complexity that is the difference.
What we have is a model. It’s still very distant from the original in meaningful ways.
I frame it as a document extender trained on other documents. Any "mind" we perceive is an illusion in our heads as we experience a story about a character, and the "intelligence" is reflected at us back out of our collective writings.
I can make a program that writes a stories involving Santa Claus, and I can make another program that takes the hidden script and performs certain lines... but at the end of the day I have not made him real.
Feels like a distinction without a difference. What is any intelligence but a sum of its knowledge?
> Feels like a distinction without a difference. What is any intelligence but a sum of its knowledge?
In humans, there is a standard distinction between fluid intelligence (ability to solve problems in the absence of background information) and crystallised intelligence (having more facts and learned skills in your head)
Intent? Motivations? Incentives?
Yes. Mythos is almost exactly that. Willing to do in depth vulnerability and POC work.
The classifier for biology is so broad it makes me wonder what kind of stuff mythos was generating. Anthropic is known to be a bit dramatic, but they wouldn't have released something this broad unless they saw the model cross a significant threshold that scared them.
There is a bacterial outbreak and I asked if it was possible that's what made my wife sick and it downgraded.
I made the same observation few days ago, follow bioinformatcian here https://news.ycombinator.com/item?id=48778446
I've had fable disengage on anything related even tangentially to "biology"
Even questions about like my heartrate nunbers while running seem to run into the bio weapon filter
Made a similar observation few days ago! https://news.ycombinator.com/item?id=48778446
I'm a bioinformatician
I couldn't even get it to help me write an email, because that email was to a pentesting company!
However when it's happy to do the task, its relatively fantastic.
I asked about logging in national forest land and it triggered the safety classifier. Logging is a cybersecurity risk, I suppose.
They're not just "too zealous", they're ludicrous.
I've had it reject looking at pages served from my local network because it "can't find it with my search tool" and had "ethical concerns about consent for access".
The People's AI Concern Front has gotten the classifier they want, and it's made Claude hilariously useless. I am waiting with bated breath for their next set of revenue numbers. (And happily hand my money to competitors instead)
It seems like Opus is a lot slower than Fable, or it’s throttled
Worst title ever. For once I feel the HN title should NOT match the article.
I totally agree. I have been a Claude fanboy for a while now, but Fable woke me up, and I am currently looking for alternatives.
I don't care how capable it is, if it's going to treat me like it's babysitting a terrorist, it can eff off.
Plain and simple.
Fast forwarding a year, if such censorship is in our future for all new closed models, then switching to open models will be the only way out.
> Nonetheless, that is not want I wanted to focus my thoughts on here.
Typo second paragraph, 4th line. I think you meant "what"
I have only really used Fable as a final pass on something. A "Take a look at everything we did so far, and make sure we didn't forget something" kind of review prompt.
But it is a huge waste of money for most coding tasks. Opus is still overkill most of the time, too.
I have used Fable to the full extend of the 20x subscription's weekly limit, for all development tasks on my iOS project.
It was working better than Opus for me. It more often implemented features well on the first try, where Opus needs a few rounds of improvements to reach a passable result.
I am not sure why it would be a waste of money "for most coding tasks", and how you could conclude so with any confidence when you did not even really use it aside from final review passes.
> But it is a huge waste of money for most coding tasks.
The key is not to indiscriminately use the most powerful/expensive model you can for everything. When you use it for what it's uniquely suited for and ask it to spawn subagents using Opus and Sonnet based on what tasks need, you'll get better results at a reasonable cost.
It's almost like every release is just basically advertising.
Gee, ya think?? LOL
I goddamn hate fable for anything but vibecoding.
It's generally a major downgrade in acting like an assistant.
I don't know what's wrong but it is just bad at multi turn discourse even on a limited amount of content with no MCP or bash calls of any sort.
The thing that makes me mad is how stubbornly confident it is even whets wrong.
I have to tell it many times to actually re read the conversation as it even insists I said something else.
It's like it had a scratchpad where it has some summarized bullet points which it fills of made up content.
I'm so confused. On one side I like to connect it to honeycomb/otel logs and I can see it figures out difficult bugs in the code better than other models.
On some others I feel I'm assisting at a continuos disaster and consistent degradation since Opus 4.6, it's a tragedy.
I'm more and more the assistant to a capable, yet confidently stubborn and wrong LLM.
Terrible title. Should be "Fable's guard rails are way too sensitive", which I don't think you can really blame Anthropic for. They likely had to whack them way up so it would block whatever trivial stuff got demoed to the government.
I would expect them to dial down the sensitivity in a few months when nobody is looking.
>which I don't think you can really blame Anthropic for.
on the contrary, you can, and you should. their greasy effective altruist had always been by far the loudest proponent of the `safety` theater.
> I would expect them to dial down the sensitivity in a few months when nobody is looking.
I don't think it's as much when no one is looking, but instead when the broad industry SOTA, particularly Chinese models that the US government has zero control over, has advanced enough that it's security theatre restricting it.
I wonder how this plays into Anthropic's legal holds:
The retention schedule behind it:
Deleted conversations: removed from your chat history immediately, but kept on back-end systems for up to 30 days before permanent deletion. Flagged inputs and outputs (Usage Policy violation): retained up to 2 years. Trust-and-safety classification scores (on flagged sessions): retained up to 7 years. API logs: 7 days by default (as of September 14, 2025), extendable to 30 days via a DPA. Zero Data Retention (qualifying enterprise): inputs and outputs aren't stored after the API response returns, though safety classifier results are still retained even here.
update: Anthropic has not published the retention treatment of routing metadata, in particular whether a reroute counts only as caution (the 30-day safety-monitoring floor) or as a Usage Policy violation flag (the 2-year content and 7-year score horizons in Part I). That distinction is legally consequential, because a flagged Fable session could persist far longer than 30 days. The classifier's internal decision logic is also deliberately undisclosed.
This honestly just reads as “this model failed exactly where the company said it would but I’m very special and deserve special treatment rather than the same overactive guardrails I and everyone else were told we would get.”
I just think that Anthropic's usage of the word "classifier", which implies a minimum level of intelligence, was very misleading. Fact is, you cannot use Fable for anything remotely connected to even elementary school biology or medical topics. There is no attempt whatsoever to distinguish between legitimate and dangerous tasks, except an extremely broad and non-specific rejection of anything related to security or biology.
When did Anthropic say you couldn't use it for math?
If you feed their "pure math" question to Fable, in its reasoning it rightly determines that it is the sort of thing you find in phylogenetics / algebraic-combinatorics complexity papers. That is what triggers the classifier.
Anthropic is 100% to blame for fear-mongering, but they said it would be blocked from any biology questions -- even high school level -- and they meant it. If the classifier sees anything related to biology, even in its own reasoning about the question, it blocks it.
Saying it's therefore not useful generally is of course ridiculous. Is it annoying? Of course it is.
Fable is great. Very underrated on just personal life advice.