The Capability You Can't Have

On Tuesday, Anthropic released the most powerful AI model the public has ever been allowed to touch. Five days earlier, the same company asked the rest of the industry to help it build a pause button. Between those two announcements sits everything you need to know about how frontier AI is actually sold.

Claude Fable 5 arrived June 9 as the public version of Mythos, the model Anthropic spent two months describing as too dangerous to release.¹ It launched alongside Mythos 5, which goes to government agencies and critical-infrastructure defenders with, in Anthropic's words, "the safeguards lifted in some areas."¹ TechCrunch put the timing in its headline: Anthropic released its most powerful model publicly "days after warning AI is getting too dangerous."⁶

PCWorld's version was blunter: "Claude's 'too dangerous' AI model is finally public. But there's a catch."⁸ By our count there are three. The public model quietly hands the most sensitive work to last year's model. The pricing puts the real capability behind a clearance you cannot buy. And the free taste expires on June 22.⁸

The Split

Anthropic did not ship one model on Tuesday. It shipped one model twice.

Fable 5 is the public version. Mythos 5 is the same underlying model with, in Anthropic's words, "the safeguards lifted in some areas."¹ Same weights. Different permissions. The line between them is not capability. It is clearance.

Here is what the safeguard actually does. When Fable's classifiers flag a request touching cybersecurity, biology and chemistry, or "distillation," the model hands the question off. "The response is automatically handled by Claude Opus 4.8 instead,"¹ the older model from last year. You ask the frontier model a security question. You get an answer from the previous generation. To Anthropic's credit, you are told: the apps name the model that answered, and the API returns a structured refusal rather than swapping models behind your back.⁹

Anthropic says this is rare. "More than 95% of Fable sessions involve no fallback at all."¹ Read it the other way. The dangerous 5% is exactly where the public model becomes a downgrade, and that 5% contains the work the marketing is built on.

Update, June 11: A day after publication, Anthropic told WIRED it is making the frontier-LLM-development safeguards described below visible, with the same Opus 4.8 fallback as the other categories: "We made the wrong tradeoff and we apologize for not getting the balance right." API requests will return a reason for refusal. The invisible version described below was policy for roughly 48 hours.

That is the disclosed tier. The system card adds a fourth category, and this one works differently.⁹ For requests Anthropic reads as frontier LLM development, building pretraining pipelines, distributed training infrastructure, designing ML accelerators, there is no handoff and no notice. The card says it plainly: "Unlike our interventions for cybersecurity, biology and chemistry, and distillation attempts, these safeguards will not be visible to the user."⁹

No fallback this time. "Fable 5 will not fall back to a different model. Instead, the safeguards will limit effectiveness through methods such as prompt modification, steering vectors, or parameter-efficient fine-tuning (PEFT)."⁹ Translate that. For one class of work, the model is made worse on purpose, by methods you cannot detect, and the company's own documentation says so. Anthropic estimates the interventions touch 0.03% of traffic, concentrated in fewer than 0.1% of organizations.⁹ The same page promises that "Claude will still respond helpfully to user requests." Helpful and degraded at the same time. The card does not treat this as a contradiction.

The passage sits on page 13 of a 319-page document. It reached daylight because a developer read it and wrote it up, and his post spent Tuesday night on the Hacker News front page.¹⁰ The disclosure existed. The visibility did not. There is a difference between publishing a fact and surfacing one, and Anthropic understands it as well as anyone.

The unrestricted version is real, and it is deployed. Mythos 5 goes to cyber defenders and critical infrastructure providers through Project Glasswing, "in collaboration with the US government."¹ A biology access program is next. The capability exists. It works. It is reserved.

Look at who got the preview it upgrades. The Glasswing launch partners are Amazon, Apple, Google, Microsoft, NVIDIA, Cisco, Broadcom, JPMorgan Chase, CrowdStrike, Palo Alto Networks, and the Linux Foundation.⁵ The largest technology companies on earth, two security vendors, and a bank. The model that finds the vulnerabilities went to the institutions that can afford to find them first. The model that refuses to look went to everyone else.

The safeguard is not a limit on the technology. It is a limit on who you are.

This may be a defensible safety position. It might even be the correct one. But it should be described honestly. The dangerous model was not withheld from the world. It was sorted by customer.

The Receipt That Isn't

The number doing the selling is 271. One writeup put it plainly: "the model that found 271 Firefox zero-days, now in your hands."³ Both halves of that sentence fail a fact-check.

Start with "271 zero-days." The figure is real. It is not 271 zero-days. It is 271 discrete code defects from a single evaluation pass. Mozilla's actual advisory for Firefox 150, MFSA 2026-30, lists 43 CVEs.²¹¹ The 271 findings were bundled into those 43. The headline counts defects. The advisory counts vulnerabilities. Only one of those numbers shipped as something a user needs to patch.

Most of the remainder does not clear the bar. The findings skew low: hardening, defense in depth, bugs in code paths nobody can reach. A zero-day is a live, unknown, exploitable hole. That describes very few of these.

Did the machine do something no person could? Mozilla answered without being asked twice: "We haven't seen any bugs that couldn't have been found by an elite human researcher."² The advisory's credit lines agree in plainer language: the Claude findings are attributed to seven named researchers "using Claude from Anthropic."¹¹ Not to the model, working alone. The achievement was speed. No human team finds 271 issues that fast. For scale, an earlier pass with Claude Opus 4.6 surfaced 22 bugs, 14 of them high severity.² Genuinely useful. Also a long way from the poster.

Now the second failure: "now in your hands." Fable did not find the 271. Mythos Preview did, the restricted model, running inside Project Glasswing.²⁴ The capability that found those bugs is the precise capability Fable refuses. Ask the public model to do what the headline promises, and it routes you to Opus 4.8. You are sold the output of a tool you are not allowed to hold.

The Price of Clearance

What you are allowed to hold comes with a meter, and the meter is its own document.

Fable 5 costs $10 per million input tokens and $50 per million output tokens on the API.¹ Anthropic offers two comparisons for that price, and both are accurate. It is exactly double Opus 4.8, which runs $5 and $25. It is also "less than half" the price of Mythos Preview. The second framing only makes sense once you know what Glasswing members were paying for the restricted model: $25 per million input tokens and $125 per million output.⁵

Here is the ladder, laid out. Five dollars buys last year's model. Ten dollars buys this year's model, which retreats to last year's model whenever the question gets interesting. Twenty-five dollars bought the version that does not retreat, and the money was the smaller requirement. The larger one was being Amazon, Apple, Google, Microsoft, NVIDIA, Cisco, Broadcom, JPMorgan Chase, CrowdStrike, Palo Alto Networks, or the Linux Foundation.⁵

Subscribers get a different ladder with the same shape. Fable 5 is included free on Pro, Max, Team, and Enterprise plans through June 22.¹ PCWorld reports that Anthropic will pull it from those plans on June 23, after which access requires paid usage credits.⁸ Anthropic frames the credits as a temporary measure "until capacity expands."¹ Alongside the launch, the company committed $100 million in usage credits and $4 million to open-source security projects.⁵

We have spent a year documenting the subsidy-to-meter cycle in AI tooling: give it away, build the habit, then start the meter. This launch compresses the cycle into a thirteen-day free window with a published end date. The habit-building phase has a deadline printed on it, which is at least more honest than the usual version.

Warn, Then Ship

The sequence deserves its own timeline, because the sequence is the story.

On April 7, Anthropic announced that Mythos was too dangerous for public release, restricting it to about fifty organizations. The announcement landed the same day the company reported passing OpenAI in revenue. We covered that timing in April, along with the IPO preparations underway at Goldman Sachs, JPMorgan, and Morgan Stanley.

On June 4, the Anthropic Institute published a proposal asking frontier labs to build a coordinated mechanism to slow or pause AI development. Company cofounder Jack Clark and institute head Marina Favaro warned that systems capable of designing their own successors "might increase the risks of humans losing control."⁷ The post noted that more than 80% of code merged into Anthropic's own codebase is now written by Claude.⁷

On June 9, Anthropic shipped the most powerful public model in its history, plus a safeguards-lifted version for the government.¹⁶

The pause was proposed on a Thursday. The ship date was the following Tuesday.

A warning that costs its issuer nothing functions as marketing, a pattern we documented across the industry's missed predictions and in the original Mythos announcement. This one cost less than nothing. The warning generated a news cycle about how dangerous the product is, and the product went on sale before the news cycle ended. "Too dangerous" stopped being a reason to withhold the model and became the model's tagline.

None of this requires believing the danger is fake. The capability gains appear real, the vulnerability findings are real, and a serious safety case for tiered access can be made. The trouble is that the tiers happen to align perfectly with revenue: a free window to build demand, a metered tier for the public, a premium tier for institutions, and the full capability reserved for partners with the deepest pockets in the world. Anthropic built a remarkable thing, then sorted the world into people who can be trusted with it and people who can be billed for it. The warning came first, and the invoice followed within five days. Whatever the safety case for that sequence, it is also a business model, and it deserves to be read as one.