The Cage Had a Classifier

Three days ago we published a piece about the eighteen days for which the US government kept a private company's two most capable AI models switched off, gated, and then released, without ever showing the public why. We wrote that no one had produced the evidence. That is still true. But the account has now arrived, and it is Anthropic's own. It names who found the problem, what the model did, and what stands guard now that the government's order is gone. The short version: the cage did not open. It was rebuilt as a classifier, and it lives inside the request path.

The account, on the record

On June 30, the day the Commerce Department lifted its export controls, Anthropic published a writeup titled "Redeploying Claude Fable 5."¹ It says what the June 12 order never did. The trigger was a jailbreak found by Amazon researchers: a prompting technique that got Fable 5 to identify software vulnerabilities and, in one case, produce code demonstrating how a vulnerability could be exploited. That is the behavior that pulled two frontier models offline for eighteen days.

To bring the model back, Anthropic trained a new safety classifier against the specific technique in the report. Their claim: it now blocks that technique in over 99% of tries. And here is the mechanism that matters more than the percentage. When the classifier flags a request, Fable 5 does not answer it. The request is handed to Opus 4.8, the older and, by Anthropic's own product tiering, less capable model, and the user is notified of the swap.¹

Read that again as a purchasing decision. You select Fable 5. A classifier reads your request first and decides whether Fable 5 is what you get.

Credit where it is due: this one ships disclosed

In June, Anthropic shipped invisible safety interventions inside Claude Code, got caught, apologized, and made them visible. That history is why this next sentence matters: the redeployment classifier is disclosed from day one. The writeup says plainly that users will be notified when a request is blocked and rerouted. Whatever else this system is, it is not a silent one, and after the summer Anthropic has had, disclosure-by-default is a real change and worth naming as one.

The company also published, two days later, a proposed industry framework for scoring jailbreaks, with severity grades and four tiers of classifier scrutiny running from prohibited uses down to benign ones.² Amazon found the hole; Anthropic wants a shared standard for grading holes. Eighteen days of administrative cage produced, in the end, a rubric. As with the three Commerce letters we traced in the original piece, the instruments are visible now. That is genuinely better than the alternative.

You select the frontier model. A classifier reads your request and decides whether that is what you get.

The number that does not exist

Here is the trade, in Anthropic's own words. The new classifier "comes at the cost of flagging benign requests more often during routine coding and debugging tasks."¹ The framework post goes further and names the philosophy: a deliberately enlarged "safety margin," accepting "a higher rate of false positives (genuinely benign prompts being blocked)" in exchange for greater confidence about the harmful ones.²

How much more often? That number does not appear in either post. Not a percentage, not an order of magnitude, not a range. "More often" is the entire quantitative disclosure. If you are paying for Fable 5, the frequency with which you actually receive Fable 5 is not a published figure.

We want to be precise about what we are and are not saying, because a bad version of this claim is already circulating. A widely shared headline said Fable 5's debugging scores "dropped 70%" after redeployment. Trace it and you find a 12-task TypeScript benchmark in which 9 of the 12 tasks got flagged and rerouted to Opus 4.8, and the benchmark's own harness scored every rerouted task as a zero.³ That is not a measurement of anyone's debugging ability. It is a measurement of the filter, multiplied by a scoring choice. The benchmark's own authors posted a clarification saying the confusion came from Anthropic's wording and that Fable 5 remains usable for coding and debugging.⁴ Twelve tasks cannot tell you the true reroute rate, and neither can we.

That is exactly the problem. The only people who know the real number are the people who built the classifier, and they have chosen the words "more often" instead. The absence is the finding. Not that the downgrade is frequent. That you cannot find out whether it is.

The cage moved in

The original story was about instruments of control you could at least see: a letter ordering the models off, a letter gating them to approved partners, a letter switching them back on. Government power, exercised in writing, on dates you can put in a timeline. What replaced it is a company-operated filter that exercises a smaller version of the same power, continuously, one request at a time, with no letter and no timeline. The state's cage had walls you could photograph. The new one is a conditional in the serving stack.

To be fair to Anthropic, this is what de-escalation looks like in practice. The government wanted assurance the specific exploit was contained; a targeted classifier with a fallback is a far narrower instrument than an export ban, and the disclosure posture is the best it has shown all summer. If you must have a cage, this is a better one.

But it is worth saying clearly what the eighteen days actually produced. The question of the original piece was whether the founding claim justified the response, and no evidence for it was ever shown publicly. That question was never answered. Instead it was made permanent and privatized: there is now a standing mechanism that decides, on grounds you cannot audit, at a frequency you cannot look up, whether the model you chose is the model you get. The government took the cage down. Anthropic installed a smaller one where the door used to be, put a notice light on it, and declined to say how often it closes.