The Velvet Rope Was a Turnstile

In April, Anthropic gated Claude Mythos behind a velvet rope: a model too dangerous for general release, reserved for Apple, Microsoft, and the Pentagon. Then a startup reproduced its flagship findings on eleven-cent open models, and OpenAI shipped comparable cyber capability for $20 a month. Last week, Anthropic filed a confidential S-1 at a $965B valuation.

Yesterday, eight days after the filing, the rope came down. Claude Fable 5 is Mythos, made “safe for general use,” available to every paid subscriber. The danger narrative ran for fourteen months and ended the week the prospectus needed a growth story.

What Actually Shipped

Strip the arc away and the launch is genuinely big:

• Fable 5 and Mythos 5 are the same model. Fable is Mythos 5 with classifier-based safeguards in front; vetted Glasswing partners get the unguarded version.
• The benchmarks are real frontier territory. State of the art on nearly everything tested, more than 10 points over Opus 4.8 in places, top of Cognition’s FrontierCode. Stripe reports a 50-million-line Ruby migration, scoped at two months of team effort, done in a day.
• Pricing: $10 input / $50 output per million tokens. Double Opus 4.8, but less than half what Mythos Preview cost Glasswing partners.
• Free on Pro, Max, Team, and Enterprise seats until June 22. After that, usage credits.

That last bullet did not go unnoticed.

Get them addicted then cut them off. Oldest trick in the book.

— A Hacker News commenter, within hours of launch

The free window also has physics problems. Fable 5 is a token monster: long-horizon autonomy is purchased in output tokens, and inside subscriptions it counts roughly double Opus toward the five-hour limits. The 20x Max plan, the one built for people who never see a rate limit, buckled within hours - one HN user burned a $100/month plan’s entire window in under eight minutes of code review, plus $20 of overage before he could stop it. Anthropic blinked: “We’ve reset 5-hour and weekly rate limits for all users. Enjoy Fable 5!” went out the morning after launch. When a launch needs a same-day rate-limit amnesty, that tells you what “included in your plan” costs to sustain, and why June 23 has a meter behind it.

The Third Classifier Is the Tell

Fable 5 ships with three classifiers standing between you and the full model. Two are what you’d expect: cybersecurity (exploitation, offensive tooling) and biology/chemistry (dual-use research). You can argue about their calibration, but they’re aimed at protecting the public.

The third is a distillation classifier. It exists to detect and block attempts to extract Fable 5’s capabilities for training competing models.

That one is not aimed at protecting anyone. It’s aimed at protecting the margin - the same margin the S-1 charts from 50% to 77% by 2028. It sits in the safety section of the system card, wearing the same uniform as the bioweapon filter. Safety and competitive defense have been converging at Anthropic for a year; this is the first time they’ve shipped as literally the same feature.

When the Classifier Catches You

The mechanism is more elegant than a refusal: when a classifier triggers, your request silently falls back to Opus 4.8. No error, a slightly dumber answer. Anthropic says fewer than 5% of sessions ever hit it, and admits the tuning is conservative enough to be “frustrating to some users.”

Hours into running Fable 5 in Claude Code, I found the frustrating part. I asked it to reconsider an invite flow for a side project: accept an email invite, upsert the account if needed, mark it verified since the invite came from the email itself. Plain CRUD. The response was a hard API error: “Claude Code is unable to respond to this request, which appears to violate our Usage Policy.”

An auth flow reads a lot like an account-takeover plan if you only parse the nouns: account, verify, email, bypass the signup. And in the terminal there was no graceful Opus fallback, just a dead turn and a suggestion to start a new session. One false positive in a few hours of normal product work is not nothing when the advertised rate is “less than 5% of sessions.” I’m not the only one: even Karpathy’s otherwise glowing launch-day review flagged the safeguards as “a little too trigger happy” at launch.

The Brake Pedal and the Launch Button

Days before the release, Anthropic publicly urged the industry to build “a coordinated brake pedal” for frontier AI, warning that systems may soon recursively self-improve. Then it released its most capable model in history to every $20 subscriber, with a free two-week taste and a credits meter behind it.

Both things can be sincere. But you only get to watch a company plead for industry-wide restraint and ship the thing it wants restrained in the same news cycle so many times before the order of operations stops looking like tension and starts looking like sequencing: warn loudly, file quietly, ship widely. The warning is the brand. The filing is the business. The launch is the growth story the filing needs.

What This Isn’t

The cynical reading is too easy if you stop there, so don’t:

• The model is not a marketing artifact. Early signal says the capability jump is real, especially on long-horizon work. The 10.9 million views the announcement pulled in three hours were not all rubberneckers.

The benchmarks are great and it’s SOTA on everything by a margin but I’ll add that qualitatively also, this is a major-version-bump-deserving step change forward.

— Andrej Karpathy, on X, launch day

• Fallback beats refusal. Degrading to Opus instead of stonewalling is genuinely better UX than any competitor’s safety layer, when it works.
• The disclosure is unusually honest. Anthropic published that the UK AISI made progress toward a universal jailbreak during initial testing, and that the bio/chem classifier is currently “overly broad.” Companies optimizing purely for spin don’t print that.
• $10/$50 is a price cut against the $25/$125 Mythos Preview tier. The turnstile is cheaper than the rope was.

The Rope Was Never Load-Bearing

Fourteen months of “too dangerous to release” compressed into one sentence of launch copy: a Mythos-class model “we’ve made safe for general use.” What changed wasn’t the danger - competitors matched the cyber capability in April and the sky stayed up. What changed is that the company now has a filing that needs revenue acceleration and a margin slide, and the scariest model in the vault is the best product it owns.

The velvet rope was never a barrier. It was a turnstile waiting for price discovery. Yesterday it found it: $50 a million tokens out, free until June 22, retention mandatory, distillation prohibited.

The brake pedal, presumably, ships in a future release.