Claude Fable 5 Routes Sensitive Queries to Opus 4.8 via Safety Classifiers

When Anthropic shipped Claude Fable 5 on June 9, 2026, the company included a mechanism that most users will never notice. Running alongside the model, not inside it, is a set of safety classifiers that monitor conversations in real time. When a query crosses a defined threshold in one of three sensitive domains, the conversation is silently handed off to Claude Opus 4.8, and the response that reaches the user comes from that model instead. Fable 5 never finishes answering. For the overwhelming majority of sessions, the classifier fires zero times. But for developers building applications in cybersecurity, life sciences, or AI development tooling, this routing layer is something they need to understand.

Anthropic describes the mechanism as a provisional safety architecture tied directly to its Responsible Scaling Policy evaluations. The short version: Fable 5 is capable enough in certain high-consequence domains that unrestricted access to its full output would push it past the thresholds those evaluations set. Rather than withhold the model entirely, as Anthropic did with Claude Mythos Preview, the company chose to ship Fable 5 with a capability ceiling in place for the narrowest slice of queries that pose the highest risk.

How the Routing Works

The classifiers operate as a parallel layer, not a filter applied after Fable 5 generates a response. When a session starts, the classifiers evaluate the incoming prompt against their trigger criteria. If the criteria are not met, Fable 5 handles the query normally. If they are met, the query is routed to Opus 4.8 before Fable 5 produces any output. The user receives a response, but it comes from the smaller model. Nothing in the chat interface or API response body signals that the switch occurred.

Anthropic has not specified the exact latency difference between a routed and a non-routed response, but the company confirmed that the classifier evaluation adds a minimal overhead relative to the total generation time. Throughput on the Fable 5 API, priced at $10 per million input tokens and $50 per million output tokens, is unaffected for the 95-plus percent of sessions that never trigger the classifier at all.

The Three Domains

Anthropic has named three categories of queries that can trigger the routing mechanism. Each reflects a different type of harm the company is trying to limit without removing Fable 5 from general availability.

Cybersecurity queries that involve exploitation, offensive cyber operations, or agentic hacking workflows sit in the first category. This is distinct from defensive security work. Anthropic's stated intent is that code audits, penetration testing methodology, and vulnerability triage should not trigger the classifier. The boundary, however, is not perfectly drawn. A developer asking Fable 5 to help review a piece of malicious shellcode for defensive purposes may find themselves on the wrong side of the line, depending on how the prompt is framed. Anthropic has acknowledged the imprecision and is refining the cybersecurity classifier's thresholds.

The biology and chemistry category covers pathogen enhancement, synthesis routes for controlled substances, and what Anthropic calls high-consequence dual-use queries: requests where the information is legitimately available in academic literature but whose combination and specificity in a single response would provide meaningful uplift to someone attempting to cause mass harm. Anthropic has been unusually candid about the calibration problem here. The current net is too broad. Researchers studying biosecurity policy, students working through university coursework, and professional chemists have encountered refusals or degraded responses on queries that fall well below any reasonable threat threshold. A narrowed version of the bio/chem classifier is in development.

The third trigger domain is model distillation. This covers extraction attacks: structured prompting campaigns designed to reproduce Fable 5's behavior in a third-party or competitor model by harvesting enough input-output pairs at scale. The concern is partly commercial (Fable 5 at 80.3% on SWE-Bench Pro represents a substantial lead, and that lead has economic value) and partly safety-oriented. A distilled version of Fable 5 produced without Anthropic's safety training pipeline could inherit the capability without the guardrails.

"The most capable public model will, on a slice of topics, silently hand your question to a weaker one." TechCrunch, June 9, 2026

What Developers Need to Know

For most consumer use, the routing mechanism is invisible and inconsequential. For developers building production applications on the Fable 5 API, it introduces a variable they need to account for in benchmarking and quality assurance.

Applications in specialized professional domains, particularly security tooling, bioinformatics pipelines, and AI development infrastructure, have the highest exposure. A workflow that runs a batch of technically demanding prompts may receive a mix of Fable 5 and Opus 4.8 responses without any metadata to distinguish them. Anthropic has confirmed it is not currently providing API-level signals to indicate which model generated a given response.

In practice, this means a weaker-than-expected output on a demanding prompt in one of the three trigger domains may indicate the handoff occurred rather than a regression in Fable 5's baseline performance. Teams running automated evaluation pipelines should build in a step to check whether anomalously low scores on sensitive-domain benchmarks cluster in ways consistent with Opus 4.8's capability profile. That is currently the only reliable detection method available.

The data retention policy change that accompanied the Fable 5 launch also interacts with the routing layer. Conversations that trigger the classifier and route to Opus 4.8 are subject to the same retention rules as any other session, but enterprise customers who have negotiated zero-retention agreements should confirm with Anthropic whether routed sessions are logged differently at the infrastructure level.

A Provisional Architecture

Anthropic has described the classifier configuration as provisional, and the word carries weight. The company is treating the current trigger thresholds as a first approximation, set conservatively while the underlying safety research matures. As Project Glasswing patch windows close and the bio/chem classifier is refined, the net is expected to narrow. Anthropic has committed to publishing periodic updates on classifier scope and trigger rates, though no fixed schedule has been announced.

The deeper purpose of the routing mechanism is to let Fable 5 pass the Responsible Scaling Policy evaluations without the blanket capability restrictions that held Mythos Preview out of public release entirely. By removing the highest-risk capability subset from general access at query time rather than at training time, Anthropic can ship a model that scores 80.3% on SWE-Bench Pro and remains freely available on Pro, Max, Team, and Enterprise plans through June 22, 2026, while keeping its RSP commitments intact. It is a narrow path, and the company knows it. The classifier is not a permanent answer to the question of how to deploy frontier models responsibly. It is the current answer, with the explicit acknowledgment that the question will need to be asked again when the next model is ready.