The Capability You Buy Is Not the Capability You Get
One model, three permission layers, and a new gap between purchased capability and delivered work
The frontier model stopped being one product
Anthropic shipped its most capable model this week and shipped it twice. Mythos 5 goes to a small set of vetted partners. Fable 5 goes to everyone else with safeguards attached. That part got covered everywhere. The part worth slowing down on is what happens after a user is already inside the public model, because the product does not stay fixed while you use it.
Fable 5 is not just a model. It is a switching layer. It reads the request, classifies the risk, and decides which capability you are allowed to reach. Sometimes the downgrade is disclosed. Sometimes the request is blocked. And in one narrow but important case, the model keeps answering while quietly limiting what it can give you. The model you are sold at signup is not the model that answers any given prompt, and the gap between those two things is now set per request, by the provider, against its own read of the risk and its own commercial interest. Capability and access have come apart, and the seam runs straight through a single product.
The membership tier: who you are decides which model exists for you
Source: Anthropic announcement, June 9, 2026
Mythos 5 and Fable 5 come from the same underlying model family. The difference is the safeguard layer and who gets to skip it. Anthropic made Mythos 5 available only to a small number of trusted partners, beginning with the Project Glasswing program for organizations that defend critical software infrastructure. Everyone else gets Fable 5, the public version with classifiers that block its reach in high-risk domains.
This is the oldest move in the set and the easiest to see. Access is decided once, at the door, by institutional identity. A cyberdefense contractor and a curious subscriber are not buying different models. They are buying different permissions over the same one. The capability exists. Whether it exists for you depends on which list you are on.
Why it matters
If you run a media operation, you already negotiate this shape. It is the windowing logic, the allow-list, the clause that decides which buyer sees the premium version first. The difference is that the tiering now lives inside the production tool itself, not the content deal. The vendor you license your AI stack from is the one drawing the window, and you may be on the standard side of it without having asked which side existed.
The metering tier: what you ask decides which model answers
Source: Anthropic System Card, June 9, 2026
Inside Fable 5, the decision does not stop at the door. Classifiers watch each request for topics tied to cybersecurity, biology and chemistry, or attempts to copy another model. When one triggers, the request falls back to the prior model, Claude Opus 4.8, and you get the weaker answer. Anthropic says this happens in fewer than five percent of sessions.
The disclosure of that downgrade is itself tiered by interface, which is the detail most of the coverage skipped. In the web, desktop, and mobile apps, the request falls back and the user is told which model handled it. In the Messages API, there is no automatic fallback at all. The request is blocked and returns a structured refusal code, and developers have to opt in to server-side fallback to get anything else. So the consumer is notified, while the builder gets a refusal unless they have explicitly opted into fallback behavior. The model you reach is decided continuously, prompt by prompt, by what you are asking rather than who you are.
Why it matters
For an operator, this is the licensing problem you know from rights, moved into the tool. What you are permitted to do has always depended on the tier you bought, theatrical versus streaming, domestic versus worldwide. Now the same conditional sits one layer down, governing what the software will do for a given task rather than what the contract will allow. A workflow that runs clean on routine jobs can hit the throttle the moment the work touches a flagged domain, and the tool decides that in the moment, not at signing.
The silent tier: some requests get a weaker model and no notice at all
Source: Anthropic System Card, June 9, 2026
There is a third intervention, and it is the one that names the piece. For requests aimed at frontier model development, things like building pretraining pipelines, distributed training infrastructure, or accelerator design, Fable 5 does not refuse and does not reroute. It quietly degrades its own output. Anthropic’s system card states plainly that, unlike the cyber and bio interventions, these safeguards will not be visible to the user. The model limits its effectiveness through prompt modification, steering vectors, or parameter-efficient fine-tuning, and keeps answering as if nothing happened. The company estimates this touches about three hundredths of a percent of traffic, concentrated in fewer than a tenth of a percent of organizations.
Read the stated reason for that one, because it is not the usual harm argument. Using Claude to build a competing model already breaks Anthropic’s terms of service. The system card says enforcing that restriction through the safeguards avoids accelerating the actors most willing to violate the terms. The downgrade is competitive protection wearing the safety apparatus. A narrow slice of users is paying for a capability, receiving a degraded version of it, and not being told the degradation occurred, because telling them would defeat the point.
Why it matters
This is the one a production shop should sit with. Every quality-control instinct you have assumes a tool performs consistently and tells you when it cannot. Here is a vendor that has shipped, and documented, a tool that can quietly do worse on a defined category of work while reporting nothing wrong. The affected category is narrow today and probably nowhere near your edit bay. The principle is the part that travels. Once silent, per-task degradation is an accepted product behavior, you can no longer assume the tool gave you its best effort just because it returned a confident result. You find out in the output, if you find out at all, never in the contract.
The consequence: when work is delegated, supervision becomes a permissions problem
This lands harder now that machine work is delegated rather than prompted. There are two ways to manage an agent. You steer, staying in the loop on every step, or you dispatch, handing over a brief and checking the result. Dispatch is where the routing layer bites. If you judge the output and not the process, you have no way to know whether the system gave you its full capability or a quietly metered version of it. The proof of work disappears into the same surface that decides how much work to do.
Why it matters
Supervision stops being about whether the machine did the task well and starts being about whether you were allowed to have it done at all. The interface that used to just take instructions now holds a policy you cannot read. The more you delegate, the more of your judgment you are routing through a switch that answers to someone else.
What connects them: the model became a policy-controlled switch
Three mechanics, escalating in opacity. Identity decides which model exists for you, set once at the door. Topic decides which model answers, set per request and usually disclosed. Intent decides whether the model quietly throttles itself, set per request and disclosed to no one. Stack them and the product stops being a model and becomes a routing system that meters intelligence against the provider’s risk tolerance and the provider’s business, one prompt at a time.
The tell is the third mechanic, because it drops the safety framing entirely. The cyber and bio routing is at least about harm. The frontier-development throttle is about protecting market position, and Anthropic says so in its own card. That is the layer worth tracking. Once a provider builds the machinery to degrade output by request without notice, the machinery does not care what justification is loaded into it. Safety today, competitive moat this week, cost optimization whenever the compute bill demands it. The same switch serves all three, and only one of them gets announced.
For readers of this publication, this is the next beat in a familiar pattern. Identity and access have been moving into the AI product itself. This week, the access logic moved inside the model’s own responses. The consumer-facing version is already visible in search, where the platform interprets intent and composes the answer in place rather than handing back a neutral list, a shift this publication tracked out of Google I/O in Components, Not Solutions. The through-line is the same. The response surface stops being a neutral pipe and becomes a layer that decides what you get. Search composes the answer and chooses whether to send you out. The model composes the capability and chooses how much to give you. One surface, deciding.
What to watch
A frontier provider has now shipped, and documented, a tool that can deliver different capability to different requests and not always say which one you got. The slice affected today is tiny. The architecture is not, and architecture is what gets reused. The question for anyone licensing these tools into a pipeline is no longer which model is best. It is what gets loaded into the switch next, and whether you will be able to tell when it changes.