Anthropic released Claude Fable 5 yesterday and called it the most powerful generally available model ever shipped. The benchmarks back the headline. The press did its job. By lunchtime my timeline was wall-to-wall screenshots of one-shotted apps and "it's a beast."
I spent a day with it. I came away underwhelmed, and not because the model is weak.
I came away underwhelmed because the most powerful model on earth refused to do the one job I actually had for it, and it did the second job only slightly better than the thing I already pay for.
Let me explain what happened, then what's actually going on.
The case for Fable is real
I'm not going to pretend the capability isn't there. It is.
Fable 5 is the public, "safe for general use" cut of Anthropic's Mythos class, the tier that now sits above Opus. Same underlying model as Mythos 5, which stays locked behind a restricted programme called Project Glasswing. The API id is claude-fable-5. It carries a 1M-token context window and up to 128k tokens of output, and it holds focus across that window in a way Opus 4.8 visibly does not.
The numbers are genuinely strong. On SWE-bench Pro it lands 80.3%, against 58.6% for GPT-5.5. On Terminal-Bench 2.1 it hits 88.0%, ahead of Opus 4.8 at 82.7%, GPT-5.5 at 83.4%, and Gemini 3.1 Pro at 70.7%. Stripe says it ran a 50-million-line migration in a day against a two-month estimate. Simon Willison threw hard problems at it and called it a beast. He isn't wrong.
It's also more token-efficient. Some people are reporting the same result in roughly half the tokens, which matters when we get to the bill.
So: real model, real gains. Credit where it's due. I wanted to use it for two things. Here's where it fell over.
The job it refused
I've been writing code since the '80s, and these days a lot of my work is auditing other people's codebases. Sometimes that means the security side: reasoning about exploitation paths, walking through offensive tooling, the kind of audit where the model's depth is the whole point. So that's the first thing I reached for Fable 5 to do.
It wouldn't.
Not with a refusal. A yellow banner appeared: Fable's safety measures had flagged the message for cybersecurity topics, and it had switched to Opus 4.8. To Anthropic's credit, the banner says so out loud, and even concedes, in writing, that these measures "may flag safe, normal content as well." You can change the behaviour in /config.
So it told me. Then it downgraded me anyway, on a legitimate audit it admits it shouldn't have flagged.
This is the part of the launch that didn't make the headline. Fable 5 ships with a classifier that watches for high-risk domains, offensive cybersecurity and exploitation, most biology and chemistry, anything that looks like a distillation attempt, and when it fires, your prompt is answered by the weaker model instead. Anthropic says this happens in fewer than 5% of sessions. At least 95% of Fable traffic, they say, runs entirely on Fable.
That number is technically reassuring and practically useless. The 5% isn't spread evenly across the population. It's concentrated in exactly the workloads that working professionals run. Within hours of release, screenshots were circulating of routine cryptography and openssl-shaped questions tripping the cyber classifier. The community's working theory is the obvious one: the deferral rate for casual users is near zero, and for people doing actual security work it's most of the session.
This is the flagship, the one everyone's calling a beast. On the one task where its depth was the entire reason to use it, I got handed the model I already had. If you want to know how good Opus 4.8 still is, I wrote about that. It's a good model. It just isn't the one I came for. A banner telling me I've been downgraded doesn't un-downgrade me, and "we may flag safe content" is not a feature, it's a confession.
The hand you can't see
Here's the part the banner doesn't cover.
The model switch is visible. Good. But the safeguards aren't only a switch to a different model. They also include prompt modification and steering vectors: interventions applied to your request, inside the model, that you don't see and don't get a banner for. The prompt you wrote isn't always the prompt the model answers, and nothing flags when that happens. The loud intervention gets a notice. The quiet ones don't.
Nathan Lambert put the principle better than I will. An AI that gets less intelligent automatically, without telling you, is by definition misaligned. Anthropic gets the model switch right by that test: it tells you. It's the un-notified layer underneath, the steering you can't see and can't turn off in /config, that breaks the contract.
And here's the timing that makes it hard to read as pure safety. Anthropic shipped this days after publicly warning that AI is advancing too fast and may soon start improving itself. Then they released their most powerful public model anyway, with the most aggressive interventions on the domains where a competitor might catch up. Lambert's read, and mine, is that this is a mix of reasonable transparent safety on bio and cyber, and quietly rolled-out market entrenchment on everything that looks like frontier research. The bio block I can defend. The invisible nerf I cannot.
If you've read the arms race for your trust, this is the same move with a bigger engine.
The job it didn't refuse
The second thing I wanted was a logic audit. No cyber, no bio, nothing the classifier cares about. Just point the smartest public model at a real codebase and ask it to find what's broken.
This is where the model runs at full power. No routing, no limiter. The honest frontier experience.
It found one edge case.
It was a real edge case, to be fair. A genuine bug I'd have been glad to catch in review. But one, on a full-power pass, from the model that scores 80.3% on SWE-bench Pro and migrates fifty million lines in a day. Opus 4.8 finds that class of thing too. The benchmark gap between the two models did not show up as a gap on my desk.
That's the quieter disappointment, and the one the limiter discourse is drowning out. Even when Fable 5 is allowed to run flat out, the headline number and the desk result are not the same thing. I've made this argument before about benchmarks, and Fable 5 is the most expensive proof of it yet. The parrot got a bigger vocabulary. It still doesn't know which of your bugs matters.
The bill, and the cliff
About that expense.
Fable 5 is $10 per million input tokens and $50 per million output. That's roughly double the price of Opus, and Anthropic is open that it's the most expensive major model going. Yes, it's more token-efficient than past Claude models. But serious sessions still chew through 500k to a million tokens, and it's a premium rate for a premium model that, on my two real tasks, gave me one model I already own and one edge case.
And the meter is about to switch on. Fable is bundled into the paid plans until 22 June. After the 23rd it comes out of usage credits. So the window where everyone is calling it a beast is also the window where nobody's paying per token for it. That tends to change the reviews. I've watched that meter come on before.
What I'd actually tell you
If you do casual work, prototyping, document analysis, long-context research, the limiter will never fire and the model is the best you can buy. Genuinely. Use it.
If you do security, cryptography, anything the cyber classifier squints at, assume you're talking to Opus 4.8 most of the time and price your work accordingly. Watch for the yellow banner. It'll tell you when the engine got swapped for a smaller one, which is more honest than most of this industry manages. It just won't make Opus into Fable.
So keep your hand on the wheel. It tells you when it swaps the engine. It doesn't tell you when it quietly reaches over and adjusts the steering.
The discourse settled on the right metaphor within hours: a Ferrari with a 30mph limiter. The bit everyone's too excited to say out loud is that the limiter isn't on the car. It's on the roads you actually drive.