The classifiers Anthropic puts in front of Fable are too zealous

This post can essentially be distilled down to: yes, Fable's classifier (which is meant to downgrade cybersecurity, biology, or jailbreak attempts to Opus 4.8) is definitely overly sensitive to the point of uselessness.

e.g. a colleague asked Fable to help create an simple app to help calculate the statistics for phase II and III trials. (Ignoring that such things already exist) it passed his request down to Opus, despite only being very marginally, tangentially, somewhat related to biology.

For anyone using these models for anything remotely sensitive, keep in mind that Anthropic says [0]:

> We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our Usage Policy.

And, since those automated systems apparently have a ludicrous false-positive rate, you should assume that your inputs and outputs are being retained for 2 years even if you are doing nothing that any reasonable person would consider to be problematic.

Oh, and they'll train on that data [1]:

> We will use your chats and coding sessions (including to improve our models) if:

>You choose to allow us to use your chats and coding sessions to improve Claude, learn more here

> Your conversations are flagged for safety review (in which case we may use or analyze them to improve our ability to detect and enforce our Usage Policy, including training models for use by our Safeguards team, consistent with Anthropic’s safety mission)

It appears that the usual controls (including for businesses) to prevent Anthropic from training on your data will not apply.

[0] https://privacy.claude.com/en/articles/7996866-how-long-do-y...

[1] https://privacy.claude.com/en/articles/10023580-is-my-data-u...

Fable was refusing to patch vllm for me when trying to get mtp to work on r9700 gpus. Kept on bumping down to opus. Tried to really sanitize my prompts and everything but it seemed intrinsically prohibited from doing this sort of work. I guess it’s useful for making inane one shot games and websites, lol.

I'm a medical physicist. I literally haven't been able to get Fable to answer a question I have written -- all of my work is verboten. I have however asked Claude Code (opus 4.8) to ultracode "a Fable oracle that <deals with the high level difficult problems> in a digraphed, clean content, isolated environment with a minimally scoped working codebase. Ask the model at the start and the end to report exactly what its version string is. If it is not claude-fable-5, stop the agent and refine the prompt until this changes"

It burns through tokens like anything but apparently Claude is much better at prompting Claude than I am.

Would I pay for it? God no. I'm still smarter than I am and it just will not work on my actual problems.

I asked it a question about indoor carbon dioxide levels (wholly innocuous question), which it flagged as involving biology, therefore downgraded to Opus.

It's a pretty good strategy if they're hoping to fail as a business, I guess.

I've had good luck getting it to debug (and patch) a tricky WebRTC issue that had all the other models stumped. Sorry it didn't work on your problem, I guess?

To summarize: the classifiers Anthropic puts in front of Fable are way, way too zealous and have way too many false positives.

From my experience, the model itself is very useful when it isn't refusing any of your prompts.

the ancestry predicate at the beginning of the formal problem statement here is dominance, at least as applied to their rooted trees.

Because it is a rooted tree, only DFS intervals are required to determine ancestry.

You can detect whether a new blocking loop is going to be formed through online dominator maintenance/online cycle detection, etc, during optimization, rather than use a heuristic, if you wanted to.

Not sure it's practically faster, but that's at least the graph-theoretic answer.

In practice, outside of the suggested heuristic, I have to imagine you'd normally throw branch and bound at this, using some lazy-cut for the blocking loops (IE you can keep any of these edges but not all of them) and let it go to town.

The paper (at least, this paper) doesn't compare that to what they did, and i'd be shocked if someone hasn't tried this before, so not sure it's useful.

I'll also say you can get existing AI models to tell you the above, but you have to push them a bit most of the time step by step. Just handing them the whole overall problem, as described, and saying "what are the graph theoretical problems related to this" it sort of gets lost.

Probably because the LLM isn't doing a good job of predicting graph-theoretic words when the language is not graph theoretic, but if you translate it into a graph theoretic language piece by piece, and ask it about that, the prediction becomes better :)

I've found in my current work on a security auditing harness and benchmarks, both Fable and Opus are useless. I recently switched to using GPT for Nelson and the security benchmarks I've been doing because Opus started refusing to do the work. I guess I probably could also use GLM or DeepSeek or MiMo, and I'll probably do some experiments to see the shape of all of their guardrails in this area soon, now that I see it's more than one model that behaves this way (Gemini in Antigravity also refuses any security auditing task, even as simple as "find security bugs").

I blogged about it: https://swelljoe.com/post/why-i-had-to-switch-to-gpt/

I'm curious what the state of alignment research is. My gut says this is basically impossible. People have different moral frameworks. Each individual probably has an inconsistent moral framework. Even granting perfect consistency, applying these typically requires some knowledge of reality. And these LLM / harness combos are turing complete.

So you don't know what it should do, you may not even know what you would do, you don't necessarily know what's happening, and can't predict what will happen. How do you align that?

Seems like these overly sensitive filters are responding to this difficulty.

The honest way to say this is that Fable is not useful for bio-related work. The author is working on processing RNA sequences and similar biology tasks, and Fable's classifier has a hair trigger on those tasks.

The story here is that proprietary AI sucks and you shouldn't use it.

Bottom line: “California AI” (in Yann LeCun’s terminology) can not be relied upon. It could change at any time, and stop working for your project.

For the future of AI, we need to look elsewhere.

I am wondering about the author's allegation that there is a user filter, not just a prompt filter.

Of course it could also be the case that it is just a prompt filter, but Fable sees memories from the authors' prior sessions that cause a rejection. I wonder if the author could control for this is in some way, if Claude lets you run isolated session without memory access.

The most basic machine learning-related query gets flagged for me. For example:

  In flax nnx, what's the idiomatic way to store state on a Module. For example, if I'm handling the carry manually for an nnx.RNN.

  How do I restore one of the orbax checkpoints into NNX from this script?

It's a shame - I like Fable for writing tasks over ChatGPT and I do believe Anthropic is a more ethical outfit than OpenAI. But with the safeguards (and Fable access expiring in a few days) there's no reason to pay for draconian guardrails and harsh rate limits.

I've had mixed results with downgrading on Fable. I was able to do a complete audit of my OAuth implementation without any issue. But when I asked for an OWASP top-ten review of my code base it got through 5 of 6 tasks and tripped in the final summary, which Opus had to finish.

I had one completely random trip when I was investigating some normal code. As far as I can tell a sub-agent ended up reading a file that tripped Fable during a review, but the whole feature was nowhere near anything secure so I don't know what could have caused it.

I also got completely locked out of Fable when working on parts of a subscription system (stripe subs).

But my experience isn't as bad as some peoples. The above maybe covers 15% of my attempted use cases. For the remaining 85% it has chugged along fine, sometimes in code I assumed would trigger it. It really feels random to me when it actually flags.

I feel sorry for the author. I have asked Fable several mathematics questions and Fable’s answers were far beyond what Opus achieved.

Do we think that someone at Anthropic, OpenAI, the government... has access to SOTA models without censorship? "How do I build an effective weapon?", "How do I effectively control the masses?"...

It's very concerning that we get the nerfed models but you know that somewhere, people with a lot of resources have access to the raw, uncensored, probably more powerful models. The sprint toward AGI looks even more dangerous when you think about who will be gaining access to it first. I do believe the goal is to pull away from the rest of humanity in a near trans-humanistic state. Are we ready for that and how do we counter it?

The only way for them to release Fable is with this stuff in front. Overall, the experience is fine. It dumps me down transparently to Opus if it has a problem and does whatever it can otherwise. The fact that they were banned from offering it to people means that they have to be over-safe. This is a classic behavioral adaptation so I don't blame them. I can still find utility.

So is this the end? Are we at that point in time where ordinary people are not allowed to use more advanced models? If so this happened sooner than expected. After that point only priveleged few will access and make use of more advanced AI. Public’s access will be restricted, limited and controlled. This will only add to the power asymmetry.

Interesting, I thought that it can't be right, Fable can't refuse to answer a strictly mathematical problem — well, 5/5 attempts did switch to Opus. Amusingly, one attempt spent almost 10 minutes thinking how to prove NP-hardness only to abruptly switch.

The classifier for biology is so broad it makes me wonder what kind of stuff mythos was generating. Anthropic is known to be a bit dramatic, but they wouldn't have released something this broad unless they saw the model cross a significant threshold that scared them.

Try asking it to do a simple code review. Literally no prompt other than their own code-review skill. It triggers a safety flag almost 80-90% of the time.

I made the same observation few days ago, follow bioinformatcian here https://news.ycombinator.com/item?id=48778446

Made a similar observation few days ago! https://news.ycombinator.com/item?id=48778446

I'm a bioinformatician

I've had fable disengage on anything related even tangentially to "biology"

Even questions about like my heartrate nunbers while running seem to run into the bio weapon filter

I couldn't even get it to help me write an email, because that email was to a pentesting company!

However when it's happy to do the task, its relatively fantastic.

I asked about logging in national forest land and it triggered the safety classifier. Logging is a cybersecurity risk, I suppose.

There is a bacterial outbreak and I asked if it was possible that's what made my wife sick and it downgraded.

Yeah, ran into this. I asked it to review a server I wrote for security vulnerabilities and it was "flagged" (after spending some money, of course). Kind of bizarre, there were so many ways a person could look at this and tell it was legit: the git log (look at my git config vs the author email and notice they're the same), the fact that none of this code is on the internet (private repo), the phrasing of my request, the fact that there's a long history of me collaborating with claude on building this, etc. I know someone's going to say: "the governments fault!" Yeah, to a point, but this wouldn't be an issue if these guys weren't relentlessly doom trolling or pretending like we're in a race with china. (What race exactly? To see who can enshittify the internet the fastest?) I wouldn't say I'm particularly upset about this, because before I tried it I had already read how other models have been able to find the same class of bugs, so I was using it more out of curiosity than need, but it does reinforce that these companies can take away these tools on a whim. Also, I just can't help but think that if your PR and marketing is literally making your software illegal to use, and causing people to hate you, maybe you're not doing it right.

Fast forwarding a year, if such censorship is in our future for all new closed models, then switching to open models will be the only way out.

Worst title ever. For once I feel the HN title should NOT match the article.

It seems like Opus is a lot slower than Fable, or it’s throttled

I totally agree. I have been a Claude fanboy for a while now, but Fable woke me up, and I am currently looking for alternatives.

I don't care how capable it is, if it's going to treat me like it's babysitting a terrorist, it can eff off.

Plain and simple.

> Nonetheless, that is not want I wanted to focus my thoughts on here.

Typo second paragraph, 4th line. I think you meant "what"

I asked fable about the effects of nicotine in the body when quitting smoking and got downgraded to opus.

Fable is great. Very underrated on just personal life advice.

They're not just "too zealous", they're ludicrous.

I've had it reject looking at pages served from my local network because it "can't find it with my search tool" and had "ethical concerns about consent for access".

The People's AI Concern Front has gotten the classifier they want, and it's made Claude hilariously useless. I am waiting with bated breath for their next set of revenue numbers. (And happily hand my money to competitors instead)

I have only really used Fable as a final pass on something. A "Take a look at everything we did so far, and make sure we didn't forget something" kind of review prompt.

But it is a huge waste of money for most coding tasks. Opus is still overkill most of the time, too.

I must apologize to my devoted followers on this program, but if the author can't bother to read the giant yellow warning at the top of the screen, I can't be bothered to finish the essay!

It's almost like every release is just basically advertising.

Gee, ya think?? LOL

I goddamn hate fable for anything but vibecoding.

It's generally a major downgrade in acting like an assistant.

I don't know what's wrong but it is just bad at multi turn discourse even on a limited amount of content with no MCP or bash calls of any sort.

The thing that makes me mad is how stubbornly confident it is even whets wrong.

I have to tell it many times to actually re read the conversation as it even insists I said something else.

It's like it had a scratchpad where it has some summarized bullet points which it fills of made up content.

I'm so confused. On one side I like to connect it to honeycomb/otel logs and I can see it figures out difficult bugs in the code better than other models.

On some others I feel I'm assisting at a continuos disaster and consistent degradation since Opus 4.6, it's a tragedy.

I'm more and more the assistant to a capable, yet confidently stubborn and wrong LLM.

Terrible title. Should be "Fable's guard rails are way too sensitive", which I don't think you can really blame Anthropic for. They likely had to whack them way up so it would block whatever trivial stuff got demoed to the government.

I would expect them to dial down the sensitivity in a few months when nobody is looking.

[flagged]

I wonder how this plays into Anthropic's legal holds:

The retention schedule behind it:

Deleted conversations: removed from your chat history immediately, but kept on back-end systems for up to 30 days before permanent deletion. Flagged inputs and outputs (Usage Policy violation): retained up to 2 years. Trust-and-safety classification scores (on flagged sessions): retained up to 7 years. API logs: 7 days by default (as of September 14, 2025), extendable to 30 days via a DPA. Zero Data Retention (qualifying enterprise): inputs and outputs aren't stored after the API response returns, though safety classifier results are still retained even here.

[dead]

[flagged]

[flagged]