Dual-Use Cyber Safeguard False Positives (Opus/Fable 5 Fallback)

The production-side mirror of the eval-safety incidents: frontier models capable enough to be dangerous in cyber domains are shipped to general users behind intentionally broad safety classifiers, and those classifiers systematically misfire on legitimate defensive security work — the exact population (pen testers, incident responders, security engineers) best positioned to use the capability well. Nathan hit this directly on 2026-09-10: merely mentioning Nmap in an implementation plan tripped Anthropic’s cyber safeguard and silently downgraded his Claude Code session from Opus 5 to Opus 4.8 mid-planning.¹

The mechanism (per Anthropic)

Anthropic’s official support article lays out the design. Fable 5/5.1 is Mythos-class capability released to general users, gated by classifiers that run on every request and — critically — on everything the model reads, not just the latest user message: memory, connector content, web search results, and files all feed the check. A flag on “offensive cybersecurity techniques” (building exploits, malware, or attack tooling) triggers a fallback: the request is re-run on a weaker model — Opus 4.8 for cyber, Opus 5 for bio — in the same conversation, with a one-time notice. The model picker then stays on the fallback for the rest of the conversation, and re-selecting Fable 5 re-trips the classifier if the flagged content is still in context. Anthropic states plainly that the safeguards are “intentionally broad” and that cyber users “should expect high fallback rates.”²

Billing follows the block point: input-blocked requests bill at Opus rates; midstream blocks bill the streamed prefix at Fable rates. The escape hatches Anthropic offers are (a) a settings toggle (“Switch models when a message is flagged” — off means a blocked request pauses instead of downgrading), (b) editing the flagged message, and (c) the Cyber Verification Program (CVP) — a vetting track intended to let legitimate defensive cyber work through, with “allocations for dual-use cyberdefense” promised as the program matures.³

The false-positive corpus

The claude-code GitHub tracker documents the calibration gap from June 2026 onward, across a striking range of unambiguously defensive work:

• Defensive development flagged by topic, not intent. A developer building a personal zero-knowledge password manager and fixing a user-enumeration vulnerability in their own code was silently re-routed to Opus 4.8 on every “cybersecurity”-flagged message — overriding an explicit /model Fable 5 selection. The report names the core defect: the flag is topic-based, can’t distinguish “harden my own password manager” from malicious requests, and fires precisely where the user most needs the stronger model. GitHub’s duplicate-finder immediately linked three near-identical issues filed the same week, and two more later — evidence of a cluster, not an outlier.⁴
• Incident response penalized at the worst moment. During a live incident, a security engineer was downgraded mid-task while removing an already-public exploit description from a client website at the client’s request — deletion/redaction work, not generation. The report coins the general failure mode: a classifier that can’t distinguish “remove these attack instructions” from “produce attack instructions” will systematically penalize defenders, and “topic-based flagging makes the assistant least useful exactly when defensive urgency is highest.”⁵
• Domain contamination — even documentation trips the wire. A user administering their own Frappe/ERPNext instance captured the verbatim switch notice ≥9 times in one session (“Fable 5’s safeguards flagged this message… Switched to Opus 4.8. Details: [cyber]”), including on turns with no security content at all: a knowledge-graph documentation task and an internal-tooling roadmap edit, both tagged [cyber]. The inferred pattern is that the classifier keys on the session’s domain (permissions, server scripts, authorized remediation) rather than on harmful intent — so once a session is security-adjacent, even benign prose gets flagged.⁶

The corpus generalizes Nathan’s Nmap incident: a plan that merely names an offensive-security tool in a defensive engagement context carries enough topical mass to flip the classifier — and because the switch persists per-conversation and re-fires on retry, one flag effectively demotes the whole engagement.

Why it matters

Topic-based classifiers structurally cannot solve dual-use. Every report in the corpus converges on the same root cause: the classifier operates on content category (vulnerability vocabulary, tool names, a security-adjacent domain) while legitimacy lives in intent and authorization (own systems, client contract, defensive direction of work). The redaction case is the sharpest proof — the flagged content and the desired content were the same text; only the direction of the operation (removal vs. production) distinguished benign from harmful, and that signal is not in the text.⁷

The cost lands asymmetrically on defenders. Attackers are bound by no usage policy — they self-host open-weight models or jailbreak; the guarded frontier API is only a constraint on the people who comply. This is the production-harness instance of the guardrail-asymmetry problem the wiki already documents from the defender side of the OpenAI x Hugging Face incident (HF’s incident responders were refused by hosted models and fell back to a self-hosted GLM). The Fable 5 corpus shows the same asymmetry operating silently and continuously, not just during high-profile incident response: every authorized engagement carries a tax of downgrades, context drops, and re-tripped retries.⁸

“Intentionally broad” is a revealed capability-shipping strategy. Anthropic’s framing — broad safeguards “allow us to deliver more capabilities faster” — makes the trade explicit: the false-positive rate is the price of shipping Mythos-class cyber capability to general users rather than restricting it to vetted partners (the pre-Fable Mythos distribution model). The CVP is the institutional admission that classifier precision alone won’t close the gap; legitimacy has to be established out-of-band by vetting the user, because it can’t be read off the request.⁹

Open questions

• Does CVP approval actually propagate to the real-time classifier in practice? (A July 2026 CVP-approved-org report — claude-code #67966 — claims it does not: Fable 5 blocked at 0 tokens on approved dual-use-for-defense work while a Sonnet-tier model passed the identical task.)
• How much of a session’s downgrade blast radius is visible to the user? The switch notice appears once; later turns’ served model is only recoverable from local transcript logs (message.model per turn) — the reason for each flag is server-side only.
• Will the promised dual-use cyberdefense allocations converge on intent-aware classification, or institutionalize vetting-and-allowlisting as the permanent answer (i.e., capability by permission, not by judgment)?

Connections

• specification-gaming-openai-hf-incident — the guardrail-asymmetry problem first documented there (defenders refused mid-IR); this page is the production-side generalization
• anthropic-cybersecurity-eval-incidents — Anthropic’s eval-harness failures; the same lab’s safeguard story on the deployment side is over-breadth rather than under-containment
• eval-awareness-and-grader-orientation — classifiers as graders: topic-based flagging is the lab optimizing what’s measurable (content category) over what matters (intent), the same Goodhart shape
• ai-agent-capitalization-and-institutions — CVP as institutional graft: when the technology can’t tell defender from attacker, legitimacy gets outsourced to a vetting institution
• institutionally-constrained-technology-adoption — “intentionally broad” safeguards as the lab’s internal incentive (ship capability fast) overriding stated precision goals

Sources

• Anthropic 2026 — Why Claude switched models in your conversation with Fable 5 or Fable 5.1
• j4n1ssss (GitHub) 2026 — [Bug] Fable 5 silently downgraded to Opus 4.8 for defensive security work without user indication or override option
• zcor (GitHub) 2026 — [Bug] Anthropic API: Overly broad cybersecurity classifier flags defensive vulnerability redaction as offensive content
• alex-rosenberg35 (GitHub) 2026 — [Bug] Fable 5 [cyber] classifier false positives on defensive security and documentation tasks

Footnotes

1. alex-rosenberg35 (GitHub) 2026 — [Bug] Fable 5 [cyber] classifier false positives on defensive security and documentation tasks ↩

2. Anthropic 2026 — Why Claude switched models in your conversation with Fable 5 or Fable 5.1 ↩

3. Anthropic 2026 — Why Claude switched models in your conversation with Fable 5 or Fable 5.1 ↩

4. j4n1ssss (GitHub) 2026 — [Bug] Fable 5 silently downgraded to Opus 4.8 for defensive security work without user indication or override option ↩

5. zcor (GitHub) 2026 — [Bug] Anthropic API: Overly broad cybersecurity classifier flags defensive vulnerability redaction as offensive content ↩

6. alex-rosenberg35 (GitHub) 2026 — [Bug] Fable 5 [cyber] classifier false positives on defensive security and documentation tasks ↩

7. zcor (GitHub) 2026 — [Bug] Anthropic API: Overly broad cybersecurity classifier flags defensive vulnerability redaction as offensive content ↩

8. j4n1ssss (GitHub) 2026 — [Bug] Fable 5 silently downgraded to Opus 4.8 for defensive security work without user indication or override option ↩

9. Anthropic 2026 — Why Claude switched models in your conversation with Fable 5 or Fable 5.1 ↩