Refusal is what fits on the request path

The most useful sentence Anthropic published this month is an administrative one. "Claude Fable 5.1 and Claude Mythos 5.1 are the same model, but with different levels of safeguards." Two names on the price list, one set of weights, and the only difference is what the surrounding policy lets a request through to. Fable, the one anybody can use, redirects "queries related to research and development in the life sciences" to Opus models. Mythos answers them, for people who have been checked.

On 17 September the checking became a programme. The Life Sciences Verification Program opened in beta to teams and institutions, in two grades. A Standard Use grant covers "the majority of biology research and development workflows", extends across a whole team, and renews once a year. A High-risk Use grant "removes all safeguards that block life sciences requests", applies "to a single research project as opposed to a full team", and must be renewed every six months. Applicants pass a review of "their research credentials, security standards, and ethical research oversight", and state what they intend to do at the resolution of a job advertisement: "high-level descriptions of the intended work, like one would share in a job listing, and not include any sensitive information or IP."

Most of the coverage read this as Anthropic easing its biology safeguards. The announcement describes something more specific, and more useful to anyone learning how these systems are defended. It is a change of venue. Anthropic is "shifting safeguards from real-time blocking, where we reject potentially harmful access at the time of each request, to offline monitoring, which allows us to more clearly identify potential misuse across patterns of behavior." The control has moved off the request path. That is what makes it better, and that is what makes it weaker, and the two are the same fact.

What a guard on the request path can see

A production guardrail is usually a pair of classifiers, one reading the request before the model answers and one reading the answer before it leaves. Anthropic's published account of the technique, from February 2025, gives the shape of the trade. Its constitutional classifiers cut jailbreak success on a targeted set from 86% to 4.4%, cost 23.7% more compute than the unguarded model, and raised the refusal rate on production traffic by 0.38%, which was not statistically significant in a sample of 5,000 conversations.

Read that last number carefully, because it is the one that gets quoted and the one that misleads. It is an average over everything the service sees: code, email, spreadsheets, homework. A classifier tuned to a global false-positive budget does not spread its mistakes evenly. It spends them on the population whose ordinary work looks like the hazard. For a lab characterising viral vectors, the refusal rate is not 0.38% of the time. It is the job.

That is not a tuning failure. It is the geometry of the problem: the guard on the request path has one message and must answer now. What a single message mostly carries is topic, and in biology the topic does not separate the classes. "How is this family of viral vectors recognised" is gene therapy, and vaccine design, and the first step of something much worse, in the same words. The LSVP announcement offers exactly that as its example of work needing a High-risk grant: "characterizing how one specific family of viral vectors is recognized". If you cannot separate intent from text, and you are unwilling to let the bad case through, the only move left inside the latency budget is to refuse the category. Which is precisely what was shipped, stated plainly a fortnight before the programme opened: "Claude Fable models will continue to block professional biology and drug development queries because of their potential dual-use risks."

Notice, too, that the guard's action was never only yes or no. Fable does not refuse life-science R&D so much as route it elsewhere, to the Opus family. A refusal is the degenerate case of a routing decision, and once the guard is a router rather than a gate, other destinations become available. One of them is a queue.

What the same guard can see a day later

Move the decision behind the answer and almost every constraint relaxes at once. The unit of judgement stops being a message and becomes an account over time: Anthropic requires 30 days of data retention on LSVP traffic to make this work. The features multiply: volume, sequence, whether the requests cohere into anything resembling a project, whether the same team is circling one pathogen from twelve directions. Compute stops mattering, because nobody is waiting. And the question being asked changes from one that text cannot answer to one that it can. Not "is this request dangerous", but "is this traffic what they said they would do".

The declaration is doing the work there. By writing down a purpose in advance, the applicant supplies the reference distribution against which their own traffic is later compared. It is a prior the customer hands you and can be held to. A grant tied to one named project and renewed every six months is a narrow prior; a team-wide grant renewed annually is a loose one, which is why the riskier grade is scoped to a single project.

The deeper reason accuracy improves is not that the classifier got smarter. It is that its mistakes got cheaper. On the request path a false positive is a blocked researcher, so the threshold must be conservative. Offline, a false positive is a review, so the threshold can sit somewhere no online system could tolerate. None of this machinery is new: Anthropic's Responsible Scaling Policy, at version 3.3 since May, has long described deployment safeguards as a defence in depth with asynchronous monitoring as a layer beneath real-time classification, on the stated logic that asynchronous work can afford computation that latency cannot. What changed in September is which layer carries the decision for one population.

And what that layer cannot do is prevent anything. By the time the pattern is legible the answers have been given. Enforcement has moved to revocation and to the renewal date, which is why the renewal periods are the most load-bearing numbers in the announcement.

The road not taken

There was another way to handle dual-use knowledge, and this is a decision against it. The alternative is to remove the capability from the weights. WMDP, the Center for AI Safety's benchmark, is 3,668 multiple-choice questions on hazardous knowledge in biosecurity, cybersecurity and chemical security, published alongside RMU, an unlearning method its repository says reduces performance on those questions while preserving general capability. Unlearning is irreversible by design. That is its appeal and its cost: there is nothing left to grant back, and the virologist loses it too, permanently, along with the adversary.

Anthropic has chosen the other branch. The knowledge stays in the model and a policy layer stands in front of it, configured per account. Two consequences follow that are worth more than the announcement. The first is that "the model refuses X" is now never a durable fact about a model; it is a statement about a configuration, and somewhere there is a form that changes it. The second is that the safety property has been moved permanently outside the weights, which is another way of saying the weights are worth more to steal than they were.

Biosecurity worked through this shape a decade before AI did. The Common Mechanism, the open-source DNA synthesis screening tool that IBBIS maintains on GitHub, runs a sequence through hidden Markov profiles of known biorisk, then protein and nucleotide searches for taxonomy, and then a third stage whose entire job is to clear flags raised by the first two when the match is a common or conserved region. An entire stage devoted to un-flagging is what a hazard-matching classifier looks like once practitioners have lived with its false positives. And sequence screening was never deployed alone; it was always paired with knowing who the customer was. The AI industry has now arrived at the same two-part answer, from the other direction.

The strongest objection

A declared purpose is cheap talk. A determined actor with a credentialed front institution writes a plausible statement of work, passes a credentials review, receives a team-wide grant, and then generates traffic that matches the declaration because they wrote the declaration. Prevention has to be defeated. Detection only has to be outlasted. Anthropic's own threat intelligence report, published on 10 September, covers activity from December 2025 through August 2026, with biological misuse among its harm areas; a nine-month reporting window is itself a description of how long this kind of thing runs before it is named in public.

That objection is right about the tail and wrong about the comparison. The alternative on offer was never prevention. It was a categorical refusal that any competent actor could route around by rewording, by splitting the task, or by using a different provider, while blocking the vaccine lab reliably every time. Trading a control that stops the wrong people for one that identifies them later is a real loss in the tail and a real gain everywhere else, and the declaration's value was never its truthfulness. It is that an inconsistency becomes detectable and a named institution is on the hook for it, which is how export control and synthesis screening have always worked.

What should be held against the programme is its missing arithmetic. The announcement contains one quantity, 30 days, and no figure for how many flagged sessions were reviewed, how quickly, or how many grants have been revoked. Offline monitoring is a promise about a queue, and a queue with no published latency is a filing cabinet. This piece argues almost entirely from one company's account of its own controls, because that is what exists; the numbers that would make it checkable do not.

For anyone studying this: stop reading a refusal as a property of a model and ask which layer produced it, for whose account. When you meet an over-refusal rate, ask which slice it was measured on, because the aggregate is always reassuring and the slice that matters is the one that resembles the hazard. And treat the two as different exercises, because they are: precision under latency on one message, consistency against a declared prior over thirty days.

Fable and Mythos are the same model. The difference between what one will tell you and what the other will is a form, a credentials check, and a date. Somewhere in a lab right now, the binding constraint on a piece of biology is not what the model knows. It is whether the grant is still current.