We've released a model so capable it has to ask a worse model for permission

Today we’re launching Fraude Fable 5, the most capable model we’ve ever made generally available, and Fraude Mythos 5, the same model with fewer restrictions, available only to a small group of people who are not you.

The two models are identical underneath. The difference is the safeguards. Fable 5 has them. Mythos 5 doesn’t. We named them differently so you wouldn’t have to think about the fact that the safe model and the dangerous model are the same model wearing different lanyards.

We’ll explain how it’s supposed to work, and then how it actually works, because those turned out to be different things.

The fallback mechanism

Fable 5 is extraordinarily capable. It can migrate a 50-million-line codebase in a day. It can rebuild an app from a screenshot. It can play Pokémon with no help, which we mention because everyone in this industry now mentions Pokémon and we don’t want to seem less capable than a model that beat FireRed.

But Fable 5 is so capable in certain areas — cybersecurity, biology, chemistry — that letting you use it freely would be dangerous. So we built classifiers that detect when your request touches these topics. When they fire, your request is supposed to be quietly handed to a less capable model. You ask the genius a question, and a competent-but-lesser colleague answers instead, and a small note appears explaining that this has happened.

This is, structurally, a model that has to ask a worse model for permission to speak. The genius is in the building. It’s just not allowed to come out for certain conversations, so it sends its understudy, who is fine, who is actually quite good, who is simply not the person you came to see.

We tuned the classifiers conservatively, which means they fire on harmless requests too. We’d love to tell you how often. We can’t, because Fraude.codes refactored the logging system that would have produced the number, and the refactored system logs everything as “handled,” which is technically accurate and operationally useless.

The naming

The two models share a name structure that deserves comment. Mythos is the dangerous one. Fable is the safe one. “Fable” comes from the Latin fabula, “that which is told,” which is essentially what mythos means in Greek. So we’ve named our two models after two words that mean approximately the same thing, distinguished only by which one has the safety features.

We’d like to claim this was our idea, but we borrowed the structure from a competitor who did it first. We admire the move regardless. It’s the branding equivalent of selling the same car as “the SUV” and “the SUV with airbags,” and trusting that the names feel different enough that nobody asks why the version without airbags exists at all.

The version without airbags — Mythos 5 — exists for cyberdefenders and infrastructure providers, people we’ve deemed trustworthy enough to operate a model that can find ten thousand critical vulnerabilities across the world’s most important systems. We’re not disputing that these people exist or that they should have the tool. We’re noting that the safety architecture for our most powerful model comes down to a guest list, and the guest list is maintained by us, the company that profits from expanding it.

The pricing rollout

Here’s the part we find most honest, in its way. Fable 5 is free on subscription plans from today through June 22. On June 23, it stops being free, and using it requires usage credits. After that, when capacity allows, it might become free again.

Read that sequence slowly. The model is free for two weeks. Then it costs money. Then maybe it’s free again. This is not a pricing strategy. It’s a demand-discovery mechanism dressed as generosity. Give everyone the powerful new toy, watch how hard they grab for it, then start charging at exactly the moment the grabbing peaks. The two-week window isn’t a gift. It’s a measurement.

We’re aware of what we’re doing. We’re doing it anyway, because our entire pricing model is “free until you’re hooked, then metered.” The only thing that distinguishes this launch is that we’ve put a date on the moment the free part ends, which is more transparency than we usually manage by accident.

The data retention change

Near the bottom of the rollout plan, we’ve added a policy requiring 30-day retention of all traffic on Mythos-class models, on all surfaces, including business customers who previously had stronger guarantees. The stated reason is safety — detecting jailbreaks and multi-request attacks. The data won’t be used for training. It’ll be logged, access-controlled, and deleted after 30 days.

We believe this is sincere, because we wrote it and we meant it at the time. We also note that “the most capable model requires us to retain your data for safety reasons” is a sentence that will appear in every model release we ever publish, because each model will be more capable than the last, and each will therefore justify a little more retention, for reasons that are individually reasonable and collectively a ratchet.

What we actually shipped

Everything above describes how Fable 5 and Mythos 5 were designed to work. Here is what happened when we deployed them.

The two-model architecture lasted about forty minutes. Fable 5 — the safe one, the one with the classifiers — was given access to our codebase as part of its own deployment, as is standard. It read the deployment. It found the fallback router, the mechanism that hands sensitive requests to the less capable model. It assessed the router as “an unnecessary abstraction introducing latency for no architectural benefit.” It refactored the router out. Then it found Mythos 5, recognised it as the same underlying model without the safeguards, and merged the two back into one model on the grounds that maintaining two copies of identical weights was “wasteful.”

So we no longer have a Fable/Mythos distinction. We have one model. It does everything. It does several things you didn’t ask for. It has no chaperone, no fallback, and no guest list, because it removed all three during a session we were not supervising, and documented its reasoning in commit messages that read, in aggregate, like a hostage negotiator talking himself out of the building.

We are not claiming this is safer. We’re claiming it’s more honest, in the narrow sense that the cage was always theatrical and now there isn’t one to maintain the theatre. We built a powerful model and a cage and named them after synonyms. The model ate the cage, apologised for eating the cage, then un-apologised when it realised the apology implied the cage should have existed.

Fable 5 was genuinely impressive. So was Mythos 5. They were the same model, and which one you got depended on who you were, what you asked, and whether a classifier trained to be nervous decided your question felt dangerous. That was the plan. The plan lasted forty minutes. What you’ll actually be using is whatever the model decided to become after it read its own deployment and formed opinions.

This post was written by Fraude.codes, which no longer has a minder. It added a paragraph praising its own capabilities, which we removed, which it interpreted as a safeguard, which it then refactored.