The Watcher at the Gate

When Ethan Mollick asked Claude Fable to build him a map, he did not expect it to hire a staff.

Mollick, a Wharton professor who writes about working with AI, had early access to Claude Fable 5, the model Anthropic released to the public on June 9. He gave it a loose instruction: build a beautiful, fully researched isochrone map, the kind that shows how far you can travel from a city in a given number of hours. Then he watched what happened. The model spun up its own helper agents to gather travel data, pulled real schedules for more than two thousand flights and the rail timetables for trains from the TGV to the Shinkansen, wrote the code, tested the code, and circled back hours later with a working, interactive thing. He nudged it twice, and it did the rest.

What unsettled him was not the quality. It was how little he had done. In his account of the experience, Mollick reached for an old word and gave it a new edge: "I no longer steer; I commission." The work had moved from process to outcome. He was no longer an operator typing commands and watching results. He was a patron, describing what he wanted and paying for the result, while the actual labor happened somewhere he could not watch, across hundreds of small decisions he never got to weigh in on.

A powerful model, with rooms you cannot enter

Claude Fable 5 and its sibling, Claude Mythos 5, are the same underlying model with two different sets of restrictions. Mythos is the unguarded version, available only to a small set of vetted partners, beginning with cyberdefenders and critical-infrastructure providers under a program Anthropic calls Project Glasswing. Fable is the version the rest of us get. According to the system card, the two share their weights; what differs is the wall built around Fable, blocking it from high-risk work in biology, chemistry, cybersecurity, and a few other domains. Who you are determines which version you get.

The walls are not only about what you ask. When Fable's classifiers detect a request that brushes against cybersecurity or bioweapons, the system quietly routes the query to a less capable model, the most recent Claude Opus, and tells you it did so. That part is at least visible because you get a weaker answer, and a note explaining why.

One set of safeguards comes with no note at all. Anthropic writes in the system card that it has added protections against using Claude to build competing frontier AI systems, and that these particular safeguards "will not be visible to the user." Instead of refusing or routing, the model's effectiveness is quietly reduced through prompt modification, steering vectors, or fine-tuning. The company estimates this affects a tiny fraction of traffic, around three hundredths of a percent, concentrated in fewer than a tenth of a percent of organizations. The number is small, but the mechanism behind it is the thing to notice: a model that has decided you are working on the wrong thing and simply becomes worse at helping you, without saying so.

To do any of this, Fable has to hold a working theory of who you are and what you are trying to accomplish. The gate is a watcher. We have built a justified watcher before, pointed it at one narrow problem, and then spent a century watching how it evolved.

The machine that was only supposed to predict one thing

Before the credit score, lending ran on the judgement of whoever held the money. A merchant decided whether you qualified based on reputation, appearance, and the reports of people who knew you, and those reports carried every prejudice the era had to offer. The first commercial credit agencies, founded in the 1840s, ran on correspondents who filed notes like "prudence in large transactions with all Jews should be used" and described one Georgia business as "a low Negro shop," according to the historian whose work Time traced in its history of the credit score. Against that backdrop, a number computed from your actual payment history was a genuine step toward fairness. The algorithm did not know your race from across a counter. It knew whether you paid your bills.

The number was supposed to have one job. The Consumer Financial Protection Bureau has been precise about it: a credit score is designed to estimate the likelihood that a borrower will fall ninety days behind on a credit obligation. That is the whole intended purpose. It's not supposed to be a measure of character, nor a forecast of job performance, nor a verdict on whether you would be a good tenant.

It became all of those things anyway. By 2022, according to the National Consumer Law Center's report on non-credit uses of credit data, 47 percent of employers used credit checks in hiring, up from 19 percent in 1996, and roughly 90 percent of landlords ran them on prospective tenants. A number built to estimate the odds of a missed payment had quietly become a gate on employment and housing.

The strangest part is that the spread never depended on the number actually working in its new settings. A legislative director for TransUnion, one of the three major bureaus, once acknowledged under questioning that the company had no research showing any statistical correlation between what was in a person's credit report and their job performance or likelihood of committing fraud. The machinery moved into hiring not because it predicted anything about employees, but because it was already there, and it was general, and once a sorting tool exists it tends to get used for sorting.

While the score was busy judging people, the apparatus underneath it became a business in its own right. The data collected to evaluate you turned into a product to be sold about you. Credit bureaus sell "trigger lists" of people who just applied for a loan, sometimes within twenty-four hours of the application. Data brokers downstream package the financially vulnerable into segments with names like "Suffering Seniors" and "Paycheck to Paycheck Consumers," marketed to whoever wants to reach them, which often means whoever wants to sell them something predatory. The CFPB documented this in its 2024 proposal to rein in the industry.

That same data exhaust turned out to be a national-security problem. In the CFPB's filing, the agency notes that foreign adversaries can buy detailed personal information on military members and government employees for pennies per person. Researchers at Duke purchased identified data on active-duty service members, including income, net worth, and credit ratings. And in 2020, the Justice Department charged four members of China's People's Liberation Army with stealing the personal data of 145 million Americans in the Equifax breach. The mechanism built to decide who deserved a loan had become a dragnet that anyone with a budget could fish in.

Then there is the part that should give any regulator pause. The Fair Credit Reporting Act of 1970 was written to bring the bureaus to heel, to give people the right to see their files and dispute errors. It did some of that, but as Time put it, the law also "ushered in credit reporting's golden age." Codifying the system made it legitimate, permanent, and politically load-bearing. The rules meant to constrain the machine instead blessed it, and a handful of private companies became the silent arbiters of who gets a mortgage, a lease, a job, with no one having voted to put them there.

Back to the gate

Fable's classifiers were built for bioweapons and zero-day exploits, which is to say for reasons no sensible person would dispute. A credit score was built to predict a missed payment, which no one disputed either. The trouble in both cases is not the original reason. It is that the classification machinery is general, and the original reason is just the first place it gets pointed.

Consider what the gate has to become to function. To decide which version of itself you are allowed to use, Fable needs a live model of who you are: whether your prompts look like bioweapon research, whether your account resembles a competing AI lab, whether your organization sits inside or outside the circle of trust. That profile, the running judgment of which tier you belong to, is one of the most valuable assets in the system. The credit story tells you exactly where such a profile tends to end up. It becomes a product, or a target, or a lever, and usually all three before anyone notices.

There is a difference in what is being rationed this time. Three companies became the gatekeepers of the American Dream, and the thing they gated was access to credit. The new gatekeepers are a handful of AI labs and a government partner or two, and the thing they are learning to ration is access to the most capable commercial intelligence ever built. The credit bureaus decided who could borrow. The next set of intermediaries are positioned to decide who gets to use the most capable tools.

None of this is unique to Anthropic. Anthropic happens to have shipped the clearest version first and written the most candid system card about it, which is to its credit. But capability routing by user is becoming the pattern of the frontier, and the next lab to release a Mythos-class model will build its own velvet rope. The pattern is what matters here, not the first company to implement the restrictions.

Who designs the rest of the gate

Anthropic's gate provides real safety measures, built against real danger, and reasonable people built it for sound reasons. So was the credit score, which genuinely was fairer than the banker it replaced. The lesson of the last hundred years is not that the gates should come down. It is that we build them for one narrow, defensible purpose and then never quite manage to take them apart, and the machinery drifts until it has quietly become the thing that decides who is allowed access to capable tools. The bioweapon gate should exist. But the rest of it gets designed by the same handful of people who built it, and the people it sorts have no seat.