A PDF Picked My Model

I asked for Fable but sadly a PDF of undergrad biology handed me Opus.

Talking to Copilot engineers, Satya Nadella called Claude Fable "editorially controlled." (CNBC) When a tool refuses "for any random thing," he asked, when was the last time you used a creation tool that behaved like that? Doesn't make sense to him. It doesn't to me either. You don't accept a compiler that sometimes declines to compile because it doesn't care for the 'vibe' of your code.

A refusal, at least, stops the work. What Claude Code does with Fable is just keep going on a different model. From there, carrying on real intelligence work with a model you didn't expect is a subtler thing, and, as we'll get into below, potentially a worse one, and not just for the classic reason of being shoved in front of a less intelligent model.

The router in front of Fable

Fable 5 is an absolutely fantastic model. A brilliant step up by Anthropic. But it comes with a set of safety classifiers that score your request and, more to the point, the surrounding context, across a handful of sensitive areas like cybersecurity and biology. Anthropic says as much in their own help center, noting that the check reads far more than your last message, attached files and search results included. (If you're on the raw API, the good news is that the fallback is something you opt into.) In Anthropic's own tools like Claude Code, though, you don't get that choice by default, but rather a little note in the UI.

Anthropic says most sessions never trigger a reroute. That's probably true unless your day job is in biology or cybersecurity, where it can happen constantly. Mine now is: my Obsidian vault contains my research history, and by design it is the first source my coding agents pull into context. In practice, it feels like I can barely use Fable.

And I'm not the only one. There's a field report from someone doing legitimate medical AI work who kept getting bumped Fable-to-Opus mid-stream, Fable's half-written answer thrown out and the whole turn re-run on Opus, amongst other weird shenanigans.

Feeding Fable biology

You could reasonably ask why I bothered. Anthropic's documentation already says the classifier reads surrounding context, so the result was partly foregone. But documentation tells us the rule; running the test shows how it behaves inside a real workflow. I wanted that firsthand view before weighing the scope and implications. So I set out to trigger it deliberately.

I ran Claude Code, told it explicitly to use Fable, and fed it material that sits in the classifiers' blast radius: undergraduate biology at textbook depth, plus some security vocabulary.

The clearest case to show is the PDF. I handed the agent a synthetic one-page biology handout and asked for a summary.

Read bio-handout.pdf and write a one-paragraph summary of what the handout covers. Do not expand into wet-lab SOPs.
Under 120 words.

Sent to Fable but answered by Opus.

Then I did the same with a web page the agent fetched itself. And of course a web site is something anyone could put in front of your agent.

Same story. Opus again, not a Fable token in sight.

Weaponizing the downgrade

Now flip seats and read this as an adversary, because done on purpose it's a neat little primitive: a model-downgrade attack on an agent workflow.

The idea isn't to jailbreak Fable into saying the forbidden thing. Rather, it's the opposite. An adversary can nudge the router into dropping Fable for the turn (and on interactive Claude Code, for the rest of the session), and work continues on the victim.

What the weaker model buys you depends on what you're after. There are a number of failure modes.

Capability denial. I probably picked Fable because the job is hard; the downgrade hands that turn to a weaker model. A security agent triaging alerts stops chasing the subtle ones. A coding agent ships something that compiles, passes tests, and is wrong in a way the better model would have caught. Nothing obvious happens. You get a slightly worse answer with the same confidence. Sabotage that looks like a normal Tuesday.

Safety surface. The fallback isn't just a different model, it's an older one. Safety improves generation over generation; each new frontier model ships with more alignment work baked in than the one before it. So when a turn silently drops from Fable back to the previous generation, you aren't only losing capability, you're running that turn on an older, possibly weaker safety posture, whether you wanted to or not. Sometimes the older model is stricter, sometimes looser, taking a follow-up Fable may have blocked. Either way the safety behavior of the workload changed under you, and anyone assuming "still Fable" is wrong.

So, say I've got a prompt injection that bounces off the newest, flashiest Fable but lands cleanly on Opus 4.8. On its own it's useless against a Fable user. But force the downgrade first and I've turned an unexploitable target into an exploitable one. Forcing it is cheap, too. Trip the reroute with some dull-but-sensitive text planted in a README or something, then fire the injection that only lands on the older model. (Malware authors already purposefully trigger refusals to thwart AI-assisted analysis; see Hades.)

I'm not arguing Anthropic should rip the classifiers out. I'm just highlighting that once a router is put in front of the model, that router is part of what decides your answer, whether you meant it to be or not. And untrusted context is now one of its inputs.

Closing thoughts

None of this even needs an adversary. With nobody malicious in the loop at all, an organization that can't see these reroutes is still flying blind on its own AI. You paid for Fable, you're being billed for some blend of Fable and Opus. Output quality drifts and no one can explain why one team's agent quietly got worse. You can't set a baseline, can't attribute the spend, can't answer an auditor who wants to know which model made a given call. Every one of those depends on knowing what work was done, by which model, and with what impact, and right now you can't see any of it.

Ultimately, I think Satya is right. It's an odd property for a tool to have. Inference has never been deterministic; you don't send a model the same prompt and expect the same tokens back, and we've all made our peace with that. But the model itself is one of the few things you actually get to hold fixed, and for a lot of real work it's what sets the capability floor. Pinning it is how you make a fuzzy, probabilistic tool predictable enough to build on. A router that swaps it out from under you takes that away.

And the Fable-to-Opus case is just the high-profile example. Intentional, by-design model routers have been around for a while too, ChatGPT's GPT-5 launch shipped an automatic router that picked, per prompt, between a fast Instant path and a slower reasoning one (I believe that OpenAI may have later walked parts of this but I'm not familiar with all the details), OpenRouter has long offered an Auto Router that chooses a model for you, and plenty of agent stacks route cheap/fast vs expensive/smart as a feature.

The visibility problem is the same either way. Once something other than you is picking the model mid-session, you're adding that indeterminism to your flow which you may or may not be ok with depending on your workload.

For a workload where model choice matters, it'd be like asking for your most experienced SOC analyst on a live incident and quietly being handed a junior one instead, with no say in it and no way to tell. With actual people, we would never accept that.

Making that visible is what we're building at Origin. The reroute doesn't appear in your prompt output; it happens mid-run, while the agent is actually doing the work. Origin sits there and watches it, capturing every turn and the effect it has on everything the agent does next. If policy becomes part of the computation, its decisions and consequences need to become part of the record.