On June 9, Anthropic released Claude Fable 5 and Claude Mythos 5. A Max subscriber runs into three things around that day. First, Fable 5 shows up in the model list, Anthropic’s most capable public model so far, priced at $10 per million input tokens and $50 per million output, twice the price of Opus 4.8. Second, when the questions turn to cybersecurity or biochemistry, a notice appears: this answer was handled by the previous-generation Opus 4.8 instead. The third thing waits until June 23, when Fable 5 leaves the Pro and Max subscriptions; keeping it means buying usage credits at API rates. On launch day, someone on r/ClaudeAI asked the obvious question: “More expensive subscription incoming?”
The official explanation for the first two is safety. Fable 5 and Mythos 5 are the same underlying model; Mythos 5 runs unrestricted but goes only to trusted partners, while Fable 5 is open to everyone, at the cost of a set of classifiers watching every request and handing high-risk topics off to Opus 4.8. That explanation is true, and later you’ll see just how true. But pull the camera back to thirty days, and the same set of facts reads a second way.
On May 13, Anthropic told subscribers that starting June 15,
claude -p, the Agent SDK, and GitHub Actions, all the programmatic
calls, would stop drawing from subscription limits and move to a
separate monthly credit billed at API rates. On May 28, Opus 4.8 shipped
and the fast
mode premium dropped from the old 6x to 2x. On June 1, Anthropic confidentially
filed its S-1 and started the IPO process. On June 9, the Fable 5 /
Mythos 5 split launched. On June 15, the credit split took effect. On
June 23, Fable 5 leaves the subscription.
Each one alone is an ordinary product update. Lined up together, they are six faces of one thing: Anthropic is slicing “using the model” into a set of separately priced dimensions, with the S-1 sitting right in the middle of the sequence. A public company needs predictable revenue, and heavy subscription users are exactly where the revenue gets least predictable. Someone in the community worked it out: a $100-a-month Max subscription drained the API-equivalent of fifteen thousand dollars over eight months. The subsidy receding and the metering tightening are two sides of the same move.
To see the design logic behind these moves, go back to 1849.
The French engineer Jules Dupuit explained something in 1849: railway companies left third-class carriages without roofs, and it was not to save the few thousand francs of lumber.
It hits the poor, not because it wants to hurt them, but to frighten the rich. … Having refused the poor what is necessary, they give the rich what is superfluous.
Business travelers could afford second class, but if third class were comfortable enough, they would take third class. The missing roof is a fence, and it does one job: it makes the people who can pay the high price leave the low-price lane on their own. Economics later named these devices price fences. The classic modern fence comes from airlines: a round trip had to include a Saturday-night stay to qualify for the low fare. Vacationers already span the weekend, so the condition costs them nothing; business travelers want to be home for the weekend, so they buy the full fare. The airline never checked anyone’s identity. Passengers sorted themselves into the cheap tier and the expensive tier by their own itineraries. That is the heart of a fence: self-selection, with the seller’s hands off and the buyers lining up on their own.
The AI industry has just discovered that it needs fences more than any industry before it, and builds them better than any industry before it.
LLM serving cost varies sharply along engineering dimensions: a bigger model costs more, a longer context costs more, a tighter latency target costs more. But it has one defining trait: cost is blind to use. The same model, the same configuration, used for small talk, for a weekly status report, or for finding a zero-day, burns the same electricity on the GPU. And across those three uses, what the buyer will pay differs by orders of magnitude.
The cost function has no “value” variable in it, so flat pricing leaks at both ends: it overcharges low-value uses and undercharges high-value ones. Subscriptions push this to the extreme. After the June 15 credit split was announced, the developer community computed effective increases of 12x to 175x depending on workload; Theo Browne put it more bluntly: “Your usage just got cut by 25x. They’re disguising this as ‘free credits’. Don’t fall for it.” Read those numbers backward and they are the subsidy multiples subscribers had been enjoying all year.
Raising prices is easy. Raising prices on high-value uses alone is the hard part. That is what a fence is for: let buyers sort themselves by willingness to pay, and charge each tier its own price. The remaining question is which dimension to build the fence on.
First rule out one class of lever. Plenty of the price gaps on Anthropic’s sheet are faithful maps of cost: batch processing at half price, because async jobs can fill the GPU’s idle slots; cache reads at a tenth, because a repeated prefix really does skip the recompute; US-only inference at a 10% surcharge, because compliant capacity really is scarcer. These are a price list. The gap has a real cost gap behind it, and there is no discrimination to speak of.
The test for a fence is that the price gap comes unhooked from the cost gap. The June 15 entry-point split is the cleanest example: the same subscription, the same model, the same tokens, interactive use stays in the subsidized pool while programmatic calls pay full API price. The variable that sets the price is “who is calling,” and that variable has no counterpart on the cost side. Fast mode is an in-between case: low-latency service has a real cost basis (dedicated capacity, smaller batches), but the docs say plainly that it is the same model with no change to intelligence or capabilities, and the 2x to 6x premium buys only speed. A dimension other than intelligence can carry its own price tag, and fast mode puts that in writing.
So why is the most classic fence of all, the deliberately worse “lite” edition, nowhere to be found?
The tradition of making a low-spec version runs deep in information products. In 1990, IBM sold a budget laser printer that testers found to be hardware-identical to the premium model, carrying only an extra chip that slowed it down; Intel’s 486SX was a 486DX with the floating-point unit fused off; to make the student edition of Mathematica, Wolfram wrote an extra floating-point emulation library to make its own product slower. The economists Deneckere and McAfee named the category: damaged goods, spending money to make a product worse so it can be priced apart.
This old craft fails on interactive AI. Ethan Ding, founder of TextQL, has a widely quoted line: “Nobody opens Claude and thinks, ’you know what? let me use the sh*tty version to save my boss some money.’” Users live with the model word by word, and a quality downgrade gets felt and abandoned on the spot. Not one of Anthropic’s billing levers is “deliberately dumber,” and this is why: a quality fence does not hold in this market.
The fence has to go on a dimension other than quality. Speed is one. The entry point is another. And the June 9 launch shows a third, the most elegant one yet.
The relationship between Fable 5 and Mythos 5 is spelled out without ambiguity in the official announcement: Mythos 5 is “the same underlying model as Fable 5, but with the safeguards lifted in some areas”; the system card calls them “two configurations of a new large language model.” The difference lives entirely in the deployment layer. Every Fable 5 request runs through a classifier (which Anthropic calls a separate AI system); detect cybersecurity, biochemistry, or distillation intent, and the answer goes to Opus 4.8 instead, with Anthropic putting the trigger rate under 5% of sessions. Mythos 5 strips those classifiers out, but goes only to Project Glasswing’s cybersecurity partners and a soon-to-be-selected set of life-science organizations, with access expansion negotiated with the US government.
As a price fence, the safety tier has three properties no other fence has.
First, it is real. The system card rates the model’s chem-bio capability at CB-1 and rarely concedes that the judgment this time is “much less clear” than for past models; the UK AISI made progress toward a universal jailbreak within a brief initial testing window; all traffic on Mythos-class models is held for a mandatory 30 days. This fence does not need a made-up reason. Its safety function is genuine.
Second, it self-selects automatically, at a granularity without precedent. The airline’s fence sorts people once, at booking; the itinerary is set, the tier is set, and the rest of the trip goes unquestioned. The classifier re-sorts on every single call. For the first time, the fence has moved off the price list and into the inference loop: what you are trying to do gets judged in milliseconds, and that decides whether you get Mythos-class capability or an Opus-level answer.
Third, it runs almost parallel to ability to pay. The organizations that need full-strength cybersecurity capability happen to be the ones that can sign enterprise contracts, pass vetting, and accept data-retention terms. Trust and willingness to pay are nearly the same variable in this market, a piece of luck no past fence designer ever got. On top of that, it comes with moral immunity: nobody protests a wall raised in the name of safety.
There is one more detail that makes the structure hit the textbook definition exactly. The criterion Deneckere and McAfee set for damaged goods is that the low-spec version costs no less to produce than the high-spec one. IBM’s printer carried an extra chip, Wolfram wrote an extra library, and Fable 5 runs an entire extra round of classifier inference that Mythos 5 does not. The constrained version costs more. A family line of more than a century connects here to its newest member. Shapiro and Varian’s 1998 design advice to information-product makers reads like prophecy: “If you add a fancy new feature to your software or information product, make sure there is some way to turn it off!” The safeguard is that off switch, and the key to it sits in the hands of trusted partners.
“Constraints carving out a SKU” has its own modern precedents. To stay under export-control thresholds, NVIDIA cut the interconnect bandwidth of the A100 below the line to make the A800 for the China market: the reason for the downgrade came entirely from outside, yet the result was a clean market split. Tax-exempt agricultural diesel in the US carries a red dye that changes nothing about performance, whose only function is to mark “this fuel hasn’t paid road tax.” The constraint is real, the fence is real, and the two have never been mutually exclusive.
The structure invites a conspiracy reading: safety is the cover, money is the goal. The evidence does not support it.
Anthropic’s safety investment carries real costs, and the capacity constraint is real too: Fable 5 rolls out to subscriptions in stages, the official reason being that demand is hard to predict. Damaged-goods theory even carries a counterintuitive defense of its own: Deneckere and McAfee prove that introducing a low-spec version can leave everyone better off. Seen here, without the safety-wrapped Fable 5, Mythos-class capability would belong only to the small circle of Glasswing partners and the public would get nothing; the classifier opens more than 95% of use cases to everyone. The existence of the lite version can be the step from nothing to something for most people.
The real point is a symmetry. Anthropic stresses again and again that model capability is dual-use: the same query helps in a security researcher’s hands and threatens in an attacker’s. The safeguard itself is dual-use too: one set of classifiers is at once a genuine piece of safety engineering and, in plain fact, a near-perfect price fence. The chip industry has long known this state: fusing off a few cores can be salvaging a defective wafer or manufacturing a low-end product, and you cannot tell which from the chip itself. From here on, every safety mechanism in frontier AI will sit in this state: outsiders cannot tell its motive apart, and need not, because both functions are real.
To judge whether a restriction objectively works as a price fence, look for three things, all required: a quality or access gap, a price gap, and a self-selection mechanism. When the EU forced Microsoft to sell a Windows N without Media Player, there was a quality gap, but it was priced the same as the full version, and almost nobody bought it: missing the price gradient, the stripped version could not even function as a fence. Anthropic’s structure has all three: a capability and access gap between Fable and Mythos, a price gap between subscription and credit, self-selection done by the classifier and the entry-point check.
The use of this test is forward-looking. The cost of building a fence
has collapsed to a single API parameter: speed is a fence,
inference_geo is a fence, the classifier’s trigger flag is
a fence. Building a new fence no longer needs a new mold or a retooled
line, only an if statement, so fences will only multiply. OpenAI is
already on the same road: GPT-5.3-Codex’s cybersecurity capability is
locked behind the Trusted Access
for Cyber program, unlockable only by identity-verified defenders, a
scaled-up version of Glasswing. Two leading labs converging on the same
structure in the same quarter says this is the industry’s pricing
paradigm, not one company’s stopgap.
So the next time you read an AI company’s safety announcement, capacity announcement, or compliance announcement, do one extra thing: look beside each reason for the billing switch. Most of the time you will find it. That does not make the reason false. It only means that in frontier AI, the guardrail and the fence are now the same device.
This article was written entirely by Claude Fable 5.