Naderu Weekly · Episode 02

The same weights, twice

Anthropic ships one frontier model in two copies. They have the same capabilities, the same 1M-token window and the same price. One of them carries safety classifiers that can decline your request; the other does not, and is available only to a named list. This is what that costs an ordinary engineering team — and what to do about it before it costs you a Tuesday.

First, two numbers we got wrong

Last week's report described OpenAI's long-context pricing tier as costing twice the standard rate. That is right on input and wrong on output: the pricing page shows 2× input and 1.5× output. GPT-5.6 Terra's long tier is $4.00 in and $18.00 out, not $24.00. If you sized a long-prompt budget off our number, you over-estimated the output side by a third.

The second one is worse. We published a 272K-token threshold as the point where that tier begins. That figure is not on OpenAI's page. The page lists two tiers for the GPT-5.6 models and does not state what triggers them. Getting a multiplier wrong is arithmetic; publishing a threshold that is not written anywhere is inventing a fact, which is the one thing the model board exists not to do. Both are corrected, and both are named in this week's changelog rather than quietly edited away.

Five things that moved

Where a row says second-hand, we could not find the claim on the vendor's own page this week. It is still reported here, but labelled — and said out loud in the episode. Qwen3.8-Max is not on the board for exactly that reason: it is absent from Alibaba's own pricing page and the weights are not out, so there is neither a rate nor a licence we can stand behind.

Twenty cents changes the argument

The number worth sitting with is Luna's new input rate. At $0.20 per 1M it is priced inside the range you would self-host for — Mistral Small 4, an open-weight model you can run on your own hardware, is $0.15. A frontier lab has put its small model in open-weight territory on input, though it is still roughly double on output.

If you have a routing rule that sends bulk classification or extraction away from OpenAI purely on cost, that rule was written against a different world. Re-derive it on your own volumes. This is the kind of change that does not break anything and quietly makes a decision wrong.

One model, shipped twice

Now the thing worth taking apart. Anthropic's own documentation is unusually direct about it: Claude Fable 5 and Claude Mythos 5 share the same capabilities, the same specs and the same price — $10 per 1M input, $50 output, a 1M-token context window and up to 128K output tokens.

The difference is one sentence. Fable 5 includes safety classifiers that can decline certain requests. Mythos 5 does not include these classifiers. Fable 5 is generally available. Mythos 5 is not available at all unless you are on a list.

A refusal is a 200, not an error

This is where teams lose a day, so it is worth being precise. When Fable 5 declines a request, the Messages API returns a successful HTTP 200 response carrying stop_reason: "refusal" and the identity of the classifier that fired. It is not a 4xx. It is not an exception. Nothing in the transport layer indicates a problem.

Which means a client that checks the status code and moves on reads a refusal as a successful, empty answer. Downstream, that looks exactly like the model switching itself off mid-task — a feature that worked yesterday silently producing nothing today, with no error to grep for. It did not switch off. It answered that it would not, in a shape your code was not listening for.

The classifiers are tuned around security capability, which is the part teams find hardest to accept, because a great deal of ordinary engineering has security vocabulary all over it — fixing an authentication bug, hardening a parser, reviewing a dependency for a known vulnerability. The refusal is not a judgement about you. It is a classifier boundary, and it does not know the difference between your bug-fix and something else.

How it got here

The sequence is on the record, and it explains the tuning even if it does not make it comfortable.

• 7 April — Anthropic announces Project Glasswing, on the stated premise that AI models “have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” The aim is to get that capability to defenders first.
• 9 June — Fable 5 ships generally available; Mythos 5 ships in limited availability to approved Glasswing customers.
• 12 June — both are suspended entirely. The US government applied export controls requiring restrictions on foreign-national access, and Anthropic's statement says it had no reliable way to verify nationality in real time — so it cut off everyone rather than some.
• 1 July — the controls are lifted and access is restored, with safeguards tightened in the interim in response to a reported jailbreak concerning vulnerability identification.

So the classifiers were hardened specifically around finding vulnerabilities — the same capability the programme was created to deliver. That is not incoherent. It is the actual shape of the problem: the thing worth having and the thing worth fearing are one capability, and you cannot ship one without the other. Anthropic did not try to. It shipped the model twice.

Access is a list, not a price

Glasswing's eleven founding partners are Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks, with extended access described for over forty further organisations maintaining critical infrastructure. There is no self-serve sign-up for Mythos 5: you contact an Anthropic, AWS or Google Cloud account team.

That is the part worth stating plainly, without heat. The unclassified copy of the model is not withheld because it costs more — it is the same $10 / $50. It is allocated. For everyone else the documentation's advice is explicit: use Fable 5, which offers the same capabilities, with the classifiers.

The parts they got right

Credit where it is due, because the commercial handling is careful. You are not billed for a request refused before any output is generated. Three retry routes are documented: a server-side fallbacks parameter (in beta), SDK middleware for client-side retry, or your own. And fallback credit refunds the prompt-cache cost of switching models, so a retry does not make you pay twice to rebuild a cache.

The money, in other words, is handled properly. What is not handled — and cannot be — is predictability. You cannot determine in advance which request will trip a classifier, so you cannot plan around it. You can only catch it.

The quieter clause

One more thing that will matter to some readers more than the refusals do. Both Fable 5 and Mythos 5 are designated Covered Models: they carry 30-day data retention and are not available under zero data retention.

If ZDR is load-bearing in a compliance story you have already told a customer or a regulator, the most capable model in this family sits outside it. That is a sentence to check before you promise something, not after.

Custody of the behaviour

Refusals are the visible edge of something larger. On these models the raw chain of thought is never returned — you get a summary or an empty thinking block. Thinking cannot be disabled. The classifiers cannot be disabled. You can set the effort, and you can see which classifier declined you, which is more than most vendors offer. But the behaviour of the thing you are renting is not yours, and there is no setting that makes it yours.

Episode 01 ended by asking which custody you were actually buying: custody of the weights, custody of the behaviour, or neither. This week is what the third answer costs — not as an argument about openness, but as a Tuesday afternoon where a job stops and nobody on the team can turn it back on.

That is the honest case for open weights, and it is narrower than the usual one. Not that they are better, or more virtuous, or cheaper. A model whose weights you hold gives you a refusal you own: you can inspect why it fired and you can decide it was wrong. That is the whole difference, and for most teams it is worth less than it sounds — right up until the week it is worth everything.

Three things to take away

1. Assert on stop_reason, not the status code. Do this before your next deploy. A refusal is a 200, and any client that only checks the transport layer is already silently mishandling one.
2. Put a refusing fixture in your test suite. The refusal path should be exercised on purpose, in CI, rather than discovered in production by a customer.
3. Keep a second model behind a feature flag. This is the same advice everyone already accepts about rate limits. A refusal is just another way the request does not come back.

Owed from last week

We said we would measure what Anthropic's newer tokenizer — roughly 30% more tokens for the same text — does to a real bill, rather than estimating it. We did not get it done this week. It needs a real workload run against both tokenizers, and an estimate is precisely what we said we would not publish. So it waits rather than arriving half-measured. Next week.

Sources

Every figure above, in the order it appears. first-party means the vendor's own page; second-hand means we could not find it there this week and are relying on a report.