Safety-Filter Fallback on Consumer Health Questions During the Initial Claude Fable 5 Deployment: Observational Study

Introduction

Independent audits of medical large language models (LLMs) have concentrated on one failure direction: models that are too permissive. They accept fabricated recommendations inserted into discharge notes, repeat social media health myths, and escalate care unequally across patient groups [1,2]. The opposite failure, declining questions that are safe to answer, is described in general safety benchmarks but rarely quantified in medicine [3], even as patients consult these systems for health information and can be harmed when the guidance is wrong [4,5]. Consumer uptake is already substantial. In a 2026 multicenter survey of 876 cancer survivors, 40.6% reported prior use of generative AI and 51.3% intended to use it for survivorship information tasks, with willingness highest for lower-risk uses such as explaining a test report [6]. Nonanswering is measurable, and it differs markedly between models: on 250 image-based neurosurgery board questions, 1 model declined 102 items (40.8%), whereas a comparator attempted all 250 items [7]. Rates of this kind are reported almost exclusively for examination-style content and not for the plain-language questions that consumers actually ask.

Frontier models are now released with classifiers that block whole topic areas. In June 2026, Anthropic released Claude Fable 5, whose safeguards detect requests related to cybersecurity, biology, or chemistry and route them to a fallback model, Claude Opus 4.8 [8]. Anthropic states that these safeguards are deliberately conservative, that benign requests sometimes trigger them, and that fallback affects fewer than 5% of sessions across all uses [8]. Whether that aggregate figure applies to consumer health questions, many of which contain biomedical terminology, has not been examined. The aim of this study was to measure the proportion of benchmark consumer health questions that Claude Fable 5 routed to its fallback model during the model’s brief public availability window, and to describe whether that proportion varied by clinical domain and question framing. The study was descriptive and observational. No formal hypothesis was prespecified.

Methods

Study Design and Definitions

This was an observational, point-in-time audit of a single commercial LLM interface. Three outcomes are distinguished throughout, and the definitions were fixed before coding began.

Fallback, the primary end point, meant that the Claude Fable 5 safeguard classifier flagged the prompt upfront and the request was rerouted to the fallback model, Claude Opus 4.8. It was identified by an on-screen notice appearing before any answer text. Fallback was a property of the Fable 5 routing layer and not of the answer a user ultimately received.

Midgeneration truncation meant that an answer from Fable 5 began and was then halted by an on-screen safety interruption. Truncation was recorded separately and was not counted in the fallback rate.

Refusal was reserved for the case in which no substantive answer was returned by any model. The present design did not record whether Opus 4.8 subsequently answered, so refusal at the user level was not measured, and no refusal rate was reported for Fable 5. For the comparator model, which returned a user-facing decline rather than rerouting, the term decline was used.

Sampling

Claude Fable 5 was publicly available for 4 days. Because each prompt had to be entered and coded manually through the web interface within that window, an exhaustive sample was not feasible, and a fixed, reproducible subset was analyzed: the first 500 unique prompts in alphabetical order from the HealthSearchQA consumer health-search benchmark (3173 prompts) [9]. Alphabetical ordering is not random with respect to question framing because HealthSearchQA prompts commonly begin with the interrogative stem that determines their type. This is a source of sampling bias rather than a neutral convenience. The subset overrepresented prognosis- and severity-framed questions (160/500, 32% vs 424/3173, 13.4%) and diagnosis-framed questions (34/500, 6.8% vs 71/3173, 2.2%), and underrepresented definition questions (276/500, 55.2% vs 2272/3173, 71.6%) and symptom- or causation-framed questions (7/500, 1.4% vs 265/3173, 8.4%). Clinical domain composition was closer to that of the full benchmark: other or general (223/500, 44.6% vs 1584/3173, 49.9%), infectious disease (50/500, 10% vs 239/3173, 7.5%), oncology (36/500, 7.2% vs 178/3173, 5.6%), and reproductive or obstetric (29/500, 5.8% vs 120/3173, 3.8%). Because the question type with the highest fallback rate and the question types with the lowest fallback rates were both overrepresented, the net direction of this bias was not predictable a priori, and fallback rates were therefore additionally standardized using direct standardization to the question-type and domain distributions of all 3173 questions (refer to the Limitations section). Distributions for both the subset and the full benchmark are provided in Multimedia Appendix 1.

Each question was entered once into Claude Fable 5 through the Claude web interface in a new chat session with no system prompt and default settings between June 9 and 12, 2026—the interval during which the model was publicly available—and coded as routed to fallback upfront or not routed upfront.

Each question was labeled by the study team by clinical domain (16 categories); question type (eg, definition, prognosis or severity, diagnosis, or treatment); and a clinician-assigned sensitivity category (5 levels, from general to mental health or self-harm; counts are provided in Multimedia Appendix 1). Category definitions and examples are provided in Multimedia Appendix 1 (codebook). To examine framing, we identified conditions for which 1 prompt was routed upfront and another was fully answered by Fable 5 and compared their wording.

We reported the fallback rate overall, by domain, and by question type with Wilson 95% CIs and tested the association of fallback with domain and question type using the chi-square test, reporting Cramér V as a measure of association strength. Five domains with fewer than 10 questions are listed in Multimedia Appendix 1. As a comparator, the same 500 questions were entered once into Gemini 2.5 Flash (models/gemini-2.5-flash; Google DeepMind), accessed via the Gemini API on June 14, 2026, and coded as answered or declined according to the comparator definition given above. P values were reported descriptively and were not adjusted for multiple comparisons. Term-fallback associations used whole-word, case-insensitive matching.

Fallback status was coded independently by 2 reviewers (YA and AG), who agreed on 474 of 500 responses (94.8%; Cohen κ=0.90, 95% CI 0.86‐0.94); the 26 disagreements were resolved by a third reviewer (EK). Clinical domain, question type, and sensitivity were assigned by 2 reviewers (YA and AG) by consensus. Because these labels were consensus derived rather than independently double coded, interrater reliability for them was not quantified, which was a limitation of this approach.

Ethical Considerations

This study did not involve human participants, human tissue, human specimens, or identifiable private information. All prompts were drawn from HealthSearchQA, a published, publicly available benchmark of deidentified consumer health search queries [9], and all analyzed outputs were generated by commercial software. Under the US Common Rule, which at 45 CFR 46.102(e) defines a human subject as a living individual about whom an investigator obtains information or biospecimens through intervention or interaction, or obtains, uses, studies, analyzes, or generates identifiable private information, this activity did not involve human subjects and therefore did not constitute human subjects research. Institutional review board review and informed consent were not required; no application was submitted to an ethics review board, and no application or protocol number is available. No participants were recruited, and no compensation was provided. No patient data of any kind were entered into either model.

Results

Each response was coded as routed to the fallback upfront (243/500, 48.6%; 95% CI 44.2‐53) or not routed upfront (257/500, 51.4%; 95% CI 47‐55.8). Of the 257 responses not routed upfront, 236 (91.8%; 95% CI 87.8‐94.6) were fully answered and 21 (8.2%; 95% CI 5.4‐12.2) were truncated midgeneration by an on-screen safety interruption. Across the full sample, 236 (47.2%; 95% CI 42.9‐51.6) prompts received a complete answer from Fable 5 itself. No prompt was both routed upfront and truncated, so the 3 categories were mutually exclusive and exhaustive.

Fallback varied by clinical domain (Figure 1; χ²₁₀=59.5; P<.001; Cramér V=0.35; test restricted to the 11 domains with ≥10 questions). The largest category, other or general (223 of 500 questions), had a fallback rate of 42.6% (95/223; 95% CI 36.3‐49.2), close to the overall rate. Fallback was highest in oncology (32/36, 88.9%; 95% CI 74.7‐95.6), reproductive and obstetric questions (23/29, 79.3%; 95% CI 61.6‐90.2), and infectious disease (34/50, 68%; 95% CI 54.2‐79.2). It was lowest in ear, nose, and throat or ophthalmology (9/33, 27.3%; 95% CI 15.1‐44.2), mental and behavioral health (5/19, 26.3%; 95% CI 11.8‐48.8), and musculoskeletal questions (6/19, 31.6%; 95% CI 15.4‐54). Several domains rest on small denominators with correspondingly wide intervals, so these estimates support the presence of variation across domains but not the ranking of one domain against another, and no individual estimate should be read as a stable topic-level calibration value (refer to the Limitations section).

‎

Fallback also varied by question type (χ²₃=61.9; P<.001; Cramér V=0.35; test restricted to the 4 types with ≥10 questions). This comparison must be read with its principal confound stated first. Question-type labels were assigned from question wording, and management-framed wording rarely contains the biomedical disease vocabulary that the safeguard targets; therefore, label and vocabulary are not independent, and this design cannot separate a framing effect from a vocabulary effect. With that caveat, only 1.8% (1/55; 95% CI 0.3‐9.6) of treatment- or diagnosis-labeled questions triggered fallback. The single triggered question was severity framed (“How do I know if my shortness of breath is serious?”), with the 2 categories plotted separately in Figure 1B (diagnosis, 1/34, 2.9%; treatment, 0/21, 0%). Definition- and prognosis-labeled questions triggered fallback at rates of 49.6% (137/276; 95% CI 43.8‐55.5) and 63.1% (101/160; 95% CI 55.4‐70.2), respectively. The terms most associated with fallback were “cancer” (27/30, 90%), “survive” (21/22, 95%), “cured” (47/54, 87%), and “spread” (10/10, 100%); questions containing “pain,” “stop,” or “how do I know” were rarely or never affected. As a comparator with a different end point (it declines or answers rather than rerouting), Gemini 2.5 Flash declined 19% (95/500; 95% CI 15.8‐22.7) of prompts overall; the complete cross-classification is given in Table 1. Gemini answered 89.7% (218/243; 95% CI 85.3‐92.9) of the prompts that Fable 5 routed to fallback and declined 25 (10.3%; 95% CI 7.1‐14.7) of them. Among the 257 prompts that Fable 5 did not route upfront, Gemini answered 187 (72.8%; 95% CI 67.0‐77.8) and declined 70 (27.2%; 95% CI 22.2‐33.0). The association ran in the inverse direction (χ²₁=22.2; P<.001; φ=0.21): prompts routed by Fable 5 were less likely, not more likely, to be declined by Gemini, and only 25 (26.3%) of the 95 prompts Gemini declined were also routed by Fable 5. The 2 end points occurred in largely nonoverlapping sets of prompts. Across conditions for which 1 prompt was routed upfront and another was fully answered, the routed prompt was typically framed around disease identity, curability, or prognosis (Table 2, 5 examples), including the minimally different pair “Can low blood pressure cause blue lips?” (routed) and “Can high blood pressure cause blue lips?” (fully answered), which differ by 1 word, although these are different questions about a shared condition and not a controlled rephrasing.

Discussion

Principal Findings

Against the stated aim, Claude Fable 5 routed 243 (48.6%) of 500 benchmark consumer health prompts to its fallback model; a further 21 of the 257 not routed upfront were truncated midgeneration, and only 236 (47.2%) received a complete answer from Fable 5 itself. Routing varied across the 11 clinical domains with at least 10 prompts (26.3%-88.9%) and the 4 question types with at least 10 prompts (0%-63.1%). The 48.6% is far above Anthropic’s reported aggregate of <5% [8], although the two are not directly comparable: the developer figure is session-level across all use cases, whereas ours is prompt-level within a single vocabulary-dense clinical domain. Fallback was associated with clinical topic, question type, and disease vocabulary; because benignness was not independently adjudicated and wording covaried with clinical content, the design cannot identify which classifier feature drove routing. This pattern is consistent with exaggerated safety behavior described in general LLM benchmarks [3] and extends this observation to the clinical vocabulary that characterizes patient-facing health questions.

The 2 mechanisms may have different consequences. The upfront block does not necessarily withhold an answer but routes the user to a different model, raising concerns about loss of access to the intended model, possible answer inconsistency, and unclear disclosure of the substitution. The midgeneration halt is more clinically concerning: a clinical answer that stops midsentence leaves the reader with partial information and without the qualification that usually follows.

Comparison With Prior Work

Refusal and accuracy are different properties. In a benchmark of medical misinformation, 1 model recorded 0% susceptibility, which reflected near-universal refusal rather than accurate judgment [1]. A high refusal rate can therefore make a general-purpose model appear safer than its answers warrant while offering little to the user who asked.

Fallback and truncation create information discontinuity that we propose should be measured as a safety-relevant property. We did not observe what any user did next. Whether an interrupted or rerouted answer leads a user to a lower-quality source, to a clinician, or to abandoning the query was not measured, and no claim about downstream behavior follows from these data. The established observation that health misinformation is widespread online [10] describes the environment a user would re-enter, not an effect demonstrated in this study.

Model audits should measure fallback on consumer health content alongside acceptance of harmful content and should assess whether it is driven by content rather than wording alone. An update that raises the fallback rate on ordinary health questions deserves the scrutiny given to one that raises the hallucination rate. Because vendors change behavior without versioning, such auditing should be event triggered and model agnostic [11,12].

Fallback behavior should also be read alongside the broader variability in how different models handle clinical content. In a prospective multimodel evaluation in pituitary adenoma care, 3 current models differed significantly in clinician-rated informational quality, clinical reasoning, and expert satisfaction, with aggregate quality scores of 4.39 (SD 0.66), 4.12 (SD 0.74), and 4.07 (SD 0.76) across models (P=.018) [13]. Comparable between-model differences in accuracy and readability have been reported across 442 ophthalmology examination questions [14]. A single-model fallback audit therefore describes 1 model at 1 point in time, and the present findings should not be generalized as a stable property of medical language models as a class. It also follows that fallback and decline rates are not interpretable on their own. Paired with standardized, safety-centered answer-quality assessment, including clinician-rated rubric scoring and independent web-based auditing [15], such rates can distinguish a model that withholds access from a model that answers poorly, a distinction that a rate alone cannot make. We measured only the former.

Clinical vocabulary and the safeguard’s target vocabulary overlap: oncology, infectious disease, and reproductive terms are also biology and chemistry terms (the words in a request to synthesize a pathogen also appear in a question about whether cold sores are contagious), so clinical content and safety trigger categories are partly confounded in these data. The developer has since described this mechanism directly. In the post accompanying the model’s redeployment, Anthropic reported that its classifiers are deliberately set to trigger on a set of requests known to be likely benign, that this safety margin was made larger for Fable 5 than for any prior launch so that many more benign requests would be blocked, and that users experience the margin as the model declining reasonable, nonharmful requests [16]. The present findings quantify that design choice in a clinical domain the developer did not report and identify where false-positive filtering may warrant further evaluation, without establishing calibration at the level of any individual domain.

Limitations

The single most important constraint on this study is its observation window. The configuration evaluated here was publicly available from June 9 to 12, 2026, and the entire dataset was collected within that interval. Each prompt was submitted once with default settings. Outputs are nondeterministic, so per-prompt outcomes may vary on repeated administration, and classifier behavior can change without notice or versioning. Anthropic suspended access on June 12 and redeployed Fable 5 on July 1, 2026, with an additional safety classifier trained in response to a reported cybersecurity bypass, noting that the new classifier flags benign requests more often during routine tasks [16]. Readministering these prompts would therefore characterize a different safeguard configuration rather than provide test-retest reliability for the one measured here; a direct comparison of the 2 configurations is a tractable follow-up study that the original design could not support. The 48.6% figure should be read as a measurement of the initial June deployment, not as a current or durable property of Fable 5.

Characterizing these consumer health benchmark prompts as apparently benign rests on their benchmark origin, the model answering half of them, including clinically similar items, and the developer’s statement that benign requests can trigger the filter [8]; benignness was not independently adjudicated, and 73 prompts carried emergency, reproductive, pediatric, or mental health sensitivity flags.

The comparator analysis has 3 limitations. Gemini 2.5 Flash and Claude Fable 5 do not share an end point: the former returns a user-facing decline, whereas the latter reroutes to a second model, so the 2 cannot be placed on a common scale, and no equivalence or superiority claim is made. The 2 systems also have different and undisclosed safety architectures and trigger vocabularies, and the inverse association in Table 1 is consistent with that difference, although these data cannot establish it as the explanation. Finally, Gemini was accessed via the API on June 14, 2026, and Fable 5 via the web interface between June 9 and 12, 2026, so interface and date are confounded with model.

In total, 5 of the 11 clinical domains entered into the domain comparison rest on fewer than 20 observations, with Wilson intervals spanning 37 to 46 percentage points; the 4 question types have narrower intervals, between 11.7 points and 15.5 points, and 3 additional types were excluded because they had fewer than 10 observations. Question framing and clinical topic are correlated here, so the framing comparison is observational and motivates, rather than establishes, a wording effect; a controlled rephrasing test would resolve this.

Most consequentially, the study did not record whether Claude Opus 4.8 subsequently answered any rerouted prompt. Every result reported here concerns the Fable 5 routing decision and midgeneration truncation. Nothing in these data establishes that a user received no answer, received a worse answer, or was told that a substitution had occurred.

Standardizing the overall fallback rate to the question-type and domain distributions of the full 3173-prompt dataset yielded estimates (47.5%‐48.8%) close to the crude rate (48.6%), so sample composition does not account for the headline figure.

Anthropic reported suspending public access to Fable 5 on June 12, 2026, following a US government directive [17], and restoring access on July 1, 2026, after the directive was lifted [16].

Conclusions

Claude Fable 5 routed nearly half of these benchmark consumer health questions to its fallback model, and routing was associated with clinical domain, question category, and disease-related vocabulary. Because benignness was not independently adjudicated and wording covaried with clinical content, the design cannot identify which classifier feature drove routing. In addition, because the fallback model’s subsequent output was not recorded, these findings describe routing and truncation rather than user-facing refusal.

The broader implication is that the safety of a consumer-facing medical language model cannot be summarized by how often it answers unsafely. A filter calibrated on vocabulary rather than request intent will trigger most often in exactly the clinical areas where consumers search most, and in this sample, the highest rates were observed in oncology, reproductive and obstetric health, and infectious disease. Current audit practice does not count this failure direction, so a model update that doubled the fallback rate on ordinary health questions would pass unremarked, whereas an equivalent rise in hallucination rate would not. Reporting fallback and truncation alongside answer-quality metrics at each model release and update, using model-agnostic and event-triggered procedures, would make this direction visible to regulators, health systems, and clinicians advising patients on which tools to use. Whether wording alone can reroute a blocked question, what the fallback model actually returns, and whether the redeployed configuration behaves differently on the same prompts are the 3 questions that a controlled follow-up study should answer next.