The most powerful artificial intelligence ever released to the public today just arrived with a restriction that few expected — Claude Delusion 5 will simply refuse to answer questions about biology if it detects that they could be used to make biological weapons. And no, we are not talking about instructions for synthesizing pathogens; the system is so cautious that even seemingly innocent questions could be blocked.
Anthropic launched Delusion 5 last Tuesday as the first model of the class Mythos available to the general public. This is the company’s most advanced line, one that until just two months ago was completely out of reach of common users because it was considered too capable, too dangerous. Now it is available to everyone, but with conditions that have generated more debate than anyone expected.
Sensitive topics that AI does not want to answer
Delusion 5 does not work alone. When it detects that a query touches on sensitive topics of biology, chemistry or cybersecurity, it does not respond directly, but redirects the question to Claude Opus 4.8Anthropic’s older model, which is less capable in those areas but doesn’t have the same safety restrictions. The user sees the same response, but something completely different is happening under the hood: the most intelligent model in the company’s history is deliberately pushed aside.
Dianne Penn, chief product officer at Anthropic, was clear on this. The system is going to err on the side of cautionand that means that legitimate queries will also be redirected even if they do not represent any risk right. A question about pathogens that any biology student would ask could activate the filter. A researcher trying to understand viral mechanisms for his thesis might find that Delusion 5 simply passes the buck to another model.
Why so much caution? The company’s reasoning is hard to ignore — The same questions that serve a security researcher or a professional biologist can be dangerous if asked by someone with completely different intentions.. There is no easy way to distinguish between the two cases. And Delusion 5, with all its computational power, is exactly the kind of tool a malicious actor would want to use to obtain information they couldn’t easily obtain otherwise.
How the filter system works in practice
The most interesting thing about this architecture is not the lock itself, but how it is technically designed. Delusion 5 uses automatic classifiers that analyze requests in real time and detect if a question touches on risk areas in biology, chemistry or offensive cybersecurity. When the system flags a query, the model immediately pauses the chat and notifies the user with a specific message.
The message that users see is direct but not hostile — something in line with the fact that security measures have marked the consultation for dealing with biology or cybersecurity issues. From there, The conversation continues with Opus 4.8 taking over the administrationwithout the user having to do anything additional. The flow is not interrupted; just change drivers.
What can become a problem is the sensitivity of the detector. Users on X have already reported that the filter is activated even with harmless tasks, such as reviewing a blog post that tangentially mentions cybersecurity. That says a lot about the philosophy behind Delusion 5 — Anthropic would rather block a hundred legitimate questions than let through one that could be used for harm.
Why this matters beyond Anthropic
The controversy around Delusion 5 does not stop only in the biology filters. Anthropic had to publicly apologize after it was revealed that model restrictions had been implemented without clearly communicating it to developers, causing several research projects to be affected without warning. The company promised that from now on all safeguards will be visible to users.
Microsoft, for its part, temporarily disabled Claude Delusion 5 of the models selector available to his employees in the internal version of GitHub Copilot, while the rest of Claude’s models remain available under the Zero Data Retention policy. That speaks to a level of corporate noise that Anthropic probably didn’t anticipate at launch.
The underlying debate is deeper than any technical restriction. To what extent should a private company decide which science questions are “too dangerous” for its most capable AI? There are legitimate investigators who need exactly the kind of answers that Delusion 5 won’t give. There are also malicious actors who, given access to the unfiltered model, could exploit it in ways that no regulatory system is ready to manage.
What Anthropic does with Delusion 5 is not new to the industry, but it is the most explicit and structured implementation we have seen. The most powerful AI on the public market comes with a deliberate limitand that, while uncomfortable for many users, is perhaps exactly the right thing to do when you’re building technology that literally didn’t exist five years ago. Time will tell if the line is drawn in the right place, but at least for the first time, the line is drawn.
Keep reading:
• They manage to breach Apple’s M5 chip: Is your MacBook in danger?
• Anthropic releases Claude Delusion 5 and Claude Mythos 5, the most powerful AI models it has ever built
• How much it costs to test Anthropic’s new AI models in 2026
