AI safety filters are starting to pick which model answers you, and HoneyRoute goes further

The model answering you may not be your pick

When you send a request to a large AI model, the reply may come from a different model than the one you chose. As Security Internal Reference reported, Anthropic built this into the June 2026 launch of Claude Fable 5. If a safety classifier (a program that sorts requests by risk) sees a request touching high-risk areas, it can switch that request to a weaker model such as Claude Opus 4.8.

The areas include offensive cybersecurity techniques, biology and life sciences, frontier model development, and attempts to extract a model's reasoning. Anthropic calls the switch Fallback. Users see a notice and can tell which model actually answered, so this is not a trap or a secret swap.

The shift is subtle but real. Older guardrails decided whether a request was allowed or refused. Fallback adds a third option: serve the request, but with less powerful capabilities.

Why a middle path helps

Imagine a company with one very strong cybersecurity model and one weaker model that handles everyday coding. A question could serve either a researcher or an attacker. Refusing it harms legitimate work, while answering it with the strongest model may hand over too much capability.

Fallback sits between those two. The fallback model keeps its own safety rules and can still refuse. Later versions such as Fable 5.1 assign different fallback models to different risk types, with some cybersecurity requests going to Opus 4.8 and some biology requests going to Opus 5.

Anthropic also offers this at the API level, so developers can automatically retry with a backup model after a safety refusal. The article is careful on one point: there is no public evidence that Fallback is a honeypot meant to trap attackers.

HoneyRoute: a decoy for attackers

A honeypot is an old network-security trick: a fake system that looks valuable, so intruders waste time in a controlled space while defenders watch. A September 2026 paper called HoneyRoute brings that idea to AI services. A light detector scores each incoming request. Normal traffic goes to the real model, and suspected attacks go to a decoy model behind the same address.

The attacker may keep tweaking prompts and settings, and everything is logged. The goals are to keep suspicious traffic off the real model, keep the attacker engaged so they reveal their methods, and feed what is learned back into the detector. The system also builds an attacker fingerprint, a profile used to link similar attacks.

The paper offers two decoys. A code-based one uses rules, templates and cached answers, which is cheap but easier to spot. A model-based one is a separate model that behaves like the real one, which is more convincing but still uses computing power.

What the tests show, and what they don't

On an initial test set of 103 samples, HoneyRoute scored an F1 (a balance of catching attacks and avoiding false alarms) of 0.911, with a median routing delay of 38 milliseconds. A two-stage approach using a large guard model scored 0.948 but took about 14.6 seconds. On a larger 1,103-sample test, HoneyRoute scored 0.893 against 0.944 for Llama Guard 4 12B, so it is faster but not the most accurate.

In a stress test with 250 requests, 150 of them resource-draining attacks, the real model used 15,351 tokens instead of 708,077. That is the 97.8% drop. Normal requests slowed from 21.4 to 22.7 seconds. But the decoy still burns computing power, so this is not a 97.8% cost saving.

The decoy matched the real model's answers in meaning 92.9% of the time on normal requests. That measures answer similarity, not how often a real attacker would be fooled.

Another finding concerns multi-turn attacks. Attack conversations showed risk scores rising at an average slope of 0.155, versus 0.012 for normal ones. A rule using that trend caught all 35 attack sessions in the extended test, with an 8% false alarm rate on normal sessions. The test sets were small and partly model-generated.

The hard parts before real use

False alarms are the biggest worry. In a multilingual test, HoneyRoute wrongly flagged 43 normal Chinese technical questions. A security researcher quietly sent to a decoy would get answers that do not match the real service, without knowing it. The article argues that uncertain requests should get a stronger guard, tighter tool permissions or a sandbox, with honeypots reserved for clearly hostile probing.

Unknown attacks are another gap. Only traffic that reaches the decoy becomes intelligence. An attack the detector misses goes straight to the real model. Matching attacks to a source is also weak: pairwise identity matching had only 10.2% precision, so it should not be used alone to ban anyone.

For AI agents that use tools, a decoy can fake language but must never get access to real databases, files or browsers. Anthropic's October 2026 anti-distillation report points the same way: it described layered classifiers and account-level controls, and said the reasoning tokens available to those trying to copy its model fell by about 90%—99% within its monitoring.