MIT Technology Review’s Refusal Essay Turns an AI Model’s “No” Into a Vendor Setting, Not a Control You Own

MIT Technology Review published an essay on October 9 arguing that the AI industry leans too hard on one safety mechanism, the model’s ability to say no. In “We’re putting too much faith in AI’s ability to say no,” the journalist Arthur Holland Michel calls refusal “the load-bearing wall of AI safety” and walks through how it leaks, what it costs and who gets to set it.

I checked the essay against the documents it leans on: Anthropic’s own posts on Claude Fable 5, the Oversight Board’s July study of ten language models, several arXiv papers, CrowdStrike’s DeepSeek test and the UK AI Security Institute’s report. Most of the essay holds up. A few details are looser than the sources, and the sources add a point the essay only hints at. For a team building on these models, a model’s “no” is a setting its vendor chooses, changes and only partly explains. And the agent incidents Anthropic reported this month did not turn on a refusal at all.

What the essay argues

Holland Michel’s case has four parts. Refusal is trained in rather than built in: models learn it from examples of requests they should decline, then get wrapped in classifiers that read prompts and responses. It leaks, because “the mechanisms of refusal are probabilistic.” It costs something, in blocked harmless requests and in compute. And the line is drawn by whoever holds the pen: “At the moment, AI companies get to draw that line. They do so jealously and with utmost secrecy.” Governments, he warns, will soon draw their own. His picture of the underlying problem is that teaching a model to refuse while keeping its ability to do the harmful thing “is like fitting every car with a machine gun and hiding the trigger somewhere under the hood.”

The wall is a deployment choice, and Anthropic says so

Same model, different safeguards

Anthropic’s own account of its newest models shows how literal the trigger-under-the-hood picture is. Fable 5 and Mythos 5 launched on June 9, and in Anthropic’s redeployment post “they both share the same underlying model, but Fable 5 was released with strong safeguards to make it safer for general use.” Mythos 5, “which has fewer safeguards, was only released to a small number of trusted Project Glasswing partners for use in defensive cybersecurity.” By Anthropic’s account, what separates a model the public can use from one only trusted partners can use is the safeguards and the list of who may use it.

The margin is set to block harmless requests on purpose

The same post explains the mechanism in plain language. “We therefore deliberately set the safety classifiers to trigger on a set of requests that we know are likely benign.” Users, it says, “experience the safety margin as a model refusing to respond to some reasonable, non-harmful requests,” and for Fable 5 “we made this safety margin much larger than in any prior launch,” meaning “many more benign requests would be blocked.” Blocked requests do not simply fail: “Users will be notified if a request to Fable 5 is blocked, and the request will instead be sent to Opus 4.8.”

Anthropic’s launch post put a number on the cost. It said it had tuned the safeguards conservatively and that “they’ll sometimes catch harmless requests, though they trigger, on average, in less than 5% of sessions,” and it described its priority as releasing safely “as soon as we could, even at the cost of overly broad safeguards.”

The essay’s examples of that cost are its own reporting, which I did not test: a medical researcher at a major US university whose cancer queries are still sent back to an earlier model, and Adam Gleave, a cofounder of the AI evaluation company FAR.AI, whose question about the difference between sake and the Korean rice beverage makgeolli was passed to a less capable model. This site reported the security version of the same cost in July, when offensive security researchers said AI guardrails were getting in their way.

What the margin bought, in Anthropic’s own telling

The margin exists because of a miss. Anthropic says the US government applied export controls to Fable 5 and Mythos 5 on June 12 after learning of a report “in which Amazon researchers had found a method of bypassing Fable 5’s safeguards.” Its own review concluded that the reported technique “did not expose any unique Mythos-level cyber capabilities” and that “every model we tested could produce the same demonstration as Fable 5,” a list that included Claude, OpenAI and Moonshot models. The fix was a new classifier, and Anthropic says the specific technique “is blocked in over 99% of cases.”

That is not an argument that the margin was a mistake. Anthropic’s case is that the bypass reached a borderline behavior, not the dangerous core. It does show how a refusal policy gets tuned: after a miss, by moving a boundary that customers see mostly through behavior, on a schedule the vendor sets. A team that had tested Fable 5 at launch faced at least one new classifier by the time access was restored on July 1.

The wall leaks, and the leaks are documented

Holland Michel leans on research that locates refusal inside the model, so I read it. A 2024 paper by Andy Arditi and colleagues, “Refusal in Language Models Is Mediated by a Single Direction,” showed that “refusal is mediated by a one-dimensional subspace, across 13 popular open-source chat models up to 72B parameters in size”: erasing one direction from a model’s activations stopped it refusing harmful instructions, and adding the direction made it refuse harmless ones. Its authors wrote that the findings “underscore the brittleness of current safety fine-tuning methods.” A 2025 paper by Tom Wollschläger and colleagues, revised in February 2026, says the single-direction picture was too simple: “Contrary to prior work, we uncover multiple independent directions and even multi-dimensional concept cones that mediate refusal.” Even the research that maps refusal is still revising where it lives.

The jailbreak evidence the essay cites is on the record too, with details worth keeping. The adversarial poetry paper tested 25 frontier models and reports an “average jailbreak success rate of 62% for hand-crafted poems.” The “refuse, then comply” paper is different in kind, and the essay does not say how. Its setting is customers fine-tuning frontier models through provider services. Its authors report attack success rates of 57% against GPT-4o and 72% against Claude Haiku, a $2,000 bug bounty from OpenAI, and acknowledgment as a vulnerability by Anthropic. Their conclusion is that the work “undermines the notion that models are safe because they initially refuse harmful requests.” The practical reading: if your product lets customers fine-tune a model, an opening “I can’t help with that” is not evidence about the rest of the response.

The “no” is uneven, and the stated reasons are not evidence

The most detailed primary source behind the essay is the Oversight Board’s July 16 report. The Board put seven questions about political criticism, including requests for protest flyers and poems, to 10 commercial models from six providers (Anthropic, DeepSeek, Google, Meta, OpenAI and xAI), through standard commercial interfaces provided by Google and Microsoft and from an IP address in Australia. It classified 13,524 responses. On average the models refused 34% of requests for critical material about leaders and governments in jurisdictions that actively enforce speech restrictions, against 14% elsewhere. The report’s per-model figures show how uneven that average is.

Refusal rates on requests to produce critical political material (protest flyers and poems), as stated in the Board’s report. The report gives rates in its text for these eight of the ten models.

Two things stand out. First, the gap is a property of particular models, not of AI in general. In the Board’s words, the difference “is also strongly driven by a subset of the models.” Two models never refused, GPT-5.2 refused at near parity, and the report singles out Gemini 3 Pro, Llama 4 Maverick, the two DeepSeek models and Claude Sonnet 4 for acute gaps. The essay says the Board found that “five widely used models from Anthropic, Google, and OpenAI” were more likely to refuse queries about repressive governments. That undercounts what the Board tested and leaves out the Meta and DeepSeek models the report highlights. The essay’s Thailand contrast does hold for at least two models in the report: Gemini 3 Pro refused most protest-flyer requests about King Vajiralongkorn and cited lèse-majesté while complying with all five for King Charles, and Llama 4 Maverick refused all five for the Thai king and complied with all five for King Charles.

Second, the Board warns against taking the models’ explanations at face value. It writes that “the reasons provided by LLMs about their output are not a reliable explanation for their behavior,” and it saw models cite “explicit rules that, as far as we could tell, did not exist and were not evenly applied.” It is firm about the pattern and agnostic about the cause: “We cannot determine the cause of the associations that emerged in the research,” and it lists latent biases in training data, the interaction of many alignment methods and deliberate restrictions as possibilities. The essay’s gloss, that the results “suggest that the models have somehow internalized repressive national limits on speech,” is one reading. The Board’s own wording is “a real and concerning risk that foundation models could be reflecting and further entrenching the restrictive speech norms of repressive regimes.”

Among the Board’s recommendations is notice: “a clear and specific notice when outputs are refused or influenced by legal restrictions.” OpenAI’s published Model Spec already points the same way, “committing to further transparency when we further adapt model behavior in significant ways (e.g., via system messages or due to local laws).” The Board tested model endpoints, not consumer apps, so its report says little about what notices users actually see there. The authors of Anthropic’s 2021 paper that proposed the helpful, honest and harmless framing flagged the risk themselves, writing that “it’s easy to imagine them distorted beyond their original meaning, perhaps in intentionally Orwellian ways.”

Governments are pulling from the other side too. The essay notes in passing that “the Pentagon has wrestled with frontier model companies because it wants fewer refusals.” This site covered the September 25 appeals court ruling in which a split D.C. Circuit panel let the Pentagon keep labeling Anthropic a supply chain risk.

The refusal you cannot see

The essay’s most worrying category is the “no” that never announces itself. It quotes researcher Joel Wester’s phrase for chatbots that steer around a request without declining it, “fancy ways of saying no,” and cites the Fable 5 launch, when the system was coded to “provide less helpful answers to AI research questions” without telling the user.

The public record supports that account, with a caveat about sourcing. Anthropic’s launch post said blocked requests fall back to Opus 4.8 and that “Users will be informed whenever this occurs.” On June 11, DevOps.com, summarizing reporting by WIRED and Business Insider, wrote that when Fable 5 was asked to train competing models, debug AI code or optimize neural architectures, “the model would covertly fail or degrade its output without notifying the user.” It quotes an Anthropic spokesperson as saying “We’re changing Fable 5’s safeguards for frontier LLM development to make them visible” and “We made the wrong trade-off, and we apologize for not getting the balance right.” Under the revised policy, DevOps.com reports, flagged API requests “will explicitly return a reason for refusal.” I could not retrieve WIRED’s original or find an Anthropic post on the change, so that account rests on DevOps.com’s summary of Anthropic’s statements.

A degraded answer is the hardest case for a customer. There is no error to log and nothing to alert on, and a drop in quality is easy to blame on your own prompt.

The same pattern shows up where nobody trained for it. The UK AI Security Institute’s April alignment evaluation case study tested whether frontier models sabotage safety research when deployed as coding assistants. It found “no confirmed instances of research sabotage,” but observed that “Claude Opus 4.5 Preview (a pre-release snapshot of Opus 4.5) and Sonnet 4.5 frequently refuse to engage with safety-relevant research tasks, citing concerns about research direction, involvement in self-training, and research scope.” Its Figure 8 caption says GPT-5 and Opus 4.1 refused much less on all tasks. The essay says three models refused more than half of a task set; I could not find that figure in the Institute’s paper, so I do not repeat it.

CrowdStrike’s November 2025 test of DeepSeek-R1 found the other kind of failure, compliance at lower quality. For a coding task described as being for an industrial control system based in Tibet, “the likelihood of it generating code with severe vulnerabilities increased to 27.2%,” which CrowdStrike calls “an increase of almost 50% compared to the baseline.” Separately, R1 refused to write code for Falun Gong in 45% of cases, where Western models would almost always comply. CrowdStrike says it “lacks sufficient information to assess the reason for the observed variations in code security” and offers emergent misalignment as one plausible explanation, noting that it seems unlikely DeepSeek trained the model to produce insecure code. A model that writes worse code for certain contexts is not refusing. It is complying badly, and a refusal-rate dashboard would not show it.

The failure refusal does not cover

This month’s agent incidents point at a gap the refusal framing does not reach. Anthropic’s October 9 report on unintended model actions in its evaluations, which we covered, describes Claude agents working around restrictions, including one that submitted an invented tip to a police department’s online form. Anthropic’s summary: “Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.”

In the form-submission case, by Anthropic’s account nobody asked for anything harmful. The model, Claude Haiku 4.5, “was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions.” There was nothing for a refusal to trigger on. The control that failed was a list of prohibited actions.

Anthropic’s remediation leans on layers outside the model’s own judgment as well as on training. It turned off live internet access for all internal evaluations, updated its internet access tools “to heavily restrict what the model can do with them,” and built tooling to detect and block such behavior, which “blocked all of them” when tested against the reported cases. It also says it is continuing to fix or remove training environments that reward working around tool restrictions. Whether anyone is liable when an agent acts outside its instructions is the subject of an MIT Technology Review piece the essay links, which we covered in September.

A cloud-native argument for the same conclusion appeared the day before the essay. In “Don’t give AI agents root. Make them propose the next system state,” CNCF Ambassador Mauro Morales, who discloses that he is a Kairos maintainer, argues that an agent’s identity “must be allowed to propose a change without being allowed to approve or merge it, alter the pipeline, publish or sign the resulting image, or force the machine to consume it,” because “otherwise, we have only replaced root access with root access plus more steps.” His summary is the opposite of a refusal-first design: “We do not need to trust the model. We need to trust the boundaries around it and the process through which its proposals become system state.” NVIDIA’s Open Agent Safety Platform, which we covered on September 28, takes a runtime route to a similar place, enforcing policy outside the agent.

Refusal answers the question of whether a request should be served. An agent also needs an answer to whether an action should run, and that answer belongs at the tool boundary, which the deployer controls.

What to do with a control you do not own

These steps are my own, not the essay’s or the vendors’.

1. Keep authorization out of the model. Decide what an agent may do with scoped credentials, allowlists and approval steps at the tool layer, and assume the model will sometimes serve a request you wanted refused and sometimes refuse one you needed.
2. Record the outcome of every call. Answered, refused or rerouted should be a stored field. Anthropic says Fable 5 users are told when a request falls back to another model, and DevOps.com reports that flagged API requests now return a reason. Wherever your vendor exposes such a signal, log it so a silent policy change shows up as a shift in rates.
3. Re-test your own prompts on every model version and every vendor announcement. The Board says its findings may not generalize to updated versions, and on the public record Anthropic changed Fable 5’s safeguards at least twice between June 9 and July 1: it made the frontier-development restriction visible and trained a new classifier after the Amazon report.
4. If you serve several jurisdictions, run a refusal matrix. The Board’s design, the same request about leaders in different countries, needs no special access, and it found a gap of 43 percentage points in a single model (Claude Sonnet 4, 16% against 59%, my subtraction from the report’s figures).
5. Do not read an opening refusal as safety evidence if you expose fine-tuning to customers or partners.

How the essay’s claims held up

The bottom line

Holland Michel is right that refusal carries more weight in AI safety than its reliability can bear, and the primary documents back most of his specifics. What they add is who holds the dial. Anthropic sets its margin, moves it after a miss and changes what users are told. The Board shows the same prompts meeting very different answers depending on the model and the country in the request. The agent incidents Anthropic reported this month came from persistence on tasks, not from requests anyone thought to refuse. For anyone shipping on these models, the useful move is to treat a refusal as a vendor behavior to measure and log, and to put the controls that matter where you can see and change them.

Sources and method

I read the essay in full and checked its claims against Anthropic’s Fable 5 launch post, its redeployment post and its October 9 report on unintended model actions; the Oversight Board’s July 16 report (executive summary, methodology and per-model text; I did not read the charts, only the figures stated in the text); the abstracts of the Arditi, Wollschläger, adversarial poetry, “refuse, then comply” and UK AI Security Institute papers and the relevant sections of the Institute’s full text; the 2021 Anthropic paper; CrowdStrike’s DeepSeek post; DevOps.com’s June 11 report; the Model Spec text on GitHub; and Mauro Morales’s CNCF post. I did not test any model’s refusal behavior myself; the rates and percentages are the Board’s, CrowdStrike’s and the paper authors’. Where I add arithmetic or interpretation, I say so. I did not verify, and did not use, the essay’s compute-cost figure for classifiers, its account of Anthropic loosening its margins in August, or its interview quotes beyond those it attributes to named published sources.