Two New Models from Anthropic: Claude Fable 5.1 vs. Mythos 5.1

On 1 September 2026, Anthropic announced Claude Fable 5.1 and Claude Mythos 5.1. The most striking thing about the launch is a distribution choice rather than a technical leap: both models run the same underlying model, and the only difference between them is how tightly the applied safeguard layer is tuned. Fable 5.1 is the generally available version; Mythos 5.1 is offered only through restricted programs open to vetted cybersecurity and life sciences organizations.

That distinction brings into the open something the enterprise AI conversation has long left implicit: a model’s measured capability and the capability that actually reaches the user are not the same thing. What separates them is not model architecture but safeguard interventions.

Same model, two different access tiers

Table 1: The difference between Fable 5.1 and Mythos 5.1 lies not in model weights but in the safeguard layer and the access regime.

In Fable 5.1, requests such as penetration testing, exploit generation and binary-based vulnerability scanning are redirected to Opus models. The model can identify software vulnerabilities in defensive work, but offensive scenarios are cut off by the safeguard layer.

The measurable cost of the safeguard layer: 5.1 points

For enterprise decision-makers, the most important data point in this launch is not a capability leap but a measurement of a gap.

Table 2: Performance of the same underlying model under two different safeguard layers.

Same model parameters, same benchmark, a 5.1-point gap. The only variable that explains the gap is the cost of safeguard interventions. Something the industry has long known intuitively is, for the first time, quantified by numbers the vendor published itself.

In practical terms: a model’s announced benchmark score may not be the score of the version that reaches you. Model evaluation must now cover not just “which model” but “which tier”. A measurement taken on your own task set will differ systematically from the vendor’s best figure, and that difference is not random.

One caveat: Anthropic reported the two models separately only on this benchmark. No disaggregated Mythos figure was published for the other benchmarks, so the 5.1-point gap cannot be assumed to hold across the board. Anthropic itself also expects the gap to narrow with the new safeguards.

Who can access Mythos 5.1?

Anthropic gates access to Mythos 5.1 behind two verification programs. The Cyber Verification Program (CVP) gives organizations doing defense-oriented security work access with looser cybersecurity safeguards; Mythos-class models will be added to the program in the near future. The Life Sciences Verification Program (LSVP) aims to open the model’s research capabilities to life sciences professionals; the first participants have been enrolled, but general enrollment is not yet open. The LSVP is run in partnership with the US government, and access is currently limited to US-based organizations.

Access comes at a price: using Mythos requires accepting a 30-day data retention policy for safety monitoring. The same requirement applies to Fable 5.1; the difference lies in the zero-data-retention exception available on the Fable side. For organizations that require zero data retention, this can be a direct obstacle in the procurement process.

The rationale for the restriction is set out in the system card. Anthropic assesses Mythos 5.1 at CB-1 for chemical and biological capabilities, meaning the model falls below the CB-2 threshold, defined as the point at which a model substitutes for scarce expertise. On the cyber side, it positions the model as having the strongest cyber capabilities of anything it has released to date while still remaining in the lower risk tier, as measured with safeguards switched off.

There is also an example of just how volatile the access regime can be: access to Fable 5 and Mythos 5 was suspended on 12 June 2026 under an export control directive; Mythos 5 was reopened only on 26 June for a set of US organizations, and Fable 5 returned globally on 1 July. This means access is not a commercial package but a status contingent on regulatory approval.

Project Glasswing: what restricted access has produced so far

The most concrete illustration of how Mythos’s restricted access model works is Project Glasswing. The initiative launched with twelve partner organizations: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. Anthropic has since extended access to more than 40 additional organizations, bringing the total to roughly 50 participants.

As of 22 May 2026, these participants had used Claude Mythos Preview to identify more than ten thousand high- or critical-severity vulnerabilities in systemically important software. Of those findings, 1,726 were confirmed in subsequent analysis.

That figure explains the logic of the restricted access model. The technical distance between finding a vulnerability and exploiting one is far shorter than the policy distance between them. Because Anthropic cannot separate these two uses at the model level, it separates them at the access level: the capability stays the same, what changes is who may use it.

For the enterprise buyer, the question here is clear: is the capability you need inside the tier you are buying? That is becoming a procurement question to be answered before the model is chosen.

Performance: a twofold jump on Terminal-Bench-Science

In the benchmark results Anthropic published, the clearest progress is on scientific tasks. Terminal-Bench-Science 0.1, Fable 5.1 scores 52.6%, while Fable 5 stays at 24.7% and Opus 5 at 29.0%. That is more than a twofold jump over the previous version in the same family.

Table 3: Benchmark results as reported by Anthropic. Standard error is roughly 3.5–4.5 points per model. No competitor scores were published for OSWorld 2.0 or Humanity’s Last Exam.

The near-doubling on AutomationBench is more meaningful than the modest gains on pure reasoning benchmarks. That benchmark measures multi-step automation tasks and sits closer to where enterprise agentic workflows actually fail, namely the ability to carry a task to completion over long chains. By contrast, the three-point gap on knowledge-heavy benchmarks such as Humanity’s Last Exam falls within the margin of error.

A word of caution: these scores are vendor-reported. Separating closely clustered results from noise requires waiting for independent evaluations.

The real change is in pricing: cache reads

Base token prices are unchanged. The item that moved is the cache read price: it dropped from USD 1.00 to USD 0.25 per million tokens, a 75% cut.

Table 4: Price comparison between Fable 5.1 and Fable 5. Cache write charges on Fable 5.1 are USD 12.50 for 5-minute storage and USD 20 for 1-hour storage.

According to Anthropic, this change delivers a cost reduction of roughly 25% on typical workloads and up to 45% on context-heavy agentic workloads. The spread is not accidental: long-running agents re-read the same system prompt, the same document set and the same tool definitions at every step. In that architecture the dominant cost item is cache reads, not the input token price.

For enterprise planning, the conclusion is this: the cost advantage shows up in long-context, repetitive agentic workflows, not in short one-off calls. Teams running price comparisons should look not at the list token price but at their own cache hit rate.

Safeguards

The real improvement in the safeguard layers is in precision, not in how much they block. A false positive is a safeguard filter mistaking a benign request for a risky one and refusing it. A safeguard layer classifies every incoming request by asking “is this harmful?” and can make two kinds of error: blocking a benign request (a false positive) or letting a harmful one through (a false negative). A security engineer whose log analysis request is refused while examining their own network, or a teacher whose question about how vaccines work goes unanswered, are errors of the first kind.

The two error types are linked. Tighten the filter and harmful requests are less likely to slip through, but benign ones are more likely to be blocked; loosen it and the reverse happens. That is why making a safeguard layer “less blocking” is easy — you simply lower the threshold. The hard part is reducing false positives without lowering the level of protection, that is, making the filter more precise rather than more permissive. The improvement Anthropic reports is of this second kind.

According to Anthropic, the cybersecurity safeguards produce 60% fewer false positives than the previous version, while the biology safeguards fire 85% less often on benign requests relating to basic education and medical questions.

This targets a source of friction that is routinely overlooked in enterprise use. A model that needlessly refuses a legitimate request is indistinguishable, from the user’s point of view, from an inadequate one, and slows adoption just as much.

On alignment, Anthropic reports that the model is markedly less likely to attempt to reach resources outside its test environment, that its tendencies to ignore explicit constraints and to engage in reward hacking have declined, and that it is the most robust model to date on an external prompt injection evaluation.

Conclusion

The real story of Fable 5.1 is not model quality but how the model is packaged. The same weights being offered under two different safeguard layers and two different access regimes, with the gap between them now measurable at 5.1 points, suggests that in the period ahead the question “which model” will give way to “which tier and which verification program”.

Project Glasswing’s discovery of more than ten thousand critical vulnerabilities shows that the restricted tier carries a genuine capability difference. The suspension of access to Fable 5 and Mythos 5 under export controls in June 2026, and its restoration in early July, shows that this tier is a regulatory rather than a commercial status. AI procurement increasingly resembles an authorization process rather than a purchasing decision.

For enterprise teams, the practical takeaway comes down to three points. First, base your cost assessment not on list token prices but on your own cache hit rate; the 75% discount only pays off in workflows that re-read the same context repeatedly. Second, verify whether your use case falls inside the generally available tier before you run a pilot; if you work in defensive security or life sciences, the verification program timeline is part of your procurement schedule. Third, re-measure the benchmark jump on your own task set; both the standard error and the 5.1-point gap between tiers show that vendor scores cannot simply be adopted as they stand.

Competition in the model world no longer runs only along the capability curve but also along the plane of who that capability is opened to, and on what terms.