News

On June 9, Anthropic made Claude Fable 5 broadly available – the most capable model the company has produced to date. Rather than release a single product, Anthropic offered the same underlying model in two different packages separated by safety controls. The public-facing version is Fable 5; a second configuration, called Claude Mythos 5, removes certain cyber restrictions and remains accessible only to a vetted set of cybersecurity teams and operators of critical infrastructure. Anthropic bills Mythos 5 as the most powerful cybersecurity-oriented model available.

Functionally, the split comes down to how potentially hazardous requests are handled. When Fable 5 detects queries related to cyber operations, biology, chemistry, or model-distillation, it redirects those prompts to the less capable Claude Opus 4.8. Mythos 5, by contrast, keeps the advanced cyber capabilities available for approved users. Anthropic has set identical pricing for both Mythos 5 and Fable 5 at $10 per million input tokens and $50 per million output tokens – a price point the company says is under half the cost of the earlier Mythos Preview. Fable 5 is available now through the Claude API, and it is included in Pro, Max, Team and seat-based Enterprise subscriptions at no extra charge through June 22; after that date usage will be billed against credits.

Anthropic explains the product split by pointing to the model class’s effectiveness at finding and exploiting software flaws. The company’s concern is that unleashing those capabilities without controls could give attackers a large advantage. To manage risk, Anthropic layered a set of classifiers – separate AI modules that monitor for misuse and jailbreak attempts. If a user request trips one of these classifiers, Fable 5 does not simply refuse; instead the flagged prompt is routed to Opus 4.8 and the system notifies the user that a handoff occurred.

One flagged category that deserves special mention is distillation, which Anthropic defines as attempts to extract a model’s capabilities to recreate a competing system. The company blocks distillation to prevent near-frontier skills from being replicated without safeguards. The cybersecurity classifier is broader: it aims to block not only exploit creation but also offensive cyber workflows such as reconnaissance, discovery, lateral movement and other agentic steps that make up real attacks.

Anthropic reports internal tests in which classifiers, when configured to block rather than fall back to Opus 4.8 and when not confronted with evasion attempts, prevented the model from making progress on offensive cyber tasks. An external partner also evaluated Fable 5 and found it complied with zero harmful single-turn requests involving cyberattack planning, exploit development, or defense evasion, resisting 30 public jailbreak techniques during testing.

The trade-off for these conservative safeguards is false positives. Anthropic calibrated the classifiers to be cautious in order to ship quickly, which can cause benign requests to be caught. The company says fallback to Opus 4.8 occurs in under 5% of sessions, meaning over 95% of interactions should behave like the cyber-unrestricted Mythos 5. That “under 5%” figure aggregates all fallbacks – both genuine blocks and unintended catches – so it limits the maximum user disruption rather than directly reporting the false-positive rate. Anthropic plans to tighten the classifiers post-launch to reduce unnecessary fallbacks.

On robustness testing, Anthropic cites a lengthy external bug-bounty effort of more than 1,000 hours that did not produce a universal jailbreak, exploit prompt, or a reusable harness capable of wholesale removal of safeguards. External red teams likewise failed to find a universal bypass for long-form agentic tasks, with one important caveat: the UK’s AI Security Institute made progress toward a universal jailbreak during a short initial testing window. Anthropic acknowledges it is probably impossible to eliminate universal jailbreaks entirely and frames its goal as making any remaining bypasses slow and expensive enough to be detected before wide use.

The rationale for treating this capability cautiously was foreshadowed in April, when Anthropic distributed Claude Mythos Preview to a limited group under Project Glasswing. The red team’s technical account is notable: during testing Mythos Preview located and exploited zero-day vulnerabilities across all major operating systems and web browsers it was tasked to probe. Among the findings was a 27-year-old OpenBSD bug; in another case the model autonomously crafted a remote-code-execution exploit against FreeBSD’s NFS server based on a 17-year-old flaw that was triaged as CVE-2026-4747.

Anthropic characterized that FreeBSD result as giving an unauthenticated attacker full root access from anywhere on the internet. The National Vulnerability Database’s entry was more circumspect, noting that while the stack overflow itself doesn’t require client authentication, kernel code execution would be reachable by an attacker able to send packets to the NFS server when the kgssapi.ko module is loaded. Anthropic says these offensive abilities were not explicitly trained for; instead they emerged as an unintended consequence of overall improvements in the model’s code-writing, reasoning, and autonomous behavior – the same improvements that make it better at generating patches.

The red team warned that defenses that rely on friction – measures that depend on attacker patience or manual effort – are weakened when a model can automate tedious exploitation at scale. Strong, technical mitigations such as KASLR and W^X still increase the attacker’s cost, but protections that assume slow, manual work become far less effective when an AI can do the grinding. Mythos 5 carries forward the offensive skills demonstrated in the preview, and Anthropic expects it to be comparable to or slightly stronger than the earlier Mythos Preview.

The risk is not merely theoretical. In the early weeks of Project Glasswing, Anthropic and roughly 50 partner organizations used Mythos Preview to surface more than 10,000 high- or critical-severity vulnerabilities in widely used software. Cloudflare reported about 2,000 bugs, roughly 400 of them high or critical. Mozilla identified and patched 271 issues in Firefox 150 – an order of magnitude more than it had found in Firefox 148 using the older Opus 4.6. Anthropic says similar pressure shows up elsewhere, with vendors shipping unusually large security updates.

Put simply: discovering bugs has become cheap and fast, while verifying, triaging, and patching them remains human-labor intensive. Anthropic says open-source maintainers, already overwhelmed by low-quality AI-generated reports, have asked the company to slow its disclosures because they can’t produce fixes quickly enough. In Glasswing, a high- or critical-severity bug typically took roughly two weeks to patch on average. That shift moves the critical window from discovery to remediation, creating a period between public disclosure and deployed fixes where attackers can operate.

Anthropic’s red team sharpened this concern with “N-day” experiments: given only a disclosed CVE and its patch, Mythos Preview produced functional Linux privilege-escalation exploits in under a day and with relatively modest compute costs (a few thousand dollars or less). For defenders the takeaway is clear and faster-moving than before: assume a serious CVE can become a working exploit within hours of publication, not weeks. That elevates the need to prioritize automatic updates for internet-facing systems, treat dependency updates that include CVE fixes as urgent work, and maintain baseline defenses such as multifactor authentication and comprehensive logging so that a single missed patch isn’t the lone barrier against compromise.

To support legitimate offensive security work while retaining controls, Anthropic has launched a Cyber Verification Program that allows vetted security professionals to use its models without the cyber safeguards. It is also changing data policies for Mythos-class systems: traffic to Fable 5, Mythos 5, and future models at that capability level will be retained for 30 days across both first- and third-party integrations. Anthropic insists it will not use this data for training or any non-safety purpose, will audit and log human access, and will delete records after 30 days except where safety investigations or legal obligations require longer retention. The company says this window is necessary to detect novel attacks or jailbreaks that span multiple requests; customers with strict data-handling rules should consider the retention requirement before routing sensitive inputs through these models.

Anthropic plans to broaden access to Mythos 5 via a trusted-access program and says that once it scales compute capacity, it aims to return Fable 5 to subscription tiers without the post-June 22 usage-credit surcharge. The broader industry implication remains unresolved: other labs are developing similarly capable systems, and not every organization will place an equivalent layer of classifiers in front of them. The defensive advantage Anthropic gained from Project Glasswing matters only if the rest of the field adopts comparable precautions.