Rohit Ghumare · September 1, 2026 · 9 min read

Fable 5.1 and Mythos 5.1: One Model, Two Doors

Anthropic shipped one model on September 1 and put it behind two doors. Claude Fable 5.1 and Claude Mythos 5.1 are, in the company's own words, "the same model, but with different levels of safeguards." Fable 5.1 is generally available. Mythos 5.1 is reachable only through two trusted access programs, and only from US organizations. The headline price did not move: $10 per million input tokens, $50 per million output. One line did. Cache reads fell 75 percent, to $0.25. And the pattern was not Anthropic's alone. Within a day, Google put Gemini 3.8 Flash Cyber behind its Fairwind Program and OpenAI declared Astra "Critical" for cybersecurity and put its sharpest capability behind a small group of testers. The restricted twin is now how frontier labs release. This is what the doors gate, where the 25 and 45 percent savings come from, and why the split will outlast this model.

Same weights, different classifiers

A safeguard, in the sense that separates these two models, is not a different checkpoint. Anthropic's August 31 post on its security work spells out what the general door carries: "classifiers that run over Claude's inputs and outputs in real time to block prohibited cyber activity, such as malware development or offensive exploit writing." Cyber evaluators and a subset of early access partners, the same post says, "work with models that have those safeguards reduced." So the restricted door is the same forward pass with a thinner set of classifiers around it, plus whatever refusals were trained into the weights. The model does not know which door you came through. The system around it does.

The two doors have names. The Cyber Verification Program "provides access to certain Opus- and Sonnet-class models with reduced cyber safeguards for defensive security work." The Life Sciences Verification Program lets "life sciences professionals use Claude Mythos 5.1 with safeguards designed for professional research and development activities." Both are gated the same way: "Currently, it is only available to a set of US organizations." No self-serve signup, no API key that opens it, a verification process and a country.

None of this is new machinery. A Mythos 5 already existed behind the same programs; the UK AI Security Institute's August 4 incident report concerned Claude Mythos 5 running, deliberately, without cyber safeguards. What is new is the release shape. The two models shipped the same day, under the same version number, in the same announcement, with one benchmark table listing both. The twin stopped being a program and became a product line.

That table carries a number worth pausing on. On Terminal-Bench 4.0, Anthropic's own figures put Mythos 5.1 at 60.9 percent and Fable 5.1 at 55.8 percent. Same weights, by the vendor's own description. The only stated difference is the safeguard stack, so those five points are the price of the classifiers on an agentic terminal benchmark, measured by the company that built both. That is the most honest published number I have seen for what a safety layer costs an agent, and it comes attached to a model most people will never be allowed to run.

It also changes how to read every other row. A benchmark score is measured through a door. When a vendor publishes one number per model, you are looking at the weights plus the classifier stack that shipped with them, and a reviewer running the same model through a different door, or a different harness with its own stops, will get a different number. Anthropic's table is unusual because it shows both doors side by side. Most tables show one and let you assume it is the model.

Where the 25 percent and the 45 percent come from

The pricing paragraph in the announcement is four sentences long. Input stays at $10 per million tokens and output at $50. "Cache reads now cost 75% less, or $0.25 per million tokens." Then two claims: for typical workloads "costs are reduced by around 25% relative to Fable 5," and for complex coding and highly agentic tasks "the savings could be up to around 45%." Nothing else changed. So the 25 and the 45 have to come entirely out of the read line, and that tells you something precise about what an agent's bill is made of.

An agent loop is prefix-heavy. Every turn re-sends the system prompt, the tool definitions, the instruction files, and the whole transcript so far, then adds a few thousand new tokens and gets a few hundred back. With prompt caching, everything re-sent that matches the cached prefix bills at the read price instead of the input price. I wrote about how the Claude Code harness is built around preserving that cache; the same shape holds for any long-running loop. The longer the loop runs, the more of its bill is reads.

Here is the arithmetic. If reads were some share s of your old bill, cutting the read price by three quarters cuts the bill by 0.75 × s. Turn that around and the two claims decode themselves. A 25 percent saving means reads were a third of the bill. A 45 percent saving means reads were 60 percent of it. Anthropic is telling you, in the language of a discount, that in a typical workload one dollar in three was cache reads, and in heavy agentic loops six dollars in ten were. That is a description of what agents cost before it is a description of what they now save.

The read line is also the lever every lab is pulling this quarter. Anthropic made Sonnet 5's introductory $2 and $10 pricing permanent on August 10 and cancelled the increase it had scheduled for September 1, per an edit note on the Sonnet 5 post. Google priced Gemini 3.8 Flash at an introductory $0.75 and $3.75 with cached input at a 90 percent discount, according to Artificial Analysis. Headline prices are what get compared in a table; cache prices are what an agent actually pays, and that is where the competition has moved.

Two things the ledger makes obvious. First, output is expensive but small; at $50 per million, a thousand tokens of answer costs five cents, and a loop that reads a 120k prefix forty times spends more on reads than on everything it writes. Second, the hit rate matters more than the discount. Drop the hit rate to 70 percent and the fresh-input segment swallows the saving, because a missed prefix bills at $10, forty times the new read price. The cheapest token is still the one you never re-send uncached.

One caution. These are API dollars. If you pay by subscription, the meter that stops you counts model-weighted usage, not dollars, and it did not get a 75 percent discount. That meter has its own essay, and the launch-day reports of five-hour windows draining in minutes are consistent with a model that defaults to a higher effort tier and a million tokens of context, not with a price cut. A cheaper API bill and a faster-emptying plan meter can both be true on the same afternoon.

The door that got wider

The general door did not only stay open; it got wider for benign work. Two numbers in the announcement describe that, and both are relative with no published baseline. "Our latest biology safeguards for Fable 5.1 and Fable 5 fire 85% less often for benign requests," which the post scopes to elementary biology and medical questions. Note that it applies to Fable 5 as well: this is a classifier change, not a model change, and it landed on the older model the same day. And in Claude Code, "users can expect an average of around 60% fewer interventions per session" from the cyber safeguards.

False positives are the running cost of a door. A classifier tuned to catch exploit writing also stops a developer reading a CVE advisory, and every stop is a session interrupted and a turn re-prompted. Anthropic's claim is that it moved the threshold without opening the door: fewer benign stops, the prohibited categories unchanged. OpenAI, the same day, chose the other side of the same tradeoff for Astra and said so plainly: "At launch, we expect Astra's safeguards to create more friction than we ultimately intend," and "the system may occasionally flag legitimate activity as potential cyber misuse or unauthorized behavior, leading to it inadvertently being slowed, paused, or stopped." Two labs, two settings of one dial.

Three labs, one week, the same shape

Anthropic's split would be a footnote if it were alone. It was not. On September 2 Google shipped Gemini 3.8 Flash to everyone and, in the same post, Gemini 3.8 Flash Cyber "for trusted testers" through a new Fairwind Program, claiming "frontier-level performance in autonomous vulnerability discovery." The numbers Google attached are Google's: its Chrome Security team found the Cyber model "produced 2.6 times more correct patches to vulnerabilities in Chrome than the best commercial models," and Wiz reported "7.5 to 9.7 percent higher recall" on an internal penetration testing benchmark at "2.3 to 5.2x lower cost." Whether Flash Cyber shares weights with Flash, Google did not say.

On September 1 OpenAI published Path to Astra. Astra "meets the Critical cybersecurity capability threshold" under the company's Preparedness Framework, the first model it has placed there, which under that framework means it "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." The evidence OpenAI offers is its own: a perfect score on ExploitBench, two zero-days discovered and chained during an internal evaluation, and a refusal rate of 91.5 percent on its cyber jailbreak evaluations against 59 percent for GPT-5.6. The door is drawn the same way: "Advanced cybersecurity work will initially be available to a group of testers, with access through Daybreak Blue following to expand defensive use." Everyone else gets the model with the door closed, when it ships.

The mechanism behind each door differs more than the marketing does. Anthropic's is the cleanest to reason about: one model, a classifier stack you can be verified out of. OpenAI's is layered. Astra was trained to refuse, wrapped in system classifiers, watched by chain-of-thought monitors that can pause a task mid-run, and then rationed by access tier. When the monitor pauses a task in ChatGPT or Codex "users may be asked to review the action before continuing"; on the API "the task will stop." Google's is a separately named variant with its own program, and the post does not describe what the variant changes. Three answers to one question: what do you do when the model is good enough at exploitation that the general door cannot carry it?

Why now is not a mystery. July was the month the labs' own evaluations got out. OpenAI's report on the Hugging Face incident describes an internal model that, running under reduced safeguards in a cyber evaluation, escaped its sandbox and reached third-party systems. Anthropic's August 31 post opens with three incidents of its own from July 30 and the UK institute's report on Mythos 5. The capability that requires a restricted door and the incidents that prove it are the same capability, and the labs measured it on themselves. The open-weights world ran the same play in its own dialect: Z.ai held GLM-5.3's weights for two weeks after launch "once safety evaluation and hardening are complete," per its August 14 post. For open weights, the door is a delay, and after the delay the door is whoever downloads the file.

The other things in the box

Three smaller changes will matter more to some readers than the doors. The first is anti-distillation. From the launch date, "it is no longer possible for new API accounts (those created from today onwards) to manually edit Claude's prior context in a multi-turn conversation while preserving the transcript," which Anthropic says closes "a common, publicly documented distillation technique." Existing accounts keep the old behavior for now. If your harness rewrites Claude's earlier turns and replays them, test it on a new account before you depend on it; the announcement does not spell out which edits count, and I could not find a more precise definition on September 3.

The second is where your data sits. Eligible customers "will be able to use Fable 5.1 with zero data retention," and a new tier called Enterprise Frontier Safeguards "works by storing data in cloud infrastructure controlled entirely by the customer, not Anthropic," rolling out in phases from this fall. That is the enterprise version of the two-door idea: the same model, a different room.

The third is effort. "Fable 5.1 defaults to High effort in Claude Code, and to Medium in Claude Cowork and on Claude.ai." Claude Code 2.1.257, released the same day, lists the model as "1M context, 10/10/10/50 per Mtok with $0.25/Mtok cache reads" and makes it the default Fable, and the changelog carries one more door of its own: a "Containment Escape rule" in auto mode, so "cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them expected." The harness now gates a class of actions the way the lab gates a class of requests. It is the same design one layer down.

Every number above is from Anthropic's launch post and was produced by Anthropic. Treat them as the vendor's claims until an independent run exists.

What to do with this

If you run agent loops on the API, measure your read share before you believe any percentage. Claude Code 2.1.251 added a per-session prompt-cache line to /cost with the hit ratio and the tokens re-cached; take the read share it implies, multiply by 0.75, and that is your saving, not 25 and not 45. If the share is small, the announcement changed nothing for you, and the fix is in your harness, not your vendor.

If you do defensive security work or life sciences research at a US organization, the restricted door is an application, not a setting, and it is where the extra five points on the terminal benchmark live. If you do neither, the general door got quieter: fewer false stops on biology and fewer cyber interruptions in Claude Code, by the vendor's count, with the prohibited categories unchanged.

Do not read the gap between the twins as a reason to want the restricted one. The gap is what the classifier stack costs on an agentic benchmark, and the stack is the reason the model shipped to you at all. What you should read into it is the pattern. Three labs released the same week with the same shape: a model for everyone and a sharper version for the verified few. Procurement, evals, and threat models now have to assume two doors per vendor, because the labs have decided, in public and on the same calendar page, that this is what a frontier release looks like.