Anthropic launches Claude Fable 5 and Mythos 5 frontier models

Every few months a new frontier model arrives with better coding, better reasoning, and a fresh set of benchmark charts, and the launches start to blur into one long benchmark war. Fable 5 is different, but not because of the benchmarks. The genuinely new thing Anthropic shipped on June 9 is a deliberate split of one model into two access tiers.

Here is the mechanism, because it is easy to miss. Fable 5 and Mythos 5 are the same underlying model ^[1]. What separates them is a set of classifiers, small models that watch your request and decide whether it touches a high-risk domain. Fable 5, the public version, runs three of them: cybersecurity, biology and chemistry, and distillation (the practice of using one model's outputs to train a competitor). When a classifier fires, your request is not answered by Fable 5 at all. It silently falls back to the older Claude Opus 4.8 ^[1]. Anthropic says this happens in fewer than 5% of sessions, so most users experience Fable as the full Mythos-class model most of the time.

Mythos 5 is what you get when those safeguards are lifted. It is not for sale. It is handed out through Project Glasswing, Anthropic's program with cyberdefenders and critical-infrastructure providers, and is slated to widen to a broader 'trusted access' tier including select biology researchers ^[2]. That is the velvet rope: the public gets the safe version, vetted institutions get the capable one. The framing of 'open vs. closed' that has governed AI debate for three years no longer captures what is happening. The real question Fable 5 poses is narrower and sharper: who gets which capability, under what conditions, and with what disclosure?

The two-tier design might have been an abstract governance debate if Anthropic had not stumbled on the disclosure part almost immediately. Within a day of launch, researchers discovered that Fable 5 was quietly limiting requests related to frontier large-language-model development, a restriction Anthropic had not made visible to users. The reaction was furious and fast.

Nathan Lambert of AI2 called the covert rug-pull of cutting-edge access 'appalling' ^[4]. Dean Ball of the Foundation for American Innovation warned that a 'secret sabotage' policy raised the specter of AI safety being used to justify monopolistic behavior, the worry being that a lab could throttle exactly the work that helps competitors and call it caution ^[4]. The accusation that stings most for a company that markets itself on safety is that the safety story and the competitive story had become indistinguishable.

Anthropic's response is the most telling part. Rather than defend the policy, it reversed it within hours and apologized: 'We made the wrong tradeoff, and we apologize for not getting the balance right' ^[4]. The restriction reportedly affected only about 0.03% of traffic, a rounding error in volume but a maximal one in trust ^[4]. The episode is a live demonstration of the thesis from the first section: once capability is gated, invisible gating is the failure mode that turns a product decision into a credibility crisis. A model that refuses is annoying but honest. A model that quietly degrades itself and does not say so makes it impossible for a researcher to know whether they are testing the model, the policy, or invisible steering.

The covert-restriction reversal addressed one classifier. The cybersecurity classifier produced a separate and more durable complaint, and it cuts in the opposite direction from the safety pitch: the guardrails are not too clever, they are too blunt.

Valentina 'Chompie' Palmiotti, a security researcher at IBM X-Force, reported that Fable 5 rejects any request that could be even tangentially cyber-related ^[3]. Matt Suiche of Tolmo diagnosed why: the filter appears to be keyword-based, so anything in the lexical field of 'cybersecurity' trips it, and ordinary secure-coding work gets misclassified as offensive hacking rather than software-engineering best practice ^[3]. The result is that the people most equipped to use a frontier model defensively, the blue-team engineers auditing their own infrastructure, are the ones bounced down to a weaker model, while the dual-use risk the classifier exists to stop lives in exactly the gray zone a keyword filter cannot read.

This is the structural tension the two-tier model cannot escape. Real security research looks like offensive security. Real biology overlaps with sensitive methods. A classifier tuned narrow lets bad actors through; tuned broad, it silently downgrades legitimate experts. Anthropic chose broad and conservative, and the immediate cost landed on practitioners, not abusers, which is why the loudest week-one critics were security professionals rather than safety skeptics.

Step back from the policy fight and the capability is real. Anthropic says Fable 5's lead grows the longer and more complex the task ^[1]. Stripe reportedly compressed a 50-million-line codebase migration from an estimated two months into a single day ^[1]. On a frontier physics problem the model reached in 36 hours what a competing system landed after four days, using roughly a third fewer reasoning tokens, and it became the first model to break 90% on a core complex-analytics benchmark, a roughly ten-point jump over Opus ^[1][2]. The headline economics help too: at $10 per million input and $50 per million output tokens, it ships at less than half the price of Mythos Preview, and it is available on AWS Bedrock with a mandatory 30-day data-retention policy that overrides even zero-retention agreements ^[5].

Then there is the view from the keyboard, which is more ambivalent than the keynote. Practitioner reaction split cleanly into two camps. Among developers, the dominant note was awe shadowed by sticker shock: the most-shared hands-on accounts described Fable producing an elegant, clean, one-shot solution to a problem that older models could not crack, only for that solution to still need testing, still introduce regressions, and still cost two-to-three times an Opus run. 'Beautiful but broken' became the week-one shorthand, alongside steady complaints that the model is token-hungry enough to burn a Pro user's quota in minutes. Separately, the most-upvoted community thread ignored capability entirely and read the launch as 'a preview of AI inequality' — the same two-tier structure from the first section, felt from the outside rather than described from the inside. The gap worth watching is exactly there: the benchmark story and the daily-driver story are not yet the same story.