Anthropic’s Claude Mythos 5 and Fable 5

• Fable 5 (“Fable”) and Mythos 5 (“Mythos”) are Anthropic’s most capable models. They are the same model in two configurations: Mythos has fewer safeguards and (prior to export controls) was available only to trusted partners, while Fable was the public version with stronger safeguards.

• Mythos is highly capable at offensive cyber tasks, like finding vulnerabilities and writing exploits. It can also help individuals with basic biological training make a known biological weapon. Without mitigations, releasing the model would meaningfully increase the risk of severe harm.

• Fable’s main safeguard is a “fallback” mechanism that blocks certain queries and optionally routes the request to a weaker model (Opus 4.8). The triggers are queries about cyber, biology and chemistry, suspected attempts to copy the model, or using AI to speed up frontier AI development.

• Three days after release, the US government invoked export controls requiring Anthropic to restrict all foreign nationals from accessing both Mythos and Fable. Anthropic says the government justified the order with verbal evidence of a narrow, non-universal jailbreak that bypasses Fable’s safeguards.

• This is the first time US export controls have targeted a specific, deployed AI model rather than the hardware used to train the models. The order only applies to Mythos and Fable, and affects US allies and adversaries alike.

On June 9, 2026, Anthropic released Claude Fable 5 and Mythos 5, its most capable models to date. Here is the announcement and the system card.

Fable and Mythos are the same model in two configurations. Mythos is restricted to vetted partners under Project Glasswing, while Fable was the public version with stronger safeguards.

The models are much more capable than Opus 4.8 and slightly more capable than the earlier Mythos Preview (discussed here), especially in coding and cybersecurity tasks.

Three days after the models were released, the US government ordered Anthropic to block all foreign nationals from both models. David Sacks, chair of the President’s Council of Advisors on Science and Technology, cited the discovery of a way to bypass Fable’s safeguards. Anthropic took both models offline for all users; they are still suspended at the time of writing.

In this post, I cover: (1) what risks these models pose, (2) how Anthropic assessed these risks, and (3) what mitigations they put in place. I close with reflections on Anthropic’s decision to release the models and the US government’s decision to order Anthropic to restrict access.

This section summarizes Anthropic’s catastrophic risk assessment for Mythos and Fable. Overall, the models show capability gains across the board. The biggest jumps are in cybersecurity capabilities, though the improvement from Mythos Preview is fairly modest.

• Cyber: the models can give meaningful technical assistance for real-world cyber operations using known techniques, but can’t run offensive cyber operations fully autonomously. This means the models fall in “Tier 1” of the cyber offense tiers in Anthropic’s Frontier Compliance Framework, but fall short of “Tier 2”. Mythos is slightly better than Mythos Preview at finding and exploiting software vulnerabilities. On one benchmark testing exploit development against Firefox 147, Mythos succeeded ~88% of the time, versus ~71% for Mythos Preview (and ~9% for Opus 4.8).

• Chem/bio: the models are likely able to help individuals with basic technical backgrounds make known bioweapons, but they likely can’t help create novel bioweapons. It’s hard to know whether a model can significantly help someone with basic technical training build a known chemical or biological weapon (Anthropic’s “CB-1” threshold). But the evidence suggests Mythos can, so Anthropic applied its bio safeguards accordingly. Anthropic judges that the models can’t substitute for the world-leading expertise needed to develop novel bioweapons (i.e. the “CB-2” threshold). But Anthropic is much less confident in this claim than for past models.1

• Automated AI R&D: the models can’t fully automate or otherwise dramatically accelerate the work of large, top-tier research teams. After assessing significant internal use, Anthropic judged that the model is not close to replacing its own researchers and engineers. They also have not observed an AI-attributable 2x speedup in their pace of progress. External evaluations by METR support this conclusion.

• Misalignment: risks are “very low”, but higher than for Anthropic’s earlier models. Mythos is capable enough and integrated into enough sensitive settings that this threat model is possible. Public release adds two additional concerns: models undermining research at rival AI developers and decisions inside major governments. The increased risk from misalignment compared to previous models reflects Mythos’ greater capability and broader access, not weaker alignment. Indeed, Mythos’ alignment is similar to Opus 4.8 and it’s no better at hiding its actions. So Anthropic judges the risk of serious harm from misaligned model actions as very low.

Anthropic tested the models in-house and worked with third-party evaluators including METR and the UK AI Security Institute (AISI).

• Cyber. Anthropic ran internal benchmarks on exploit development and vulnerability discovery. UK AISI ran independent cyber capability testing. To test the safeguards, Anthropic ran a bug-bounty program and internal red teaming. The bug bounty (which red-teamed Opus 4.8 with safeguards similar to Fable’s) found no universal jailbreaks after 100,000 attempts (~1,000 hours of human red-teaming effort).2 But UK AISI found a single-turn cyber jailbreak within a few hours. Their testing was still ongoing at release.

• Chem/bio. Anthropic combined expert red teaming, uplift trials with teams of PhD scientists, automated benchmarks, and a tabletop exercise. External groups (Deloitte and Frontier Design) ran additional biorisk assessments. Much of these assessments were run on a “helpful-only”3 version of the model so it would demonstrate its full capabilities (instead of simply refusing potentially harmful requests).

• Automated AI R&D. Anthropic’s main evidence came from extensive internal use of the model in its own research and engineering, supplemented by automated R&D benchmarks. METR independently assessed Mythos against the automated AI R&D threat model, running it on 38 of its hardest software tasks.

• Misalignment. Anthropic ran an automated behavioral audit across thousands of scenarios and probed the model’s internal activations to check whether its reasoning matched its actions. UK AISI separately tested whether the model would covertly undermine AI safety research.

Anthropic implemented several mitigations, following a defense-in-depth approach. Below, I focus on the new safeguards; the list is not exhaustive.

• Reading the model’s internal activations. This allows safeguards to catch misuse attempts even when the prompt looks benign. Fable’s cyber classifier works in two stages. First, a probe (a tool trained to read the model’s internal activations rather than just a prompt) screens all traffic and flags suspicious activity. The flagged output is then escalated to a second-stage classifier, which makes the final decision on whether to block the request. Reading a model’s internal activations to catch misuse is a relatively new technique. It has mostly stayed in the research lab rather than running inside a live product.

• Routing flagged requests to Opus 4.8. This fallback safeguard is Fable’s main safeguard. When a classifier detects a request related to cyber, biology, attempts to distill the model, or attempts to use the model to speed up AI R&D, Fable blocks the request and asks the user whether to route it to Opus 4.8. This lets Anthropic release its most capable model without exposing its high-risk capabilities to general users. The cyber classifiers pull Fable’s measured performance on cybersecurity tasks down to roughly Opus 4.8’s. For example, during an internal red-teaming exercise, an automated attacker could get Fable to complete only 5% of offensive cyber tasks under their normal safeguards (compared to 57% for Opus 4.8).

• Degrading AI R&D requests. Initially, the fallback safeguard “silently” degraded answers for requests related to AI R&D, but Anthropic reversed this policy. Cyber and bio requests were visibly redirected to Opus 4.8. But for AI R&D requests, the model silently gave worse answers with no notification (using techniques like prompt modification and steering vectors). After significant backlash, Anthropic reversed this policy. Users are now informed when flagged AI R&D requests are routed to Opus 4.8.

• Restricting access to Mythos. Access to Mythos is restricted to vetted partners under Project Glasswing. Releasing the unsafeguarded model to defenders first is intended to accelerate defensive adoption before broad model release. For example, doing so can allow security teams to use the model’s capabilities to find and fix vulnerabilities before those same capabilities are exposed by potential attackers (though in practice, it can be hard to find the right balance between helping defenders and proliferating to adversaries). Anthropic also notes a similar trusted-access program for biology is on the way.4

• Retaining data on all traffic. Anthropic now keeps 30 days of data on all traffic for Mythos-class models. The retained data is the full record of requests and model responses across both first- and third-party surfaces. Anthropic says it will be used only for safety (spotting novel jailbreaks, attacks spread across many requests, and false positives), and not for training. Employees can’t access the retained data by default and every access is recorded in a tamper-proof log.5 This applies even to customers with zero-day retention (ZDR) agreements. ZDR agreements have included some carve-outs in the past (e.g. for CSAM material). This expands those carve-outs.

Mythos and Fable are remarkable for two reasons. First, it’s the first time Anthropic released a model to the public that it previously judged as being too dangerous to deploy without mitigations. Second, it’s the first time the US government used export controls to restrict access to a model.

• In principle, governments should be able to quickly restrict models that could threaten national security. To justify their export control decision, the US Commerce Department cited a jailbreak that would allow users to bypass Fable’s cyber safeguards. In general, it’s reasonable for a government to be able to restrict access to a tool that (they believe) poses threats to national security.6 In these cases, it’s probably also desirable for the government to move quickly and have a fairly low risk tolerance for misuse in making this decision. This will likely become more common as frontier models become more capable. As such, I’d argue this is a useful precedent to set.

• But this specific decision was probably not justified. In restricting access to dangerous models, the government’s position should be adequately justified. The government was reportedly acting on information about the jailbreak discovered by Amazon.7 Anthropic alleged that the government pointed at a fairly “narrow” jailbreak that could allow a user to make the model “read a specific codebase and fix any software flaws”. Assuming this is true, this is probably too low of a bar to ban a model. Jailbreaks, especially narrow ones, will likely always exist.8 A developer can take steps to limit their occurrence, but it’s extremely unlikely that they will be able to find and patch all of them before deployment.910 In practice, this rule would mean banning most new models, such as GPT-5.5. Indeed, UK AISI found a universal jailbreak for GPT 5.5 in just 6 hours of red-teaming. So it’s not clear why the US government drew the line at Mythos / Fable and for this particular jailbreak.11

• The decision is in tension with the US government’s policy to allow chip sales to adversaries. The government has effectively judged that certain frontier models pose a threat to national security. This is in tension with its rules on selling advanced AI chips. In December 2025, it began permitting sales of advanced AI chips to approved Chinese customers. Through the spring, the administration continued approving higher-tier chip exports and suspended further restrictions. Advanced chips are the means by which an adversary builds frontier models of its own. Of course, granting access to a pre-built tool with dual-use capabilities is not the same as allowing access to the resources needed to build said tool. Using the resources takes time, and there may be other intervention points the US could act on to prevent China from building frontier AI models. But nevertheless, loosening the chip controls hands over the inputs needed to develop dangerous models. If the cyber capabilities of a single model warrant emergency export controls, the compute that lets adversaries train their own models should warrant equal caution.

• If export controls don’t differentiate between allies and adversaries, US allies may look to diversify strategic partnerships. US-allied countries that acknowledge the national security implications of model access now face a serious problem. The US government has signaled that it may choose to spontaneously and indiscriminately restrict access to tools that they believe are vital to national security. One might object that this is not new: the US already tier- and time-restricts its most advanced weapons systems even from close allies, who have generally accepted the arrangement.12 But frontier models are general-purpose tools that will increasingly run portions of countries’ economies. So the tolerance allies have shown for restricted access to military hardware may not carry over to a technology this economically pervasive. It seems plausible that a new wave of “AI diplomacy” could emerge in response to this decision, where countries must either invest in their own AI infrastructure or align with countries that grant them access to cutting-edge models. The US government has begun initiating talks with some allies to set up “trusted partner” schemes to grant access to cutting-edge models. But other middle powers may be left behind.

• Fallback is a promising safeguard. Fable’s “fallback classifier” safeguard seems to strike a reasonable balance between expanding access to cutting-edge models (and avoiding the friction of outright refusals) and ensuring safety. That said, the safeguard relies heavily on the underlying classifiers, and Anthropic notes that making the classifiers robust is extremely difficult. My experience in using Fable was that the classifiers were too sensitive.13 But it seems reasonable to start off more risk-averse and adjust over time.

• It’s becoming harder to rely on quantitative evaluations to show that models are safe. Many of the evaluations used to “rule out” dangerous capabilities are becoming saturated. For example, Anthropic notes that Mythos and Fable now beat top human performance on almost all the evaluations used to rule out AI R&D risks. The judgment that the models are still safe increasingly relies on more qualitative evidence, such as internal measures of research acceleration. And even the tests that aren’t saturated are getting harder to trust. As models grow more capable, they become better at knowing when they are being evaluated. UK AISI found that Mythos is very capable at distinguishing evaluation from deployment when prompted. The models’ reasoning is also getting harder to follow: their chains of thought are growing denser and more jargon-heavy. This could undermine current approaches to managing loss of control risks, which rely heavily on monitoring chains of thought. In general, we seem to be entering a period of increasing uncertainty about model safety, with no clear way to reduce the uncertainty.

Acknowledgements: Thanks to Alan Chan, Jonas Freund, Markus Anderljung, Matt van der Merwe, and Sophie Williams (in alphabetical order) for helpful feedback on earlier drafts. All remaining errors are my own.

Disclaimer: Posts are written by individual team members and reflect the author’s perspective. Not all team members necessarily agree with every take. The views expressed here do not represent the official position of GovAI.