When Anthropic launched Claude Fable 5 and Claude Mythos 5 on June 9, 2026, it did something no frontier lab had done at this scale: it shipped one model as two products. Same weights, same intelligence — two very different levels of access. Three months later, the September 1 release of Fable 5.1 and Mythos 5.1 refined the split and added a pricing move that makes the public tier meaningfully cheaper to run at scale.

The result is Anthropic's answer to the hardest question in frontier deployment: how do you sell a model that can find zero-days without handing attackers the tooling to exploit them? The answer, so far, is to charge a safety premium for the public version and keep the dangerous one behind a velvet rope.

One model, two safeguard tiers#

Fable and Mythos are not two models trained for different purposes. Anthropic is explicit about this: they share the same underlying intelligence and technical capabilities. The difference is entirely in the safeguards layered on top.

  • Claude Fable 5 / 5.1 (public): Mythos-class capability with strict automated controls. A classifier layer screens requests touching cybersecurity, biology, chemistry, and model distillation. If a request trips the risk threshold, it is rerouted to the less capable Claude Opus 4.8 — you still get an answer, just from an older model. Anthropic says more than 95% of sessions never trigger the fallback, and the system is deliberately tuned to err on the side of caution, meaning some benign queries get redirected while the classifiers improve.
  • Claude Mythos 5 / 5.1 (gated): The same model with those safeguards lifted for approved users — selected cyber defenders, critical infrastructure providers, and life-sciences researchers who have passed Anthropic's verification.

With Fable 5.1, Anthropic loosened the clamps on the public tier in two calibrated ways: the company reports roughly 60% fewer cybersecurity safeguard interruptions per Claude Code session, and 85% fewer on benign elementary-biology and medical requests. Fable 5.1 can now identify vulnerabilities in source code — defensive work a public model can reasonably do — while still blocking penetration testing, exploit generation, and vulnerability scanning of compiled binaries. The line Anthropic is drawing is capability-adjacent to the harm: understanding code is fine; weaponizing it is not.

The gate: Project Glasswing and the verification ladder#

Mythos-class access flows through Project Glasswing, Anthropic's trusted-access program run in coordination with U.S. government agencies. Roughly 200 organizations — cyber defense firms, critical software infrastructure groups, and biology researchers — were admitted for the June launch. For 5.1, Anthropic opened a dedicated Life Sciences Verification Program with open enrollment planned, and says Mythos-class access will be added to its Cyber Verification Program in the near future, starting with a limited set of U.S. organizations.

The gate comes with obligations. Mythos-class traffic originally carried a mandatory 30-day data-retention requirement so Anthropic could detect sophisticated attacks and jailbreak attempts — a condition that, the company acknowledged, limited adoption among regulated enterprises. The Fable 5.1 launch introduced Enterprise Frontier Safeguards, a phased rollout planned for fall 2026 that would store activity data in customer-controlled infrastructure and offer zero-retention options. In other words: the full power of the model is available, but only if Anthropic can watch how you use it — or, soon, if you can provably watch it yourself.

This is the precedent the industry is watching. Anthropic previously wrote, in a Project Glasswing update, that safely releasing Mythos-level capabilities to the general public would require "highly robust safeguards that prevent the model's cyber capabilities from being misused — safeguards that we (and, to our knowledge, all other AI developers) have yet to develop." The dual-release architecture is the stopgap: deploy the intelligence broadly, keep the risky affordances gated, and let the classifiers improve in production.

The price: a safety premium, then a cache-read repricing#

Here's where strategy meets the P&L. Both Fable 5 and 5.1 carry API pricing of $10 per million input tokens and $50 per million output tokens — roughly double the $5/$25 of Claude Opus 5, and double what Anthropic charges for its other generally available models. You are paying a premium for frontier capability, and the safeguard infrastructure is part of what the premium funds.

But the September release changed the effective economics without touching the sticker. Fable 5.1 cut the price of cache reads by roughly 75%, from about $1.00 to $0.25 per million tokens. Because long-running agentic workloads — multi-hour coding sessions, research agents, document pipelines — lean heavily on prompt caching, Anthropic estimates typical workloads now cost about 25% less than on Fable 5, and highly agentic workloads up to about 45% less.

A few details worth noting:

  • The 5.1 refresh also kept the 1M-token context window with up to 128K output tokens, added mid-conversation effort adjustment, and introduced invisible watermarking of generated text with a detection API in private preview.
  • Anthropic demonstrated agent runs of up to 38 hours unattended on Fable 5.1, and its own benchmark write-up shows steep gains on long-horizon tasks: 52.6% on Terminal-Bench-Science 0.1 (vs. 24.7% for Fable 5) and 55.8% on Terminal-Bench 4.0 (vs. 42.0%), with Anthropic noting a standard error of roughly 3.5–4.5 points on the science benchmark.
  • Despite all of this, Anthropic's guidance is blunt: default to Opus 5 for most workloads and reach for Fable 5.1 only for demanding reasoning and long-horizon agentic tasks. The lab is selling you the cheaper model first.

The net effect is a tiered price ladder that mirrors the safeguard tiers: Opus 5 as the everyday default, Fable 5.1 as the premium public tier for the hardest work, and Mythos 5.1 as the gated tier where price is not the point — trust is.

Why this matters beyond Anthropic#

Three things make the dual-model strategy worth tracking for the rest of the industry.

1. Routing, not refusal, is the new safety paradigm. Instead of blocking sensitive prompts, Fable reroutes them to a weaker model via classifiers. That's a product decision as much as a safety one: the user stays in the product, the refusal rate stays low, and the risky capability stays contained. Expect other labs to copy the "graceful downgrade" pattern.

2. Pricing is now a safety instrument. The cache-read cut does double duty: it makes the guarded public tier cheap enough to displace grey-market or open-weight alternatives for legitimate agentic work, which is a form of safety strategy — users who can afford the safe model don't go looking for unsafe ones. But it also means the safety premium only applies to the sticker, not to the actual workloads the model was built for.

3. The gate is getting more formal, not less. Between Project Glasswing, the Life Sciences Verification Program, the Cyber Verification Program, and Enterprise Frontier Safeguards, Anthropic is building a whole identity-and-monitoring layer for frontier access. The long-term bet is that frontier capability becomes a licensed activity — available to the verified, auditable, and retention-compliant, and mediated by classifiers for everyone else.

The takeaway#

Anthropic's split-the-difference strategy is an honest acknowledgment that capability and access are no longer the same product. Fable gives the public Mythos-level intelligence with training wheels; Mythos gives the vetted few the real thing; and the September repricing quietly made the public tier cheaper precisely where it counts — long-running agents.

The open question is whether the classifier-and-reroute architecture can keep pace with the model's own capabilities. Anthropic admits the safeguards it truly wants don't exist yet. Until they do, the velvet rope is the product — and the safety premium is the price of standing on the right side of it.