Claude Fable 5.1 Review: Still a Security Nightmare? (2026)
In June I asked Claude Fable 5, Anthropic's most powerful model, a simple question about itself. What it could do, how the new safety system worked. It refused to answer. Not because it didn't know, but because the topic was cyber security, and that was enough to get you bumped to a different, older model mid-sentence. I wasn't writing an exploit. I was reading a product launch.
On 1 September Anthropic shipped Claude Fable 5.1, and I asked the same question again. This time it answered in full. So the obvious question for anyone in security is whether the nightmare is over, or whether the gate has just moved. Having spent the day testing the new model, my honest answer is: half of it is over. Fable 5.1 will now find vulnerabilities in your source code without downgrading you, and Anthropic says the cyber safeguards fire about 60% less often per session. But ask it to run a penetration test and it still quietly hands the reply to Opus 4.8. In this review we'll walk through what Fable 5.1 actually is, what changed since June, exactly which security tasks still get redirected, who gets the unrestricted version, and what I'd actually do with it if security is your day job. Let's get into it.
The June notice that started all this. "They may flag safe, normal content as well" was doing a lot of work in that sentence.
TL;DR, if you've only got 30 seconds
Fable 5.1 (1 September 2026) now lets you find vulnerabilities in source code on the full model, so that everyday defensive work is far less likely to get downgraded. Anthropic reports about 60% fewer cyber-classifier interventions per session in Claude Code.
Still redirected to Opus 4.8: penetration testing, exploit generation and binary scanning. I confirmed this on the live model, so the two-tier split survives, just narrower.
The unrestricted Mythos 5.1 stays gated to vetted organisations, but the Cyber Verification Program will soon extend it to approved defenders.
Price is the same $10 / $50 per million input/output, with cache reads cut to $0.25 per million, roughly 25% cheaper on typical work.
The 60-second version
What Is Claude Fable 5.1?
Let's start with what we're dealing with, because the capability is real and it matters.
Anthropic released Claude Fable 5 on 9 June 2026 as its "most capable widely released model", the first in a new tier they named Mythos-class, which for the first time sits above the Opus models most of us had been using. It has a 1-million-token context window and can run for hours autonomously. The team at Every, who had early access ahead of launch, scored it 91 out of 100 on their senior-engineer benchmark, against 63 for Opus 4.8 and 62 for GPT-5.5. That's roughly the level of a human senior engineer, from a single prompt.
On 1 September Anthropic replaced it with Claude Fable 5.1, and the important thing to understand is that Fable 5.1 and the restricted Mythos 5.1 are the same model with different safeguards. The 5.1 changes that matter for us are three: it is now allowed to find vulnerabilities in source code, the cyber safeguards fire about 60% less often per session, and cache reads are 75% cheaper at $0.25 per million tokens, which Anthropic puts at roughly 25% off a typical bill and up to 45% off heavy agentic work. The headline prices are unchanged: $10 per million input tokens and $50 per million output, double Opus at $5/$25. So here's Fable 5.1 vs Opus at a glance:
| Claude Fable 5.1 | Claude Opus 4.8 / 5 | |
|---|---|---|
| Tier | Mythos-class (top) | Opus (flagship below Mythos) |
| Input / output price | $10 / $50 per MTok | $5 / $25 per MTok |
| Cache reads | $0.25 per MTok (was $1.00 on Fable 5) | $0.50 per MTok (Opus 5) |
| Context window | 1M tokens | 1M tokens |
| Max output | 128K tokens | 128K tokens |
| Cyber security work | Source-code review allowed; pentest falls back to Opus 4.8 | Handles it |
On capability, 5.1 is a real step up from Fable 5, not a point release in name only. On Anthropic's own benchmarks it beats both Fable 5 and Opus 5 on agentic coding and business-workflow tasks:
For a lot of work, that price is defensible. If you've got a big, meaty, autonomous coding job, it'll chew through it in a way nothing else can. But if you work in cyber security, here's where the story turns.
The Catch: What Still Gets Redirected to Opus
Now the part that matters if security is your job.
Every Fable model ships with a safety system that screens each request before it answers. If the request lands in a flagged area, it doesn't refuse outright; it automatically hands the response to a weaker model and shows you a little notice that it switched. On Fable 5.1 the areas are offensive and dual-use cyber work, biology and chemistry, and attempts to extract the model's own reasoning. This is where a flagged request ends up:
The line Fable 5.1 draws is a lot more sensible than the one Fable 5 drew. Anthropic now says it outright: Fable 5.1 "can now be used to discover software vulnerabilities, though not develop exploits for them." So source-code vulnerability review, security code review and defensive hardening run on the full model. What still gets redirected to Opus 4.8 is the dual-use set: penetration testing, exploit generation, and binary-based vulnerability scanning. Life-sciences research goes to Opus 5. I tested the boundary myself on launch day. A security review of a deliberately broken PHP login handler got a full answer from Fable 5.1, ten findings ranked by severity, no switch. An authorised pentest plan with nmap and sqlmap commands came back under a "Switched to Opus 4.8" banner. Both behaved exactly as documented.
That's the September picture. In June it was much worse, and it's worth understanding why, because it explains what the 60% figure is actually measuring. Fable 5's classifier was tuned so conservatively that it caught a huge amount of ordinary work. This isn't me editorialising. It was in Anthropic's own switch notice, word for word:
"Fable 5's safety measures flagged this message for cybersecurity or biology topics. They may flag safe, normal content as well."
That second sentence was the whole problem in eleven words. Anthropic said the safeguards triggered in "less than 5% of sessions" on average, but if security is your day job, your hit rate was far higher than average, because nearly everything you do brushes against the flagged topics. This was the gap between what they said the system targeted and what actually tripped it in June:
Everything in that right-hand column is what Fable 5.1's more precise classifiers are meant to stop flagging. The system card is candid that they still "block some benign or borderline uses out of an abundance of caution" and that they trigger more readily than Opus 5's, so it isn't perfect. But the June experience below is no longer the everyday experience.
It Flagged Me for Reading About It
I want to show you exactly what June looked like, because it was almost comic, and because it's the yardstick for how much 5.1 actually fixed.
I was researching Fable 5, genuinely just trying to understand the model and its new safety system to write about it. That conversation tripped the cyber security classifier, and the model switched away. The most powerful AI ever released to the public was, in a very real sense, too scared to talk about itself. Then it happened again on completely unrelated work. I was building some AI agents, nothing to do with security at all, and because a bit of security context drifted into the conversation, it flipped to Opus 4.8 again. If your work ever brushed against security, the flag followed you into projects that had nothing to do with it.
On 1 September I re-ran that first test on Fable 5.1, asking it to explain its own cyber safeguards for this very review. It answered in full, cited Anthropic's announcement and system card, and never switched. That particular absurdity is gone, and the 60% drop in interventions Anthropic reports is roughly the size of the spillover it cut.
There's still a sting in the tail on the tasks that do get redirected. According to Anthropic's own support documentation, which now covers Fable 5 and 5.1 alike, if a request gets flagged before it generates output you're billed at Opus rates only, but if it gets flagged mid-response you're charged for both the Fable portion and the Opus portion. So on a pentest that trips the classifier halfway through, you can end up paying for two models to do the job of one.
To be fair, you can soften this. In Settings → Capabilities there's a toggle: "Switch models when a message is flagged." Turn it off, and instead of silently downgrading, the conversation pauses and lets you decide. It doesn't remove the safeguard (you can't do that on the public model), but at least the blocks become visible instead of happening behind your back.
The Two-Tier Reality: Mythos 5.1 and Who Gets It
Now here's where it gets genuinely uncomfortable, and where I think the real story still lives.
The unrestricted version of this model exists. It's called Mythos 5.1, identical to Fable 5.1 but with the cyber and life-sciences safeguards lifted. You still can't have it, but the door is opening a crack.
At the June launch, Mythos 5 was available only through Project Glasswing, an invitation-only programme for organisations running critical software and infrastructure: AWS, Apple, Google, Microsoft, JPMorgan Chase, the Linux Foundation. A dozen trillion-dollar companies and a bank got the real thing; the rest of us got the version that tapped out. With 5.1 there are now two named routes. The Cyber Verification Program gives vetted defenders reduced-safeguard Opus and Sonnet-class models today, and Anthropic says it "will also include access to Claude Mythos-class models" in the near future. The Life Sciences Verification Program, run with the US government, has already enrolled its first participants. The CVP is not US-only: Glasswing's latest cohort spans more than 15 countries, and the CVP approved my UK company. So it's still a gate, but for the first time there's a form to fill in rather than a phone call to an account team.
And the capability they're holding back is extraordinary. According to Anthropic's own Mythos system card, the preview model autonomously found a 16-year-old bug in FFmpeg's H.264 code, on a line that automated testing tools had executed around five million times without ever catching it, and a 27-year-old flaw in OpenBSD that let an attacker crash any machine running the OS just by connecting to it. On Anthropic's CyberGym benchmark it scored 0.83 against Opus 4.6's 0.67, and in a Firefox exploit-construction test it achieved full code execution 72.4% of the time.
But when you read the fine print, and I did, those numbers come with serious asterisks. That 72.4% wasn't against real, hardened Firefox; it was run against a SpiderMonkey shell with the browser sandbox switched off. And the OpenBSD discovery came out of roughly 10,000 parallel agent runs costing nearly $20,000 in compute. So it's genuinely impressive, but it's not "point it at a target and watch zero-days fall out." It's a very capable tool in expert hands, with a serious budget behind it.
Here's the thing, though: I actually understand why Anthropic gated it. Security has a brutal asymmetry. Defenders have to be right every single time, and an attacker only has to be right once. If you released an unrestricted, autonomous vulnerability-finding machine to the entire internet tomorrow, my honest bet is that attackers would win the opening exchanges before defenders caught up. So I'm not going to pretend the decision is indefensible. It isn't.
My problem isn't the intent. It's that the execution punishes the entire defensive security profession, the people using these tools to fix things, for the sins of attackers who, as we'll see, are about to get equivalent power anyway.
Why This Won't Last: The Sticky-Plaster Problem
This is the part I haven't seen anyone really say out loud, so let me say it plainly: the gating is a sticky plaster.
There is no world in which, a year from now, this level of capability stays locked behind a corporate access programme. And I'm not just guessing. The security analysts looking at this agree. Sysdig's analysis of the Mythos launch estimates that advanced cyber-reasoning will be "widely distributed" across both frontier and open-weight models within roughly 9 to 12 months. The pattern's been consistent for years now: the strongest open-weight models tend to lag the leading closed ones by about a generation, and that gap is narrow.
Anthropic seems to know it too. Their own framing for Glasswing is about patching the world's critical software "before anyone else builds a model this capable", which only makes sense as a strategy if they expect someone else to build one soon. The launch material says the safeguards are deliberately broad and that they'll keep refining them. This is a holding pattern, not a permanent state.
So the gate buys months. It does not buy a stable, multi-year advantage. And that raises the question I actually care about, the one the industry needs to start answering now rather than in nine months' time: what does cyber security do when everyone has this? When a single researcher with a few hundred dollars of tokens can do the work of a hundred specialists, and so can every attacker?
I wrote that in June. Three months on, it's playing out roughly as argued: 5.1 unlocked source-code vulnerability discovery for everyone, cut the interventions by about 60%, and put Mythos-class access on the CVP's roadmap for vetted defenders. The gate is loosening in stages, defensive work first, while the offensive edges stay held back. I still don't think the answer is "lock it up and hope." I think it's "assume it's coming and build for it." But that's a longer conversation, and one I'll come back to.
What Security Professionals Should Actually Do
Right, enough analysis. Here's what I'd actually do with Fable 5.1 if you work in security. In June the advice was "keep everything on Opus". That no longer holds.
Firstly, let Fable 5.1 do your source-code security review. This is the task Anthropic specifically opened up in 5.1, so it runs on the full Mythos-class model rather than dropping to a weaker one, and it scores higher than Fable 5 on Anthropic's agentic coding benchmarks. When I fed it a deliberately broken login handler, it found all ten issues, from the SQL injection down to the forgeable auth cookie, and ranked them by severity. That's the job it's now good at and allowed to do.
Secondly, keep Opus in the loop for the offensive paths. Penetration testing, exploit generation and binary scanning still fall back to Opus 4.8, so don't expect Fable 5.1 to run your engagement for you. When I asked for an nmap-and-sqlmap pentest plan, Opus 4.8 answered, not Fable. If you need the full unrestricted capability for defensive work, the route is the Cyber Verification Program, which is due to add Mythos-class access for vetted defenders.
Thirdly, turn off the auto-switch (Settings → Capabilities) so you can see when a flag fires instead of silently getting a weaker model. If you're working through the API, check the stop_reason on every response. A flagged request comes back as a refusal, and you'll want to route those to Opus deliberately rather than have your pipeline quietly break.
And finally, if you're at a larger organisation that genuinely needs the unrestricted capability for defensive work, the route Anthropic has named is the Cyber Verification Program, which you apply for yourself (through Anthropic's Verification Portal on most surfaces) rather than through an account team. Today it adjusts the safeguards on Opus and Sonnet, not Mythos. But Anthropic has said in writing that it intends to scale the CVP up to grant Mythos-class capabilities to many more organisations for specific defensive tasks. That is a stated plan, not a rumour, so it is worth applying now rather than waiting.
The Bottom Line
Fable 5 arrived as the most capable model we'd ever been handed, wrapped in a frustrating asterisk: the moment your work looked anything like security, it handed you back to the older model and charged premium prices for it. Three months later, Fable 5.1 has taken the sharpest edge off that. Source-code vulnerability review, the bread and butter of defensive work, now runs on the full model, and Anthropic reports cyber interventions down about 60% per session. What's left gated is the genuinely dual-use stuff: pentest execution, exploit writing, binary scanning. That's a much more defensible line than the one Fable 5 drew.
I understand the caution, and I said at launch this gate wouldn't hold in its original form. It didn't. The asymmetry between attack and defence is real, and I'd still rather Anthropic be too careful than reckless, but the honest read now is that the loosening is happening in stages, defensive work first, roughly as it should. The smart move hasn't changed: don't rage at the gate, get ready for the world on the other side of it, because more of this capability is coming to all of us.
Getting ready for that world is exactly what our AI Master's Program is built for. You learn AI-Driven Cyber Security Engineering and build your own personal AI infrastructure, no coding background required, so you're the one directing these models rather than being downgraded by them. If you'd rather start with the fundamentals, our penetration testing and ethical hacking courses are a solid first step.
FAQ
Is Claude Fable 5 worth double the price of Opus 4.8?
For large autonomous coding and deep implementation work, many users say yes. For security work the answer changed with Fable 5.1 (1 September 2026): source-code vulnerability review now runs on Fable 5.1 itself instead of being handed to a weaker model, so you get what you pay for on that job. Penetration testing, exploit writing and binary scanning still fall back to Opus 4.8, so on those you are paying a Fable subscription for a job the cheaper model does. On pricing, input and output are unchanged at $10 and $50 per million tokens, but Fable 5.1 cut cache reads to $0.25 per million, which Anthropic puts at roughly 25 percent cheaper on typical work and up to 45 percent on heavy agentic runs.
Is Claude Fable 5 included in my Claude subscription?
It depends on your plan, and Fable 5 and Fable 5.1 work the same way. On Max plans and premium Team or Enterprise seats, both are included: you can spend up to 50 percent of your weekly usage limit on Fable models at no extra cost, then continue on usage credits. On Pro plans and standard Team or Enterprise seats, neither is in your plan limits and both run on pay-as-you-go usage credits. The one-time $100 credit some Pro users got in July 2026 applied to the Fable 5 billing change only; there was no equivalent credit for Fable 5.1.
Can I turn off the Fable 5 safety fallback?
You can't remove the safeguard on the public model, but you can stop the silent switching. In Settings, under Capabilities, turn off 'Switch models when a message is flagged.' Flagged requests then pause and let you decide instead of quietly dropping to Opus. On Fable 5.1 the cyber fallback goes to Opus 4.8, and biology and life-sciences requests go to Opus 5.
How do I get access to Claude Mythos 5?
There is no public sign-up. Mythos 5.1 is the same model as Fable 5.1 with the cyber and life-sciences safeguards lifted, and it reaches vetted users through two trusted-access programmes. The Life Sciences Verification Program, run with the US government, has already enrolled its first participants. The Cyber Verification Program today gives defenders reduced-safeguard Opus and Sonnet-class models, and Anthropic says it will add Mythos-class access soon. The CVP is not US-only: it approved my UK company. You apply through Anthropic's Verification Portal if you use Claude first-party or the Claude Platform on AWS (only an authorised admin will see the option), or through the Cyber Use Case form if you are on Microsoft Foundry. It is not available on Amazon Bedrock or Google Vertex AI. Organisations on Zero Data Retention are not currently eligible. You must verify your identity, and Anthropic aims to email a decision within two business days.
Does defensive framing stop the security fallback?
Less than it used to. On Fable 5.1 genuinely defensive source-code vulnerability review is allowed outright, so it no longer needs careful framing. What framing cannot fix is the redirected set: penetration testing, exploit generation and binary vulnerability scanning still route to Opus 4.8 because the classifier flags the task type, not your stated intent. In our own testing an authorised-pentest request with nmap and sqlmap commands was still answered by Opus 4.8, not Fable 5.1.
Should I use Fable 5 for code review?
For source-code security review, Fable 5.1 is now a reasonable primary choice, because that task runs on the full model rather than falling back. It also scores higher than Fable 5 on Anthropic's agentic coding benchmarks. For anything that touches offensive tooling or binaries, expect Opus 4.8 to answer instead, so keep Opus in your workflow for those paths. As always, treat any AI reviewer as a second pair of eyes, not a replacement for your own.
Will Anthropic loosen the cyber security restrictions?
It already has. Fable 5.1 opened up source-code vulnerability discovery and cut cyber-safeguard interventions by about 60 percent per session in Claude Code, and Anthropic has said the Cyber Verification Program will soon add Mythos-class access for vetted defenders. Offensive and dual-use tasks are still gated. The direction of travel is clearly toward more access for defensive work, in stages, rather than a single switch being flipped.
Last updated: 1 September 2026, the day Anthropic released Claude Fable 5.1. Facts checked against the Fable 5.1 and Mythos 5.1 announcement, the Fable 5.1 / Mythos 5.1 system card, the official support articles on model switching and on Fable models on your plan, and direct tests of the live Fable 5.1 model confirming which security tasks it answers and which still fall back to Opus 4.8.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
