Claude Fable 5.1 may now hunt for vulnerabilities, but not exploit them. And the price cut is one cell in a table.

Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 today. Most of the coverage will be about benchmarks and about the price falling roughly 25%. Two other things in the announcement matter more to anyone responsible for security, and neither is being reported.

The first is a sentence about safeguards. The second is that the price did not fall in the way the headline suggests, and the pricing table shows exactly why.

The line moved, and Anthropic said so plainly

Here is the sentence, in full: the newest safeguards "block 60% fewer false positives than before. In part, this is because Fable 5.1 can now be used to discover software vulnerabilities, though not to develop exploits for them."

That is a vendor publishing a deliberate relaxation of a security control, with the measured effect attached and the new boundary named. It deserves credit for being said out loud, and it deserves to be read carefully.

The change itself is defensible and the argument for it is strong. A model that refuses to look at a crash dump, a stack trace or a suspicious binary is useless to precisely the people who most need it, and false positives were the price of the old setting. Cutting them by 60% is a real improvement in a real workflow. Defenders spend their days handling material that looks, to a naive classifier, exactly like attacker material, because it is attacker material.

What is worth carrying away is structural rather than critical.

The capability is not in the safeguard

Anthropic states that Fable 5.1 and Mythos 5.1 are the same model, differing only in the level of safeguards applied. It then reports that it evaluated the cyber capabilities of Mythos 5.1 "with cybersecurity safeguards off", and that the model "demonstrates the strongest cyber capabilities of any model we've released", while still falling within the lower risk category of its own Frontier Compliance Framework.

Put those two statements together and the architecture is clear. The thing that separates a general user from the strongest offensive-security capability Anthropic has shipped is a safeguard layer sitting in front of a model that already has it. That is a policy control, not a capability control, and a policy control is a thing that gets tuned. It has just been tuned.

This is not a criticism of the design. It is arguably the only workable design: you cannot train a model that can find vulnerabilities for defenders and cannot find them for attackers, because it is the same task. But it should change how a security team thinks about the assurance on offer. The assurance is about a classifier's behaviour, not about what the model can do.

Anthropic is careful about the assurance too, and the carefulness is worth noticing. It commissioned external testing of the Fable 5.1 cybersecurity safeguards from two organisations, added automated testing by Gray Swan, and reports that it has "not found evidence of a critical-severity jailbreak for these safeguards". Not having found evidence of one is a narrower claim than there not being one. The announcement makes the narrow claim, correctly, and a reader should quote it the same way.

Mythos 5.1, the version with the safeguards configured for cyber and life sciences work, is available only through trusted access programs. Currently that means "only a set of US organizations", with Anthropic saying it is coordinating with the US government to widen access to more domestic and international partners. So the frontier cyber capability is gated by vetting and by nationality, not by the weights. For a British or European defender, that is the operative fact in the whole release.

The model underneath that safeguard

A relaxed control on a weak model is a footnote. On the strongest model a vendor has shipped, it is a decision. So it is worth putting Anthropic's own capability numbers next to it, with one caveat stated up front: every figure below is Anthropic's, including the column for the competitor.

Anthropic's own numbers, and Anthropic chose the comparison

What it measures	Fable 5.1	Fable 5	Opus 5	GPT-5.6 Sol
Agentic scientific research, Terminal-Bench-Science 0.1	52.6%	24.7%	29.0%	22.4%
Agentic coding, Terminal-Bench 4.0	55.8%, and 60.9% for Mythos 5.1	42.0%	52.3%	37.3%
Knowledge work, GDPval-AA v2	1853	1723	1824	1711
Computer use, OSWorld 2.0, partial credit	77.9%	72.9%	75.4%	not reported
Computer use, OSWorld 2.0, strict	41.7%	36.1%	39.6%	not reported
Multidisciplinary reasoning, Humanity’s Last Exam, no tools	60.9%	57.8%	56.6%	not reported
Business workflows, AutomationBench	31.4%	17.1%	26.9%	19.6%
Agentic coding, CursorBench 3.2.0	73.4%	70.5%	70.0%	67.2%

Two rows in that table deserve more attention than the headline.

The first is the science row. Within the Fable line, Terminal-Bench-Science moves from 24.7% to 52.6%, which is more than a doubling rather than an increment, and it beats Opus 5's 29.0% by a wide margin. It is also the row that sits closest to the safeguard that was relaxed. A model that is substantially better at agentic scientific work is also a model that is substantially better at reading a crash dump.

The second is that OSWorld appears twice. The same model on the same benchmark scores 77.9% under partial credit and 41.7% under strict. Anthropic publishes both, which is to its credit. But the number that will travel is the first one, and it is nearly double the second. Whenever you see a computer-use figure quoted without its scoring mode, that is the missing half.

Anthropic also published a demonstration rather than a benchmark for the science claim, and it is worth watching for what it does not assert.

Claude designs proteins that bind in the labClaude · Click to load. Nothing from YouTube loads until you do.

Nothing loads from YouTube until you press play. The claim in it is narrower than a benchmark row and stronger in one respect: the verification happened at a bench rather than in a scoring harness. It is also, unavoidably, a vendor demonstration of its own model, chosen by the vendor from the results it obtained.

The price did not fall. One line item did.

Now the money, because the reporting on this is going to be wrong in a way that matters to anyone writing a budget.

One cell changed, and it is the whole price cut

Fable 5.1 costs $10 per million input tokens and $50 per million output tokens. So did Fable 5. The five-minute cache write is $12.50 in both. The one-hour cache write is $20 in both. Every published rate is identical, to the cent, except one: a cache read fell from $1.00 to $0.25.

That single change is the entire "25% cheaper" headline, and it makes the saving a fact about your workload rather than about the model.

The arithmetic is straightforward and Anthropic supplies both ends of it without joining them. A cache read fell 75%. If a typical bill falls 25%, then cache reads must have been a third of that bill. If a highly agentic bill falls 45%, cache reads were 60% of it. Generalise and you get a line any team can apply to its own console figures:

Your saving equals 0.75 multiplied by the share of your bill that is cache reads.

If your work is short, varied and low-context, your cache-read share is small and you will see very little of the 25%. If you run long agentic sessions over a large codebase, you may see more than 45%. The averages in the announcement are measured "at default effort over four weeks of actual usage in August 2026", which is a genuinely useful disclosure and also, necessarily, somebody else's four weeks.

There is a caveat in the announcement that cuts the other way, and it is easy to miss. Fable 5.1 defaults to High effort in Claude Code, and to Medium in Claude Cowork and on Claude.ai. A higher effort setting means more tokens. A team measuring its bill after the upgrade is measuring two changes at once, and only one of them is a reduction.

The pricing footnote nobody has picked up

There is one more thing in the pricing documentation that did not make the announcement. Anthropic publishes a general rule for what a cache hit costs: 0.1 times the base input price. That rule now carries a parenthetical exception. It reads: "0.1x base input price (0.025x on Claude Fable 5.1 and Claude Mythos 5.1)".

Fable 5.1 and Mythos 5.1 are the only models in the table not priced on the standard multiplier, and since Mythos is available to almost nobody, Fable 5.1 is the one most readers will meet. The consequence is a genuine oddity. Fable 5.1 input costs $10 per million tokens against Opus 5's $5, and its output costs $50 against $25. On both of those it is exactly twice the price. But its cache reads cost $0.25 against Opus 5's $0.50, which is half.

For a workload dominated by cache reads, and Anthropic's own figure says an agentic workload is 60% cache reads, the relative economics of the two models are no longer what the headline rates imply. That is worth modelling before assuming the cheaper-looking model is the cheaper one.

The footnote under the table, which changes what some of it measures

Beneath the benchmark chart, in smaller type, Anthropic prints this:

"Fable 5.1 was evaluated with its production safeguards enabled. On tasks where these safeguards intervened, Fable 5.1 and Fable 5 scored a zero on OSWorld 2.0, and Fable 5 scored a zero on AutomationBench. In all other interventions from our safeguards, cybersecurity tasks were completed by Claude Opus 4.8, and biology tasks were completed by Claude Opus 5. This likely reduces the performance of Fable 5.1 and Fable 5 on these benchmarks."

Two different things are happening in those four sentences, and only one of them is generous to Anthropic.

The first is a floor, and it is to their credit. Where a safeguard blocked a task on OSWorld 2.0, the model was scored zero rather than excused. The published figure is therefore a lower bound on capability, measured with the product's real controls in place. Most vendors would have run it with the safeguards off and quietly reported the larger number, which is exactly what makes the OpenAI comparison in the row above interesting.

The second is harder. On every other benchmark where a safeguard intervened, the task was completed by a different model: Claude Opus 4.8 for cybersecurity tasks and Claude Opus 5 for biology tasks. Those completions sit inside Fable 5.1's column.

So on some subset of the science and coding rows, an unstated number of tasks were finished by something other than the model named at the top of that column. Anthropic does not say how many, and without that number nobody outside the company can tell whether it is a rounding detail or a material contribution to the row that moved most.

This is disclosed rather than hidden, and it deserves credit for being printed at all. It is also printed under a chart, in the smallest type on the page, which is a reasonable prediction about how many people will read it.

What the announcement does not cover

Two absences are worth stating, because both will be filled in by guesswork otherwise.

Nothing in the announcement concerns subscription plans. Every price in it is per token, framed as applying "wherever usage is billed by token, such as on our API". Pro and Max are not mentioned, and no statement is made about how Fable 5.1 is metered inside a subscription. A 25% reduction in token-billed cost does not translate mechanically into a subscription allowance, and anyone reporting that it does is going beyond the source.

And Enterprise Frontier Safeguards, the new data-retention arrangement, is not available yet. Anthropic describes it as storing data in cloud infrastructure controlled entirely by the customer rather than by Anthropic, giving "complete privacy (the same as a zero data retention policy)". It is to be made available to enterprise customers "in phases, beginning later this fall". Until then, eligible customers can use Fable 5.1 with conventional zero data retention. It is a commitment with a rough date, not a control you can procure today.

What is stated, and what is not settled

The claim	What is actually stated	What it does not settle
Roughly 25% cheaper	Cache reads fell 75%, to $0.25 per million tokens. Every other published rate is unchanged.	Your own saving, which is 0.75 times your cache-read share. Nothing here is a discount on input or output.
Vulnerability discovery is now allowed	Fable 5.1 “can now be used to discover software vulnerabilities, though not to develop exploits for them”.	Where the boundary sits in practice, how it is enforced, or what happens to a request that sits between the two.
The safeguards are robust	External testing by two organisations plus Gray Swan; Anthropic has “not found evidence of a critical-severity jailbreak”.	Whether one exists. The claim made is about what testing found, and it is the correct form of the claim.
Complete privacy with EFS	Data stored in cloud infrastructure controlled by the customer, equivalent to zero data retention.	Availability. It arrives for enterprise customers in phases “beginning later this fall”, so it is not procurable now.
Frontier cyber capability for defenders	Mythos 5.1 is available through trusted access, currently to “a set of US organizations”.	Access outside the United States, which Anthropic says it is coordinating with the US government to widen.

What to do about it