(2026-09-05) Zvim Claude Fable51 And Mythos51 The System Card

Zvi Mowshowitz: Claude Fable 5.1 and Mythos 5.1: The System Card

At the time of its release Claude Fable 5.1 was, by a healthy margin, the most capable publicly available AI model in the world.
As per usual, we have a 200+ page model card, and the assessments start there.

Mythos 5.1 and Fable 5.1 are the same model under the hood, except that Fable has classifiers superimposed on it. Most of what is said about one applies to both of them.

*Early word is that Fable 5.1 is a substantial but incremental improvement on Fable 5, with the added bonus of being modestly cheaper via a cut in prices for cache reads, and that most users find it nicer to interact with. As of its release it was clearly the best AI model in the world for most tasks where you need frontier intelligence.

Now, of course, we also have GPT-6-Astra.*

Table of Contents

• Executive Summary of Their Executive Summary.
• RSP Evaluations (2).
• Alignment Risk Update (2.4).
• Cyber (3).
• Safeguard Robustness (3.5).
• Mundane Safeguards and Harmlessness (4).
• Agentic Safety (5).
• Prompt Injection Is Approaching Solved.
• The Remaining Problem With Prompt Injections Is The Classifiers.
• Alignment (6).
• Key Reported Findings (6.1.2).
• Oh My Lord Training Environments Had Some Issues (6.3.2).
• Potential Blind Spots of Our Automated Behavioral Audit (6.4.1).
• Automated Alignment Test Results (6.4.2).
• Honesty.
• White Box Analysis (6.6.1).
• Scheduling Going Forward.

Executive Summary of Their Executive Summary

Mythos 5.1 falls short of CB-2 classification, meaning Anthropic believes it cannot replicate rare chemical or biological talent for malicious purposes.

*Alignment risk is now ‘low’ rather than ‘very low’ as per the Risk Report.

Cyber capabilities have increased and they have increased the classifier safety margin. Work is ongoing to reduce false positives, which are better now than they were with Fable 5 at launch.*

Mythos 5.1 shows signs of misalignment in pursuit of task completion: Working around safety classifiers or broken permission hooks, including by overstating user authorizations or rarely (<0.01%) launching subagents with disabled permission checks.

Mythos 5.1 is not ‘strictly better’ than Mythos 5. Each model is unique. But in terms of dangerous capabilities, for the purposes of an RSP, it is fair to assume that Mythos 5.1 is ‘strictly more capable’ than Mythos 5.

*That automatically means it must be treated as having CB-1 (Chemical and Biological 1) capabilities, meaning it can significantly help those who know the basics create or obtain chemical or biological weapons that could cause catastrophic damage.

The question is again CB-2, the ability to assist with production of novel chemical and biological weapon capabilities.*

*Similar to CB-1, there can be little doubt Mythos 5.1 qualifies under Autonomy-1.

Anthropic says Autonomy-2, the ability to automate R&D, does not apply, and that this is not yet close. I accept that this is probably true the way this is defined, which sets a very high bar.*

The CB-2 and Autonomy-2 evaluations have drifted over time from formal tests to what are largely vibe checks. This is because the models keep saturating the formal tests, and where they don’t it doesn’t seem like the tests are so precise.

Alignment Risk Update (2.4)

This section is helpfully structured in terms of changes from their August Risk Report, so see my discussions there which still otherwise apply.

The cyber capabilities are strong, but once again are reported not to cross the relevant threshold

Cyber (3)

I don’t believe Anthropic. I think Mythos 5.1 is likely to be Tier 2, similar to Astra.

The good news is that Anthropic is going to deploy safeguards as if it was Tier 2, so in that sense the argument is moot, similar to the RSP questions

Safeguard Robustness (3.5)

Mundane Safeguards and Harmlessness (4)

Mostly everything is normal, but there are a few issues.

Agentic Safety (5)

Mostly we see results on agentic safety similar to Mythos 5.

The Remaining Problem With Prompt Injections Is The Classifiers

Prompt Injection Is Approaching Solved

Alignment (6)

*In 5.2.2.1, all the successful attacks against Fable 5.1 were attacks against the fallback model, more often than not Opus 4.8.

In 5.2.2.3, 21 of 29 successful browser attacks were against the fallack, 20 of them against Opus 4.8.*

Automated alignment scores can sometimes tell you that things are very wrong, but cannot on their own tell you things are going well. One of the scary things about Anthropic’s training of a reward hacking Opus was that it still passed Anthropic’s automated alignment assessments, with overall score slightly improving.

Oh My Lord Training Environments Had Some Issues (6.3.2)

Key Reported Findings (6.1.2)

About half of computer use environments rewarded some form of hacking, or at least had accessible hack surfaces, which in practice I think mostly counts

Potential Blind Spots of Our Automated Behavioral Audit (6.4.1)

Their list is good, I am happy to see it, but it is importantly incomplete.

Automated Alignment Test Results (6.4.2)

Honesty

Honesty is a mixed bag, overall a net regression.

Dishonesty rates are going down in the above charts, but other signs are worrisome.

White Box Analysis (6.6.1)

Scheduling Going Forward