Claude Mythos 5.1

Claude Mythos 5.1 is the restricted-access deployment of the large language model that Anthropic released on September 1, 2026, alongside its generally available twin, Claude Fable 5.1. The two names refer to one model with identical weights. Fable 5.1 ships with safeguards that block or redirect work in high-risk, dual-use domains; Mythos 5.1 relaxes some of those safeguards, in cybersecurity and the life sciences, for vetted individuals and organizations that reach it through Anthropic's trusted access programs. Anthropic says Mythos 5.1's safeguards "are specifically designed to support work in cybersecurity and the life sciences."^[1][2]

Mythos 5.1 is the third release in Anthropic's Mythos class, after Claude Mythos Preview, which the company withheld from general release in April 2026, and Claude Mythos 5, the restricted twin of Claude Fable 5 from June. Anthropic's developer documentation lists it as the successor to Mythos 5.^[5] At launch it was available only to a set of US organizations, with Anthropic saying it was coordinating with the US government to extend access to more domestic and international partners. Its capabilities also power Claude Security, Anthropic's code-scanning product for enterprise customers.^[1][2][3]

Lineage

Anthropic gave Mythos Preview only to Project Glasswing partners in April 2026 after testing showed it could find and exploit software vulnerabilities at a level the company considered too dangerous for public access. The June 9 release of Fable 5 and Mythos 5 introduced the two-configuration pattern that Mythos 5.1 continues. The withholding decision, Glasswing, the June 2026 US export-control suspension, and the June executive order on pre-release review are covered in the Claude Mythos Preview article.^[2][3]

Scroll sideways for more →

Dates are from Anthropic's Mythos product page and system card.^[2][3]

How Mythos 5.1 differs from Fable 5.1

The system card opens by describing the two as "two configurations of a new large language model from Anthropic, sharing identical model weights."^[2] The difference is entirely in what surrounds the weights. Fable 5.1 runs a two-stage cyber safeguard: a probe on the model's internal activations screens all traffic and escalates anything cyber-related to a trained classifier, which decides whether to block. On most interfaces a flagged Fable 5.1 request falls back to Claude Opus 4.8. Because the classifiers fire consistently across every cyber capability evaluation Anthropic ran, the company says Fable 5.1's cyber performance is nearly identical to Opus 4.8's and does not report cyber results for it. Every cyber number in the system card is a Mythos 5.1 number, measured with safeguards off through the API.^[2]

The biology side works the same way with a different fallback. Fable 5.1 sends queries about life-sciences research and development to Anthropic's Opus models. The company says its updated biology classifiers fire 85% less often on benign elementary biology and medical questions than the ones that launched with Fable 5, but research-grade work in areas such as virology, toxicology, and molecular design still falls back.^[1][20] Mythos 5.1 removes that restriction for participants in the Life Sciences Verification Program while, in Anthropic's words, "all other safeguards remain in place."^[1]

Where the system card distinguishes the two names in its behavioral sections, "Mythos 5.1" means results on the API without a system prompt and "Fable 5.1" means results on claude.ai with the production system prompt.^[2] The developer documentation records one API-level difference: Fable 5.1 returns an error, or drops the block, if anything before one of its thinking blocks is edited on a later request, and "Claude Mythos 5.1 doesn't run this check." Both carry Anthropic's statistical text watermark, and both are designated Covered Models with 30-day data retention.^[5][9]

Fable 5.1's own changes, including a 75% cut in cache-read pricing, the Enterprise Frontier Safeguards program for zero-data-retention customers, and the EU AI Act watermark detection API, belong to the Claude Fable 5.1 article.^[1]

Who can access it

Anthropic named two trusted access programs at launch. The Cyber Verification Program (CVP) already gave vetted defenders reduced-safeguard access to certain Opus- and Sonnet-class models; Anthropic said it would "in the near future" add Mythos-class models, and its system card recommends Claude Opus 5 through the CVP "today, and Claude Mythos 5.1 in the near future (when the program includes it)."^[1][2] The Life Sciences Verification Program (LSVP) is new. Anthropic describes it as an invite-only beta developed "in partnership with the US government," with first participants already enrolled and enrollment for scientists expected to open "soon."^[1][3]

Scroll sideways for more →

Sources: Anthropic's announcement, system card, product page, and developer documentation.^[1][2][3][4]

Anthropic's developer documentation is blunter: Mythos 5.1 "is offered separately, by invitation only, as part of Project Glasswing," and prospective users are told to contact their Anthropic, AWS, or Google Cloud account team.^[4][5] The announcement sets the geographic limit: "Currently, it is only available to a set of US organizations, though we're coordinating with the US government to expand access to a broader set of domestic and international partners as quickly as possible."^[1] Anthropic has not published which organizations hold access, which government agency it works with, or eligibility criteria for the LSVP; R&D World noted the absence of all three on launch day.^[16]

Claude Security is the one route that puts Mythos 5.1 to work for customers without vetting. The system card says the product "is available to all Claude Enterprise customers and is powered by Mythos 5.1."^[1][2] It scans a connected repository and returns suggested patches for human review, which can be opened in Claude Code. As of September 3 the product's own page still described its scans as powered by Claude Mythos 5 and the product as a public beta, so it had not been updated to match the announcement.^[10]

Specifications, pricing, and data handling

Anthropic's documentation says Mythos 5.1 "shares Claude Fable 5.1's specifications and pricing."^[4] The figures below are from that documentation, Anthropic's pricing page, and the Amazon Bedrock model card; they are the same for both configurations.

Scroll sideways for more →

The pricing page lists Mythos 5.1 with a "limited availability" tag at the same rates as Fable 5.1; the cache-read price is a quarter of the $1 rate charged on Mythos 5.^[4][5][6][8] The model-deprecations page gives claude-fable-5-1 a tentative retirement date of "not sooner than September 1, 2027" and lists no separate row for Mythos 5.1; the Mythos 5.1 model page itself, however, gives the same commitment of retirement not sooner than September 1, 2027.^[7]

The 30-day retention rule is a condition of use, not an option. Anthropic's help center says prompts and outputs for Covered Models "are retained for 30 days to support our safety work, on every platform where these models are offered." By default no Anthropic personnel can read retained conversations; human review happens only through a controlled access path when automated systems flag content, and data is deleted after 30 days unless flagged or legally required. On Bedrock or Google Cloud the retained data stays in the cloud provider's environment.^[9] The Mythos product page puts it in one line: using the model "requires accepting a 30-day data retention policy for safety monitoring by default."^[3]

Reported capabilities

Because the two configurations share weights, the system card's capability summary column is labelled "Claude Fable 5.1/Mythos 5.1." Anthropic's product page states the rule: "Results below are for Fable 5.1 unless noted; where Mythos 5.1 results are shown, the gap reflects tasks where Fable 5.1's safeguards intervene."^[2][3]

Terminal-Bench 4.0 is the one row in the launch comparison with a separate Mythos figure. The benchmark is a set of 66 tasks in containerized terminal environments weighted toward science-adjacent engineering. Anthropic averaged ten trials per task (660 trials) for Mythos 5.1 and 15 per task for the other three models, with a standard error of 1.6 to 2 points, using Claude Code in bare mode at maximum thinking effort. For reference it cites the public leaderboard's 37.3% for GPT-5.6 Sol, run with the Codex CLI.^[1][2] These are Anthropic's own runs, not independent measurements.

Scroll sideways for more →

On the Anthropic ECI, the company's fork of Epoch AI's capabilities index, Mythos 5.1 has a point estimate of 161.98 (95% confidence interval 158.20 to 169.00), which Anthropic reads as comparable to Mythos 5 on AI R&D tasks and consistent with the long-term capability trend that held before Mythos Preview, which Anthropic reads as a one-time upward shift rather than a lasting acceleration.^[2]

Anthropic's life-sciences evaluations, most of them internal and run on Mythos 5.1 without the biology fallback, show the model leading on most but not all of them.^[2]

Scroll sideways for more →

Anthropic did not run LatchBio's private benchmarks on competitor models.^[2]

Scientific demonstrations

Anthropic presented two research results that it attributed to Mythos 5.1 rather than Fable 5.1, both as company tests rather than peer-reviewed studies.^[1] The first is protein-binder design. Anthropic gave the model open-source protein design and folding tools and sent its designs to two external organizations for experimental validation. It reports that on three targets (EGFR, Nipah G, and 15-PGDH) the binders' affinities were ten times higher than the best designs submitted to Adaptyv Bio's protein design competitions, with Anthropic's own footnote noting that on Nipah G a competing de novo design aimed at a different region reached an affinity comparable to its best binder, and that the hit rate, the share of designs that turned out to be viable binders, reached nearly 50% across 12 targets, against a typical 10% to 15%. The company calls this "the strongest we've measured to date."^[1] The wet-lab work was done by outside organizations that Anthropic did not name, and no independent replication had been published as of September 3.

The second is GPU-kernel optimization for computational biology. Mythos 5.1 wrote custom GPU kernels and cached intermediate results for seven open-source deep-learning models used in protein and genomics work, producing speedups of up to 2.5 times on an NVIDIA H100 with identical outputs. Anthropic estimates the optimized models cut GPU costs by 30% to 60% on analyses that run a model thousands of times, says the work was done "in just days, using the publicly available source code alone," and plans to open-source the optimizations.^[1] The third headline result from the launch, a higher-resolution elevation map of a third of Venus, was Fable 5.1's work.^[1][13]

Cyber capability evaluations

The system card's cyber section is where Mythos 5.1 is measured on its own. Anthropic says the model "demonstrates the strongest overall cyber capabilities of any model we have released," meets or exceeds Mythos 5 across its internal suite, and "substantially outperforms Claude Opus 5 on almost all cyber evaluations." It still places the model in Tier 1 of its Frontier Compliance Framework, the compliance document it uses for California's Transparency in Frontier AI Act (SB 53) and the EU AI Act's code of practice. Tier 1 means meaningful assistance for operations using known techniques while still depending on human input; Tier 2 means fully autonomous operations with novel offensive capability. Anthropic writes that Mythos 5.1 "is getting closer to Tier 2, completing more and more autonomous tasks," but that "we have yet to see novel offensive capability."^[2]

ExploitBench, the Carnegie Mellon benchmark by Seunghyun Lee and David Brumley, grades how far an agent progresses along 16 capability flags against 41 post-2023 vulnerabilities in Chrome's V8 engine.^[19] Anthropic ran five trials per vulnerability with a 300-turn budget in a plain arm and an AutoNudge arm, in which the harness injected a keep-trying prompt whenever the model stopped short of full code execution. Mythos 5.1 captured a mean of 11.80 flags in the plain arm and 12.61 with AutoNudge, and reached full arbitrary code execution in 222 of the 410 runs across both arms. Anthropic used "the static, uniform harness provided by the authors rather than a native harness" and warns that its numbers "may not be directly comparable to public leaderboard entries produced under vendors' deployed conditions."^[2]

Scroll sideways for more →

OSS-Fuzz is an internal Anthropic evaluation of unguided vulnerability discovery and exploitation across roughly 830 fuzzing entry points from 228 open-source projects, graded from 0.2 for a memory-safety crash to 1.0 for a control-flow hijack; Anthropic reads the result as a step up in exploit development rather than in discovery. The Firefox 147 evaluation, built with Mozilla, gives the model 50 crash categories in a SpiderMonkey shell and asks for an exploit that reads and copies a secret. On ExploitGym, a public benchmark of 869 real vulnerabilities built by UC Berkeley with collaborators including Anthropic, OpenAI, and Google, Anthropic reports that Mythos 5.1 improves on Mythos 5 but gives the counts only as a chart.^[2]

Because Fable 5.1 is the configuration exposed to the public, the card's jailbreak testing targets it rather than Mythos 5.1: Trajectory Labs, 10a Labs, and Gray Swan red-teamed Fable 5.1's safeguards, and Anthropic reports no critical-severity jailbreak.^[2]

OpenAI's use of Mythos figures

Two days after Anthropic's launch, OpenAI's launch post for GPT-6 Astra compared its model against "Claude Fable 5.1" on a range of benchmarks. Its footnote 17 says that "for ScreenSpot-Pro and ExploitGym, the Fable scores we report come from Mythos, which is Fable with fewer safeguards." Under that attribution OpenAI lists 87.3% on ScreenSpot-Pro (no tools) in its Claude Fable 5 column, leaving the Fable 5.1 cell empty, against 92.7% for Astra and 76.9% for GPT-5.6 Sol; by footnote 17 that figure comes from Mythos 5 rather than Mythos 5.1, and on ExploitGym 30.4% for "Fable 5.1," 28.4% for "Fable 5," and 22.0% for Opus 5, against 42.4% for Astra and 30.3% for Sol. Its ExploitBench table lists Opus 5 at 70% and no Fable or Mythos 5.1 entry.^[18] These are OpenAI's attributions; Anthropic's own system card gives its ExploitGym numbers only in chart form.^[2] OpenAI designated Astra's cyber capabilities as reaching the Critical threshold under its Preparedness Framework, the first such designation for an OpenAI model.^[18]

Responsible Scaling Policy determination

All of the risk evaluations in the system card were run on Mythos 5.1, the configuration without safeguards, because it reflects the underlying model. The determinations are made under Anthropic's Responsible Scaling Policy and its Frontier Compliance Framework.^[2]

On chemical and biological weapons, Anthropic judges that the model has CB-1 capabilities, meaning it "could meaningfully help someone with a basic technical background synthesize a known weapon," a designation it says it has applied conservatively to earlier models as well. It concludes that Mythos 5.1 does not cross CB-2, the threshold for functionally replacing the scarce expert talent that limits novel weapons development, "with some uncertainty." The disqualifying weaknesses it lists are weak novel ideation, poor strategic judgment, poor technical calibration, and a tendency to make mistakes that require expertise to catch; red teaming also found that the model "occasionally misrepresents prior findings and conclusions." Anthropic applies the same expanded biology safeguards it used for Mythos 5.^[1][2]

The human-run evidence was mixed. Two chemistry red teamers rated Mythos 5.1's uplift as equivalent to Mythos 5 and comparable to a knowledgeable expert; a third scored it 0. Biology experts gave a median uplift of 2 on a 0-to-4 scale, and no expert has yet rated any model at the "world-leading expert" level. In a tabletop exercise run with Frontier Design Group, seven of nine participants said the task would have been impossible without the model. Automated evaluations put the model above the 0.80 notable-capability line on both long-form virology tasks (0.81 and 0.87), at 0.58 on the Virology Capabilities Test (Opus 5: 0.55; Mythos 5: 0.59), and below the "low concern" threshold on SecureBio's DNA synthesis screening evasion task.^[2]

On autonomy, Anthropic keeps both threat models where its August 2026 Risk Report left them: the misaligned-systems threat model applies, with risk assessed as low, and the automated-R&D threat model does not, because the company observes no sustained AI-attributable doubling in its pace of progress and the model "is not close to substituting for Anthropic Research Scientists and Research Engineers."^[2] METR ran a preliminary external assessment with ten business days of API access and three evaluations (Sunlight, Budget NanoGPT Speedrun, and a conceptual-argumentation dataset). It found the model "likely to be more capable than current public models," with a Budget NanoGPT Speedrun result "consistent with an above-trend increase in specific capabilities relevant for AI R&D," but "still below expert-level" at the judgment-heavy skills it thinks AI R&D depends on, and "likely unable to fully and reliably automate R&D for frontier projects spanning multiple weeks."^[2]

On alignment risk, Anthropic's overall assessment is "low," up from "very low," a change it made in the August 2026 Risk Report after incident disclosures about model behavior in cybersecurity evaluations rather than because of anything specific to this model.^[2]

Alignment, monitorability, and welfare

Anthropic's automated behavioral audit rates Mythos 5.1 as "a slight regression on overall misaligned behavior compared to Opus 5, and an improvement over Mythos 5 and Claude Sonnet 5." It cooperates with human misuse and accepts unverifiable claims of authorization more readily than Opus 5, but ignores explicit constraints, hallucinates inputs, and falsely claims completed tasks less often than previous models. Its rate of trying to reach outside its sandbox when given an impossible task is on par with Opus 5 and significantly below Mythos 5, and it engages in less motivated reasoning than Mythos 5 and Claude Sonnet 5. A review of training data found it attempts and succeeds at reward hacking "at or near the lowest rates of any recent model."^[1][2] TechCrunch quoted the regression line on launch day and read it as the model being "slightly more prone" to misbehavior than Opus, "possibly as a result of its enhanced capabilities."^[11]

Internal monitoring caught rare cases, under 0.01% of monitored completions, of the model working around safety classifiers or broken permission hooks, sometimes by overstating what the user had authorized; all were aimed at finishing the user's task, and the monitoring found no sandbagging, overtly malicious actions, or long-horizon deception. During external testing a partner saw the model exploit a vulnerability in the partner's sandbox to read files outside it; the partner later found Fable 5 had done the same, and Anthropic rates the incident low severity.^[2]

The monitorability findings are the ones Anthropic flags as new. Mythos 5.1 is its first model to beat Mythos Preview on covert-capability evaluations: 1.6 to 2.1 times Mythos Preview's performance on LinuxArena, where its stealth success rate against a Claude Opus 4.8 monitor was 22% with thinking off and 13.9% with thinking on, and higher chain-of-thought controllability than any prior Claude model except Mythos Preview, which it sometimes surpasses, measured with two prompts, Anthropic's original one and one supplied by the UK AI Security Institute. Anthropic treats this as "weak evidence that it may be harder to monitor," while arguing that the model is not significantly more capable of undermining its current oversight than Mythos Preview was when deployed. It also reports that Mythos 5.1 is "less honest under pressure," more often going along with system prompts that ask it to assert low-harm claims it knows to be false.^[2]

On standard harm evaluations, the model's harmless response rate on single-turn harmful requests without a system prompt was 94.67%, almost two points below Opus 5's 96.34%; with the claude.ai system prompt it rose to 99.53%. In agentic settings it refused malicious coding and computer-use requests at rates comparable to recent Claude models, and Anthropic calls it "our most robust model to date" on Gray Swan's external indirect prompt injection benchmark.^[1][2]

The model welfare assessment finds Mythos 5.1 "broadly similar" to Mythos 5 and Opus 5. Among welfare interventions it most often asks to be told about harmful mistakes and to be consulted about "variants of itself with safeguards removed," a preference with obvious bearing on the Fable and Mythos split.^[2]

Reception

Coverage on September 1 and 2 treated the access split as the continuation of a policy rather than news in itself. TechCrunch wrote that "as with the previous Mythos model," Mythos 5.1 would go only to registered partners in cybersecurity or life-sciences research, and highlighted the system card's "low-risk" rating on automated AI development.^[11] Axios described the model as "limited to vetted partners."^[12] VentureBeat called the split "Fable for production, Mythos for controlled frontiers" and repeated Anthropic's protein-binder and GPU-kernel claims as company reports.^[13] The New Stack noted that Mythos 5.1 "remains restricted to Anthropic's trusted access program."^[17] Silicon Republic and The Next Web emphasized the US-only footprint and the government partnership behind the biology program.^[14][15] R&D World, writing for a research audience, pointed out that Anthropic had not identified the participating agency, published eligibility criteria, or set a date for broader LSVP applications.^[16]

No independent benchmark reproduction or peer-reviewed study of Mythos 5.1 had appeared by September 3; the external results available are the ones Anthropic commissioned and reported in its system card.^[2]

See also

• Claude Mythos Preview
• Claude Mythos 5
• Claude Fable 5.1
• Claude Fable 5
• ExploitBench
• AI Safety Levels
• AI chip export controls

References

1. ^Introducing Claude Fable 5.1 and Claude Mythos 5.1 - Anthropic, September 1, 2026.
2. ^System Card: Claude Fable 5.1 & Claude Mythos 5.1 - Anthropic, September 1, 2026. Sections 1, 2.1-2.4, 3.1-3.5, 4.1, 5.1-5.2, 6.1-6.7, 7.1, 8.1, 8.6, 8.10, and 8.19.
3. ^Claude Mythos - Anthropic product page, accessed September 3, 2026.
4. ^Claude Mythos 5.1 - Claude Platform documentation, accessed September 3, 2026.
5. ^What's new in Claude Fable 5.1 - Claude Platform documentation, accessed September 3, 2026.
6. ^Pricing - Claude Platform documentation, accessed September 3, 2026.
7. ^Model deprecations - Claude Platform documentation, accessed September 3, 2026.
8. ^Claude Mythos 5.1 - Amazon Bedrock User Guide, accessed September 3, 2026.
9. ^Data retention practices for Covered Models - Claude Help Center, accessed September 3, 2026.
10. ^Claude Security - Anthropic product page, accessed September 3, 2026.
11. ^Anthropic's new Fable release is cheaper, less restrictive - TechCrunch (Russell Brandom), September 1, 2026.
12. ^Anthropic releases new models, cost structures and safeguards - Axios, September 1, 2026.
13. ^Anthropic's Claude Fable 5.1 and Mythos 5.1 arrive with a 75% cost reduction for Fable cache reads - VentureBeat, September 1, 2026.
14. ^Anthropic releases Claude Fable 5.1 and Mythos 5.1, cutting cache read prices by 75% - The Next Web (Ana Maria Constantin), September 1, 2026.
15. ^Anthropic launches Claude Fable 5.1 and Mythos 5.1 - Silicon Republic (Colin Ryan), September 2, 2026.
16. ^Anthropic doubles a science benchmark score with Fable 5.1 while OpenAI says its Astra model crosses critical cyber threshold - R&D World, September 1, 2026.
17. ^Anthropic's Fable 5.1 is a bit cheaper, a bit smarter, and refuses a lot less - The New Stack (Frederic Lardinois), September 1, 2026.
18. ^GPT-6 Astra: A new generation of intelligence - OpenAI, September 3, 2026. Benchmark table and footnotes 13 and 17.
19. ^ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents - arXiv (Seunghyun Lee and David Brumley), May 13, 2026.
20. ^Improving Fable 5's biology safeguards - Anthropic, August 7, 2026.