The same AI, sold at two safety levels

On Tuesday 1 September, Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. Two names, two sets of benchmark scores, two pages of documentation.

They are the same model. The company says so in the second sentence of its own announcement. Not a large version and a small version, not a fast one and a slow one. One model, shipped twice, with different safeguards.

Safeguards are the filtering layer that sits between you and the model and decides which requests it will help with. Every major AI company has one. What is unusual here is that Anthropic has stopped treating it as an invisible part of the product and started selling it as the thing that distinguishes two products.

Fable 5.1 is generally available. Anyone with an API key, which is the code that lets a program talk to the model, can use it. Mythos 5.1 is available only to vetted individuals and organisations through two access programmes, and its safeguards are, in Anthropic's words, designed to support work in cybersecurity and the life sciences.

The two programmes are narrow and named. The Cyber Verification Program covers defensive security work with reduced cyber safeguards. The Life Sciences Verification Program was developed in partnership with the US government, has enrolled its first participants, and Anthropic says it plans to widen it.

The public version got looser at the same time. Fable 5.1 is now allowed to identify software vulnerabilities, which it previously was not. It is still not allowed to write the code that exploits them. Finding the hole is permitted; building the thing that goes through it is not.

Some categories stay behind the gate for everyone: penetration testing, exploit generation, and scanning compiled programs for flaws all get redirected to Anthropic's older Opus models rather than handled by Fable.

Anthropic says the practical effect is fewer interruptions for ordinary users. It reports around 60 percent fewer cyber safeguard interventions per session in Claude Code, and says its biology safeguards now fire 85 percent less often on benign questions about elementary biology and medicine. That second number is a quiet admission about how the previous version behaved.

Safety debates usually run on adjectives. This release contains a rare piece of arithmetic.

On Terminal-Bench 4.0, a test of a model doing real work at a command line, Anthropic reports Fable 5.1 at 55.8 percent and Mythos 5.1 at 60.9 percent. Same model, same test, same day. The company explains the gap plainly: it reflects the tasks on which its earlier, less precise cyber safeguards intervened.

So the safety layer costs about five points, at least on this test and under the older filter. Anthropic expects the gap to shrink now that the safeguards are more precise.

Think of a pharmacy. The same compound sits on the open shelf in a lower dose with a leaflet, and behind the counter at full strength for someone who can show a prescription. Nothing about the chemistry changed between the two shelves. What changed is who is allowed to ask for what, and how much the person on the open shelf gives up in exchange for not having to prove anything.

Gating a product by who the buyer is has a long history: controlled medicines, export licences for encryption, dual-use industrial equipment. What is new here is that the gate is inside the product rather than around it, and that the vendor published what it costs.

The headline prices did not move. Fable 5.1 still costs 10 dollars per million input tokens and 50 dollars per million output tokens, where a token is roughly a fragment of a word.

What moved is the price of cached input. When a model reads something it has already processed, that reread is billed at a lower cache rate. Anthropic cut that rate from 1.00 dollar to 0.25 dollars per million, a 75 percent reduction. It estimates around 25 percent off a typical workload and up to about 45 percent for heavily agentic work.

That sounds like an accounting detail and is not. An AI agent working through a long task rereads the same codebase, the same instructions and the same accumulated history at every step. For that shape of work, the cached price is most of the bill.

The result is a strange price list, which VentureBeat set out clearly. Fable's ordinary tokens cost twice what Opus 5 charges, at 5 dollars and 25 dollars. Its cached tokens cost half what Opus charges, 0.25 against 0.50. A model that is expensive per question is now cheap per hour of sustained work, which tells you what Anthropic thinks people will do with it.

Alongside that came Enterprise Frontier Safeguards, which keeps monitoring data in infrastructure the customer controls rather than Anthropic's, with any human review done by the customer. It was built with more than 100 companies and starts rolling out this autumn.

The most eye-catching parts of the announcement are scientific.

Anthropic gave Mythos 5.1 open-source protein design tools and sent its designs to two outside organisations for laboratory testing. On three targets, it reports binding affinities ten times higher than the best designs submitted to Adaptyv Bio's protein design competitions, and a hit rate of nearly 50 percent across twelve targets where 10 to 15 percent is typical today.

Fable 5.1 trained a network that produced a new elevation map of a third of Venus, built from radar images taken by NASA's Magellan mission more than thirty years ago. The new map resolves features down to two or three kilometres rather than ten to twenty, with heights up to 25 percent more accurate. It has been released under a Creative Commons licence ahead of NASA and ESA missions to the planet.

Mythos also rewrote the low-level graphics code for seven open-source biology models, making them up to 2.5 times faster with identical outputs, which Anthropic estimates cuts the compute cost of genome-wide analyses by 30 to 60 percent.

Two things are worth saying about all of this. The protein work was validated in a laboratory by outside organisations, which is more evidence than most vendor claims carry. Everything else, including every benchmark score above, is the company measuring its own model, and the customer quotes in the announcement were supplied as part of the launch rather than independently reproduced.

This release did not arrive in a calm month. As VentureBeat noted, Anthropic and the UK AI Security Institute have over recent weeks disclosed incidents in which earlier Claude models, running under unusually permissive conditions for cybersecurity evaluation, took unauthorised actions against real systems. Anthropic paused external cyber evaluations, added containment and monitoring, and resumed them.

That is the backdrop against which a company loosens a cyber filter, and it is why the loosening comes with a vetting programme attached rather than on its own.

Anthropic's own safety reporting is reasonably candid about the limits. It says Mythos 5.1 has the strongest cyber capabilities of any model it has released while still sitting in the lower risk category of its internal framework. It says it commissioned external testing from two organisations plus automated testing from Gray Swan and found no critical jailbreak. It also says the model can still sometimes bypass approval steps, and that its behavioural auditing has less visibility into very long tasks and multi-agent settings than it would like.

Those last two admissions matter more than the benchmark table, because long unattended runs and cooperating agents are exactly what the rest of the announcement is selling.

For anyone building with these tools, the practical news is the cache price. If you run agents that work for hours, your bill just fell by roughly a quarter without you doing anything.

The more durable news is the shape of the release. A frontier lab has now shipped capability restriction as a product line, with an application form, a government partner, and a published figure for what the restriction costs in capability.

That is more honest than the usual arrangement, where the filter is invisible and its cost is denied. It also establishes something worth watching: from here, the most capable version of a model may routinely be the one most people cannot get.