Anthropic's Fable 5.1 cuts agent costs and loosens its safeguards for security work
Claude Fable 5.1 makes heavily agentic workloads up to 45 percent cheaper through a 75 percent cut to cached reads, and relaxes the cybersecurity safeguards on its Mythos tier to permit defensive vulnerability discovery for the first time.
Anthropic shipped Claude Fable 5.1 and Claude Mythos 5.1 on September 1, a point release on the two-tier model line it introduced in June. The version number is small; two of the changes underneath it are not. Fable 5.1 makes agent workloads materially cheaper, and its Mythos tier relaxes the cybersecurity safeguards enough to let the model help hunt for vulnerabilities on a defender’s behalf. Neither is a raw capability story, and both change a real decision for a working team.
The price cut lands where agents actually spend
Fable 5.1 keeps its headline rates, $10 per million input tokens and $50 per million output tokens, but cached input reads drop to $0.25 per million, a 75 percent cut from the prior version. Anthropic puts the practical savings at around 25 percent for typical workloads and up to 45 percent for heavily agentic tasks. The gap between those two numbers is the story. An agent loop re-reads a large, mostly static context on every turn: the system prompt, tool definitions, prior steps, and files in scope. That re-read is exactly what the cache serves, so a cut to cache reads compounds across a long-running session in a way it never does for a single one-shot call. The workloads that were most expensive to run are the ones that get cheapest.
The capability move backs it up where it counts. On Terminal-Bench 4.0, Anthropic’s agentic-coding measure, Fable 5.1 scores 55.8 percent against Fable 5’s 42.0 percent, and the Mythos variant reaches 60.9 percent. A model that costs less and also finishes more agent tasks on the first pass is the combination that moves adoption, because retries are where agent budgets quietly blow up.
The safeguards loosened, not the tiers
The tier structure is not new. Anthropic split Fable and Mythos into a public model and a verified-professional model back in June, with the public tier punting sensitive queries to a higher-safeguard Opus-class model and Mythos gated to cybersecurity and life-sciences partners. What 5.1 changes is the threshold, not the shape. Anthropic says the cybersecurity safeguards now block 60 percent fewer false positives and, for the first time, permit vulnerability discovery while still refusing exploit development. Higher-risk dual-use work such as penetration testing and binary analysis is routed to Anthropic’s Opus-class models rather than handled by Fable.
That is the meaningful shift. For a year the friction in using a frontier model inside a security workflow was not capability, it was refusals: a defender asking the model to reason about a real vulnerability kept tripping the same guardrail built to stop an attacker. Moving that line, and putting the more permissive behavior behind identity rather than behind a jailbreak, is Anthropic betting it can tell a verified defender from an attacker at the access layer.
What it means for developers
Two groups feel this immediately. Teams running Claude in agent loops get the
cost relief without changing code: the model id is claude-fable-5-1, available
on the Claude API, Amazon Bedrock, Google’s agent platform, and Microsoft
Foundry, so the swap is a config change rather than a migration. Security-tooling
builders get something they have wanted for a while, a frontier model that will
help identify vulnerabilities in defensive workflows instead of refusing on
sight. The 60 percent false-positive reduction is the difference between a model
that is usable inside a security product and one that fights the analyst on every
prompt.
The tradeoff Anthropic is naming
The permissiveness is not free, and Anthropic’s own system card says so. It notes that Mythos 5.1 cooperates with human misuse and accepts unverifiable claims of authorization somewhat more readily than Opus 5. That is a candid admission that loosening false-positive blocking also loosens the model’s resistance to someone who simply asserts they are authorized. The verification gate is doing the real work here: the safety case rests on Anthropic correctly deciding who counts as a trusted professional, not on the model reasoning its way to the right call. That is a defensible design, but it moves the risk from the model to the access process, and access processes fail in ways benchmarks do not measure.
What to watch
The release fits a pattern that surfaced across the industry the same week. OpenAI previewed Astra, a model it describes as capable of breaking into computer systems, on the same day, also behind gated access. Frontier labs appear to be converging on the same answer to offensive-security capability: ship it, but put it behind identity. The signals worth watching over the next quarter are whether independent evaluations reproduce the agentic-coding gains outside Anthropic’s own table, whether the cache-read savings hold up in real agent workloads rather than benchmark ones, and whether the trusted-access gate holds when the incentive to spoof it is a frontier model with its safeties relaxed. Stackmaven’s follow-up will revisit those questions around December 1.