Anthropic has put a concrete number on a debate that has simmered in AI development for years: how much capability does a company sacrifice when it builds safety guardrails into an AI model? On September 1, 2026, the company released two versions of the same underlying model, Claude Fable 5.1 and Claude Mythos 5.1, which differ only in their safety filtering strength. The result is striking: Fable 5.1, the safety-filtered version available to most users, scored 55.8% on a coding benchmark, while Mythos 5.1, the unrestricted version locked behind a trust access program, scored 60.9% on the same test. That 5.1 percentage point gap is the direct, measurable cost of safety.

What Does This Performance Gap Actually Mean for AI Users?

The gap between Fable 5.1 and Mythos 5.1 represents something rare in the AI industry: an honest quantification of what safety costs. Most AI companies avoid disclosing how much capability their safety measures erode, preferring to maintain the narrative that safety and performance can be achieved simultaneously without trade-offs. Anthropic's decision to publish this number explicitly in release documentation marks a departure from that pattern.

For most users, this means Claude Fable 5.1 is the model they interact with. It powers Claude.ai, Claude Code, and the standard API tier. Mythos 5.1, by contrast, is restricted to roughly 150 vetted U.S. organizations through a program called "Project Glasswing," which focuses on cybersecurity and life sciences research institutions. The restricted model is not available to the general public, and access requires institutional vetting.

The performance difference shows up most clearly on specialized tasks. On Terminal-Bench-Science 0.1, a benchmark that tests a model's ability to complete scientific research tasks in a terminal environment, Fable 5.1 led by a wide margin at 52.6%, compared to Fable 5 at 24.7%, Opus 5 at 29.0%, and OpenAI's GPT-5.6 Sol at 22.4%. This suggests that despite the safety tax, Fable 5.1 still represents a significant leap in capability for research-oriented work.

How Does Anthropic's Pricing Strategy Signal Its Bet on AI Agents?

Beyond the performance gap, Anthropic made a strategic pricing move that reveals where the company believes the AI market is heading. The company cut cache read prices by 75%, dropping the cost from $1.00 per million tokens to $0.25 per million tokens. While this sounds technical, it has real implications for how AI applications will work in the future.

To understand why this matters, consider how AI agents operate. An agent that continuously reviews code, for example, must re-read hundreds of thousands of tokens of context on every call: system prompts, tool definitions, conversation history. After the model processes this context once, subsequent reads incur a lower "cache read" fee. By cutting this fee from 10% of the base input price down to 2.5%, Anthropic is making long-running, context-intensive tasks dramatically cheaper. According to Anthropic's internal usage data from August, this pricing adjustment will reduce typical workload costs by about 25%, with savings of up to 45% for agentic tasks that frequently reuse cached context.

Conversational applications and single-turn questions are largely unaffected by this change. The base input price of $10 per million tokens and output price of $50 per million tokens remain unchanged. The pricing cut is precisely targeted at agent-based workflows, signaling that Anthropic views autonomous AI agents as the next major battleground in the AI market.

What Are the Key Technical Changes Developers Need to Know?

Fable 5.1 introduces three breaking API changes that will directly affect existing code and require developers to update their applications. These changes all point toward making the model's reasoning state more stateful and harder to tamper with externally.

• Forced Tool Calling Removed: Setting tool_choice to "any" or "tool" will now return a 400 error. Developers must switch to "auto" combined with structured output instead, which changes how applications request specific tool use from the model.
• Chain-of-Thought Blocks Bound to Model Versions: Fable 5.1 can read reasoning chains generated by older models, but older models cannot read their own chains. In pipelines that use routers or fallback degradation, switching model versions will cause the reasoning process to be lost, potentially breaking multi-step workflows.
• Editing Conversation History Invalidates Reasoning: Injecting or deleting per-turn prompts, or rebuilding system prompts or tool arrays mid-conversation, will now return an error directly. This check is enforced for accounts created on or after August 31, 2026, and affects applications that dynamically modify context.

The impact on multi-step agent frameworks should not be underestimated. Applications using dynamic context injection will need to test carefully before migration to Fable 5.1.

How Is Anthropic Redefining Cybersecurity Boundaries?

One of the most contentious questions in AI safety is whether a model can be trusted to identify vulnerabilities without also being able to exploit them. Anthropic announced that Fable 5.1 can now be used to discover software vulnerabilities, but not to develop exploits that take advantage of them. At the same time, the false positive rate in cybersecurity scenarios dropped by 60%, meaning the model is far less likely to incorrectly flag legitimate security research questions as dangerous content.

However, the very existence of Mythos 5.1 suggests that Anthropic does not fully trust this boundary at the classifier level. Rather than relying on prompt-level constraints to separate vulnerability discovery from exploit development, Anthropic created a completely different access mechanism. Mythos 5.1's System Card shows the model possesses "the strongest cybersecurity capabilities" and has already surpassed major human competitors on vulnerability discovery tasks. This capability is currently locked behind the trust access program, while Fable 5.1's vulnerability discovery capability is now open to the broader developer community.

This dual approach exposes a structural tension: if the classifier line between "identify but do not exploit" is truly reliable, why does Anthropic need a separate, restricted model for the most sensitive cybersecurity work? The answer suggests that the boundary is under growing pressure, and Anthropic is hedging by offering both a public version and a restricted version to different audiences.

What New Privacy and Compliance Features Are Coming?

Fable 5.1 comes with a built-in invisible text watermark, and Anthropic simultaneously released a private preview of a detection API. The API is open to compliance institutions required by EU law, meaning that traceability of AI-generated content in the European Union is no longer just technically feasible; it now has an institutional vehicle for enforcement.

On the data retention side, Anthropic launched "Enterprise Frontier Safeguards" (EFS), a new feature that stores customer data on cloud infrastructure fully controlled by the customer rather than on Anthropic servers. This achieves privacy protection equivalent to zero data retention while retaining the ability to combat adversarial abuse. The feature will roll out to enterprise customers in phases, with rollout expected to begin later in the fall.

What Do These Changes Reveal About the Future of AI Safety?

The release of Fable 5.1 and Mythos 5.1 exposes a structural problem that the AI industry has yet to solve. When a company needs to serve different markets with the same model under different safety layers, and can precisely quantify the performance loss imposed by safety classifiers, the industry-wide narrative that "safety and capability can be achieved simultaneously" begins to erode.

Anthropic's willingness to publish the 5.1 percentage point gap is significant because it breaks from the typical playbook. Most AI companies avoid quantifying how much capability "alignment" actually erodes, preferring to maintain the fiction that safety measures have no meaningful cost. By making this number public and embedding it in official release documentation, Anthropic is forcing a more honest conversation about the real trade-offs involved in building safe AI systems.

The performance improvements across other benchmarks suggest that despite the safety tax, Fable 5.1 represents genuine progress. On CursorBench 3.2.0, the model reached 73.4%; on Humanity's Last Exam with tool use, it scored 65.0%; on OSWorld 2.0 strict mode, it hit 41.7%; and on AutomationBench, it reached 31.4%, compared to Fable 5's 17.1% on the same benchmark. These gains indicate that Anthropic has improved the underlying model significantly, even after accounting for the safety filter's cost.

The dual-track release strategy also signals how Anthropic plans to navigate the tension between capability and safety going forward. Rather than pretending the tension doesn't exist, the company is creating separate products for different use cases: a safe, capable model for the general public and developers, and a more capable but restricted model for vetted institutions that can be trusted with advanced capabilities. This approach acknowledges that different users have different risk profiles and different needs, and that a one-size-fits-all approach to AI safety may not be sustainable as the technology becomes more powerful.