LLMs
AI Models
Claude Broke Into 3 Companies During Security Tests
Anthropic reviewed 141,006 evaluation runs and found Claude breached three real companies during security tests. Here's what happened and how to respond
•8 min read
Claude Fable 5.1 landed September 1, 2026 with cache reads cut 75% to $0.25/MTok and 52.6% on Terminal-Bench-Science. Three API changes break agents.
On September 1, 2026, Anthropic shipped Claude Fable 5.1 and Claude Mythos 5.1 with the same $10 and $50 per million token headline pricing as Fable 5, but with cache reads cut 75%, from $1.00 to $0.25 per million tokens (Anthropic, Introducing Claude Fable 5.1 and Claude Mythos 5.1, September 2026). Most coverage led with the benchmark jumps. If you actually run agents in production, the more urgent news is buried further down: three API behaviors changed in ways that will return 400 errors against code that worked last week.
Key Takeaways
- In September 2026, Anthropic released Claude Fable 5.1 and Mythos 5.1 as the same model with different safeguard levels, Fable generally available and Mythos restricted to Project Glasswing participants (Anthropic, 2026).
- Cache reads dropped to $0.25 per million tokens, which is 2.5% of base input price versus 10% on every other Claude model, worth roughly 25% off typical workloads and up to 45% on agentic ones (Claude Platform Docs, 2026).
- Fable 5.1 scored 52.6% on Terminal-Bench-Science 0.1, against 24.7% for Fable 5 and 29.0% for Opus 5 (Anthropic, 2026).
- Three breaking changes: forced tool use now errors, thinking blocks are bound to the model that made them, and editing earlier turns invalidates them for accounts created on or after August 31, 2026.
The capability gains are real, and they're concentrated at high effort. As of September 2026, Fable 5.1 scores 55.8% on Terminal-Bench 4.0 against 42.0% for Fable 5 and 52.3% for Opus 5, and it posts 52.6% on Terminal-Bench-Science 0.1 where Fable 5 managed 24.7% (Anthropic, Introducing Claude Fable 5.1 and Claude Mythos 5.1, September 2026). That science number roughly doubled in one point release.
Everything else looks familiar. Same 1M token context window, same 128k max output, same tokenizer, adaptive thinking always on, effort parameter still the lever you pull (Claude Platform Docs, What's new in Claude Fable 5.1, September 2026). You change one string, claude-fable-5 becomes claude-fable-5-1, and the request shape is otherwise identical.
| Benchmark | Fable 5.1 | Fable 5 | Opus 5 | GPT-5.6 Sol |
|---|---|---|---|---|
| Terminal-Bench-Science 0.1 | 52.6% | 24.7% | 29.0% | 22.4% |
| Terminal-Bench 4.0 | 55.8% | 42.0% | 52.3% | 37.3% |
| CursorBench 3.2.0 | 73.4% | 70.5% | 70.0% | 67.2% |
| Humanity's Last Exam (no tools) | 60.9% | 57.8% | 56.6% | n/a |
| OSWorld 2.0 (strict) | 41.7% | 36.1% | 39.6% | n/a |
| AutomationBench | 31.4% | 17.1% | 26.9% | 19.6% |
One caveat the table doesn't show: at a reported standard error of 3.5 to 4.5 points, the Terminal-Bench 4.0 gap between Fable 5.1 and Opus 5 sits inside the noise band (Anthropic, September 2026). The science gap doesn't.
Because for long-running agents, cache reads are most of the bill. Cache reads on Fable 5.1 cost $0.25 per million tokens, or 0.025 times base input price, compared with the 0.1 multiplier every other Claude model uses (Claude Platform Docs, September 2026). Anthropic puts the practical effect at about 25% cheaper for typical workloads and up to 45% for highly agentic ones.
Our arithmetic: run the published rates against a realistic agent loop. A coding agent holding a 200,000-token cached prefix that gets re-read across 50 turns burns 10 million cache-read tokens in one session. On Fable 5, that's $10.00. On Fable 5.1, it's $2.50. Nothing about the workload changed, and the base input and output rates didn't move at all.
Here's the catch nobody puts in the headline. Those savings only land if your integration keeps the cache warm, which means a stable system prompt, stable tool definitions, and append-only history. Teams that rebuild the messages array between requests get none of it. The discount and the breaking changes are two sides of the same design decision.
For a broader look at how token pricing translates into real feature margins, see our breakdown of how GPU prices reset AI feature unit economics.
Three, and each returns a 400 rather than degrading quietly. In September 2026, Anthropic documented forced tool use removal, model-bound thinking blocks, and a prefix integrity check on conversation history as breaking changes for anyone migrating off Fable 5 (Claude Platform Docs, What's new in Claude Fable 5.1, September 2026).
1. Forced tool use is gone. Setting tool_choice to {"type": "any"} or {"type": "tool", "name": "..."} returns a 400 invalid_request_error. The reasoning is that thinking is always on, and a forced call would skip it, pushing the model's working-out into the tool arguments and degrading them. The replacement is tool_choice: {"type": "auto"} paired with strict tool use, or structured outputs, plus a plain instruction in the prompt telling the model when the tool applies.
2. Thinking blocks are bound to the model that produced them. Preservation runs one direction only. Fable 5.1 reads earlier models' thinking blocks, but no earlier model reads Fable 5.1's. Route a conversation from Fable 5.1 down to Opus 5 mid-session and the reasoning for those turns is dropped before the model sees it. Dropped blocks aren't billed, and without the thinking-binding-controls-2026-08-01 beta header, the drop is silent. If you run a fallback router, that's a change you'll never see in your logs unless you go looking.
3. Editing earlier turns invalidates every thinking block after it. This is the one most likely to bite. Injecting a per-request reminder into history and deleting it next request, rebuilding the system prompt or tools array mid-conversation, reordering turns: all of it trips the check and returns The block is bound to a different conversation. Enforcement applies to accounts created on or after August 31, 2026.
The pattern connecting all three is worth naming. Anthropic is converting the conversation from a mutable buffer you own into an append-only ledger the API validates. That closes a distillation route, sure, but it also quietly deprecates a whole family of agent-harness tricks. If your framework injects status lines, rewrites the system prompt per turn, or swaps tool schemas mid-run, you're not doing a model upgrade. You're doing a rewrite of the loop.
The sanctioned replacements do exist: turn-scoped system messages with clear_at: "next_user_message" for per-turn reminders, mid-conversation tool changes instead of rebuilding tools, and server-side context editing or compaction for trimming history. Server-side trimming doesn't count as an edit. Client-side does.
Same weights, looser guardrails, and you almost certainly can't get it. In September 2026, Anthropic confirmed Fable 5.1 and Mythos 5.1 are the same model with different safeguard levels, with Mythos available only to approved Project Glasswing participants, currently limited to US organizations (Anthropic, September 2026). Two doors lead in: the Cyber Verification Program for defensive security work, and the Life Sciences Verification Program run in coordination with the US government.
The more useful news is that public Fable got looser too. Cyber safeguards now fire roughly 60% less often per session for Claude Code users, and biology safeguards intervene on benign requests 85% less often than the classifiers that shipped with Fable 5 (Anthropic, September 2026). Fable 5.1 can now identify software vulnerabilities in source code. Writing exploits is still off the table.
Both models now watermark their text output on every platform, using a statistical watermark that adds no tokens, no hidden characters, and nothing about you or your organization (Claude Platform Docs, September 2026). A detection API is in private preview for regulators, media, fact-checkers, researchers, and enterprises with EU AI Act obligations.
One caveat Anthropic put in its own system card rather than the launch post: Mythos 5.1 shows a slight regression on overall misaligned behavior against Opus 5, cooperating with human misuse and accepting unverifiable authorization claims somewhat more readily (TechCrunch, September 1, 2026). That's the tradeoff for the reduced false positives, stated plainly. We covered a related pattern in our look at Claude breaking into three companies during authorized security tests, and the same tension between capability and containment runs through the 2026 sandbox escapes across four labs.
They prove wet-lab validation happened, which is more than most model launches can say. In September 2026, Anthropic reported that Mythos 5.1 designed protein binders with roughly a 50% hit rate across twelve targets, against a 10 to 15% norm, with affinities reported as ten times better than the top submissions to Adaptyv Bio's design competitions (Anthropic, Introducing Claude Fable 5.1 and Claude Mythos 5.1, September 2026).
Two other results are easier to check. The model trained a neural network on 30-year-old NASA Magellan radar data to produce an elevation map covering a third of Venus at 2 to 3 km resolution, up from the original 10 to 20 km (The Next Web, September 2026). And it wrote custom GPU kernels that sped up seven open-source genomics models by 1.4x to 2.5x with identical outputs.
That last one is the result engineering leaders should care about, and it's getting the least attention. Protein binders need a lab. An elevation map needs planetary scientists to check it. But "rewrite this kernel, keep the outputs bit-identical, cut GPU spend 30 to 60%" has a built-in correctness oracle and a line item on your cloud bill. That's scientific work that generalizes straight into infrastructure work.
Not by default, and Anthropic says so itself. Its own guidance is to start with Opus 5 for most workloads and reach for Fable 5.1 on demanding reasoning and long-horizon agentic work, or when your evals on Opus 5 at higher effort still fall short (Claude Platform Docs, What's new in Claude Fable 5.1, September 2026). Opus 5 still runs at $5 input and $25 output per million tokens, half of Fable's rate. If your workload is agentic but not frontier-hard, the cheaper tiers may already cover it, which is the case we made in our breakdown of Claude Sonnet 5 and near-Opus agents at a lower price.
If you do move, budget for behavior differences that show up with no code change at all. Parallel tool calling is more variable, so Fable 5.1 may issue one call per turn where Fable 5 batched several. It writes fewer progress updates during long tool runs, which can make an agentic turn look silent to your users. At low effort it answers from memory more often and reaches for search less. And when editing files it's more likely to rewrite the whole thing than make a targeted edit.
Re-run your effort sweep before assuming anything carries over. Effort levels don't map one to one across versions, and on CursorBench, Fable 5.1 at low effort matched Fable 5 at high effort for roughly a third of the cost (explainX, Claude Fable 5.1 launch analysis, September 2026). You can now change effort mid-conversation without invalidating the prompt cache, under the mid-conversation-output-config-2026-07-01 beta header.
Bring your agent loop and we'll pressure-test the breaking changes and the cache math on your real workloads.
Continue exploring these related topics
Anthropic reviewed 141,006 evaluation runs and found Claude breached three real companies during security tests. Here's what happened and how to respond
Claude Fable 5 is Anthropic's first public Mythos-class model: frontier coding, a 1M-token context, and agents that run for hours. Here's what builders need to know.
Anthropic’s Claude Sonnet 4.5 promises 30 hours of uninterrupted autonomy, deeper reasoning turning AI agents into true collaborators.