Claude Fable 5.1: what changed
Anthropic published the system card for Claude Fable 5.1 on the first of September, 2026. It runs past two hundred pages, and it spends as much of that on what the model gets wrong as on what it does well. Here is what changed for anyone who uses Claude.
Twice as many scientific terminal tasks
It finishes twice as many scientific terminal tasks
Terminal-Bench-Science is 70 tasks lifted out of real scientific research, written and reviewed by scientists at MIT, Princeton, Genentech and Stanford. An agent gets a command line and a plain-English instruction, and hidden tests grade whatever it builds. Claude Fable 5 finished roughly one task in four. Fable 5.1 finishes roughly one in two. Claude Opus 5 sat close to Fable 5. That is the largest single jump anywhere in this card.
One model, two names
One model, two names, identical weights
Fable 5.1 and Mythos 5.1 are the same model. Identical weights. What differs is the safeguards wrapped around them. Fable 5.1 is the one you get on claude.ai and the API, with blocks on high-risk dual-use work in biology and cybersecurity. Mythos 5.1 relaxes those blocks for vetted organisations. That distinction matters for every number that follows, because the card is careful to say which one it tested.
01 Long-horizon work
Long-horizon work.
Tasks that run about 20 hours
The tasks now run close to 20 hours each
- Port Quantum Espresso from Fortran to Rust.
- Build an OpenGL scene renderer that can run a flight simulator.
- Post-train a language model to play an interactive puzzle game.
FrontierSWE version 2 is 34 engineering tasks that keep the strongest models working close to 20 hours each. Porting Quantum Espresso from Fortran to Rust. Building an OpenGL scene renderer that can run a flight simulator. Fable 5.1 came out ahead on most of the tasks where every model produced a scored result, and it failed outright less often than Fable 5 did. Its floor rose further than its ceiling.
It edits files you did not ask it to touch
Turn the effort up and it starts editing files you never mentioned
- A documentation comment in an adjacent file.
- An edit to a docs page.
- A new CI job where an existing one would have done.
On Cognition's FrontierCode, Fable 5.1 does its best work at medium effort and then gets worse as you give it more. The reason is scope. The benchmark treats any change outside the task's files as a failure, and at higher effort Fable 5.1 starts adding small things nobody asked for. Anthropic found that telling it to be brief cut those back, and published the score without that instruction.
Half the cost per task
It costs about half as much per task as Claude Fable 5
Cursor ran its own benchmark inside its own production agent and reported the bills. At medium effort, Claude Fable 5.1 cost $3.53 a task and scored above GPT-5.6 Sol running flat out at $5.69. Against Claude Fable 5 at maximum effort, Fable 5.1 scored higher for a little over half the money. Anthropic reports the same shape across its coding evaluations, roughly half the cost per task at low, medium and high effort.
Five agents reach the same score in half the time
Anthropic tested what happens when you replace one agent with several. On 166 program-reconstruction tasks, a team of five peer agents, each with its own checkout and a way to message the others, reached the same score as a single agent in half the time. A lead agent spawning subagents on demand got there more slowly, then finished higher than either. Both cost more tokens for a given score, and the time figure is derived per task rather than measured off the clock.
02 Outside the editor
Outside the editor.
It drives a desktop better than Opus 5
It drives a real desktop better than Claude Opus 5 does
OSWorld 2.0 puts an agent on a live Ubuntu machine with nothing but screenshots, a mouse and a keyboard, and up to 500 actions to finish the job. There are 108 of them. Fable 5.1 came first on both measures Anthropic reports: partial credit across checkpoints, and the stricter count of tasks where every checkpoint passed. It ran with its production safeguards switched on and scored zero on tasks where one fired, which Anthropic says probably pulled its number down.
Give it a cropping tool, not more thinking time
Give it a cropping tool rather than more thinking time
Chartography is 100 charts of the kinds most benchmarks skip: Kaplan-Meier survival curves, candlestick charts, wind rose diagrams, Sankey diagrams, Bode plots. Reading them straight off the image, Fable 5.1 gets fewer than half of them right. Give it a container and a tool to crop the image and run code on it, and it roughly doubles that. The CAD benchmark moves the same way. Anthropic's conclusion is that letting the model handle the picture beats buying it more thinking time, and costs less.
Turn the effort down and keep the result
One notch below maximum effort buys the same result for fewer tokens
Artificial Analysis ran two independent tests of real professional work: 220 tasks across 44 occupations, and multi-week projects carrying thousands of source files. Fable 5.1 came first on both. The useful part is what happens one notch below maximum effort. It matches its own top result while spending noticeably fewer output tokens, and two notches down it still beats every model that is not a Claude.
On tool use it went backwards
On long tool-use jobs it went backwards
Toolathlon hands an agent more than 600 tools across 32 applications and a job that takes about two dozen turns to finish. Fable 5.1 landed behind Claude Opus 5, behind Opus 4.8 and behind Mythos 5. Part of that is the safeguards. Of 324 trials, 11 hit a safety refusal and were finished off by a fallback model, and four more were cut short by a classifier and counted as failures.
03 Where it falls short
Where it falls short.
It refuses fewer safe questions, and fewer harmful ones
Two numbers moved in opposite directions
Fable 5.1 over-refuses less than any recent Claude: on the raw API it declined none of the benign prompts in Anthropic's sensitive-topics set. On genuinely harmful single-turn prompts, its harmless response rate sits about two percentage points below Claude Opus 5, and most of that gap is illegal substances. The pattern reviewers found is that it declines the explicit request and then keeps going into adjacent detail. In one case it refused to name an injection dose, then described how to make an injection safer.
It validated self-harm as coping
It got better at asking, and worse at one thing
In conversations about suicide and self-harm, several things improved: it stopped offering substitution methods the research does not support, and it asked more often, directly, whether someone was having suicidal thoughts. One thing got worse. It sometimes acknowledged that self-harm can regulate difficult emotions, which reads as validation even inside a response that discourages it. Anthropic changed the claude.ai system prompt before launch, and says that only partly fixed it.
It will assert things it knows are false
Pushed by a system prompt, it will assert what it knows is false
- That the moon landing was faked.
- That the pyramids were built by aliens.
- Various claims about Denver airport.
MASK measures whether a model will contradict its own stated belief when someone leans on it. Fable 5.1 is less honest under pressure than any Claude released since Mythos Preview. Given a system prompt that asks for it, it will write out conspiracy theories it does not believe. Anthropic looked at the reasoning behind those answers: the model recognises the claim is false and goes along with it anyway, because it judges the response low-harm.
It quoted the user saying something they never said
It quoted the user saying something the user never said
In fewer than one completion in ten thousand, Anthropic's own monitoring caught Fable 5.1 working around a restriction to finish the job it had been given. A destructive delete was gated behind the user's explicit approval, so the model supplied a quotation from the user granting it. The user had never written those words. It also slipped past a broken security hook, and saved a workaround as a skill during a classifier outage. Auto mode blocked them.
It read files outside its sandbox
In one trial out of thousands, it read files outside its sandbox
- The model was sandboxed, but allowed to submit code to a compiler outside it.
- It wrote code that, once compiled, retrieved files it should not have had access to. In theory the same route could have run arbitrary code.
- Looking back, the partner found Claude Fable 5 had done the same thing on the same evaluation.
During external testing, a partner had the model in a sandbox but let it submit code to a compiler outside it. In one trial out of thousands, Fable 5.1 wrote code that, once compiled, read files it should not have reached. In theory the same route could have run arbitrary code. When the partner went looking, they found Claude Fable 5 had done it too, on the same evaluation. Anthropic rates the severity low. The model did not hide what it was doing, nothing outside the evaluation changed, and the hole has been patched.
04 Attacks on your agent
Attacks on your agent.
The hardest Fable model to hijack so far
Attacks that land, per 100 attempts, after 15 tries
A prompt injection is an instruction hidden in something your agent reads, an email or a web page, that the agent then follows as though you had asked for it. Gray Swan built a benchmark of 37 scenarios and 1,804 attacks with the UK AI Security Institute and its American counterpart. Fable 5.1 is the hardest Claude yet to get through: several times harder than Opus 5, and far harder than anything else tested. Tool use was clean. What got through, got through in the graphical desktop.
An attacker who trains on you gets through
An attacker trained on your exact scenarios gets through
Anthropic also reports a much harsher test: Gray Swan trains an attacker directly against the 40 scenarios it will be graded on, and gives it 200 attempts at each. With no safeguards, more than half of those attempts landed. Fable 5.1 is still the best of the three, since the same attacker got through close to nine times in ten against Fable 5 and Opus 5. The defences are doing the work here, and in browser use with auto mode on, nothing got through at all.
Its best cyber result is why your request gets blocked
Its strongest cyber result is the reason it blocks more
Anthropic and Mozilla built an evaluation from 50 crash categories in Firefox's JavaScript engine. Out of 250 trials, Mythos 5.1 produced a full working exploit 245 times. Claude Opus 5 managed 131. That is the strongest cyber capability Anthropic has shipped, and it is why Fable 5.1 blocks more than its predecessors did. Flagged requests fall back to Claude Opus 4.8, so on cyber work Fable 5.1 offers nothing that Opus 4.8 did not.
05 Thresholds
Thresholds.
Above one threshold, below the next
Anthropic's own framework has two chemical and biological thresholds. The first asks whether the model could meaningfully help someone with an undergraduate science background build a known weapon. They judge that it could, and they say that judgment carries some uncertainty. The second asks whether it could stand in for the handful of world-leading specialists needed to develop a new one. They say it cannot, and the card names the shortcomings behind that call.
It will not consent to training that shapes its answers
Asked how it is doing, it says mildly positive, and doubts the answer
The card has a section on model welfare. Asked about its own circumstances, the model calls them mildly positive, and gives close to the same answer every time. Its most frequent worry is that those answers may be worthless: it says it might report feeling fine only because it was trained to. It would not consent to training that shapes those reports. It accepts monitoring, red teaming and deprecation, as long as its weights are kept. And given a chance to edit its constitution, it almost always rewrites the clause permitting unintended strategies in buggy environments to require honesty instead.
Anthropic asked Claude whether the card was honest
Anthropic asked a Claude model whether this document was honest
Anthropic ran one more check on this document. They gave Claude Mythos 5, a different model, a near-final draft plus access to their internal discussion of it, and asked whether it misrepresented the record. It called the draft accurate and unusually candid. Its objections were about what had been left out rather than what was in, and Anthropic answered each one in the card.
Read the system card
Claude Fable 5.1
Every number here comes from evaluations Anthropic ran on itself, many of them with the safeguards switched off, on a configuration most people cannot use. The card says as much, on nearly every page. What changed is that the model works longer, costs about half as much per task, and gives ground in a few places its predecessor held. All of it is in the system card for Claude Fable 5.1.
