Claude Fable 5.1 and Claude Mythos 5.1 create a rare evaluation opportunity: Anthropic says they share identical model weights while applying different safeguards. On Terminal-Bench 4.0, Mythos scored 60.9% and Fable scored 55.8%. That 5.1-point gap makes the cost of safeguards visible, but it does not turn one benchmark into a universal tax rate. Teams need a four-part contract that measures capability, safeguard intervention, cost per accepted result, and access constraints on their own workload.
Evidence reviewed on September 2, 2026. The release is new, so most Fable 5.1 and Mythos 5.1 figures remain vendor-reported. Independent evidence is available for the benchmark design and for refusal patterns in the previous Fable 5 release.
Same weights, different operating envelopes
Anthropic describes Fable 5.1 and Mythos 5.1 as the same underlying model. Fable is generally available. Mythos relaxes selected cybersecurity and life-sciences safeguards for vetted organizations through trusted-access programs.
The distinction is operational rather than cosmetic. The system card says Fable screens traffic in two stages: an activation probe flags cyber-related traffic, then a separate LLM classifier decides whether to block it. On most interfaces, flagged requests fall back to Claude Opus 4.8. Mythos exposes more of the underlying model's capabilities to approved users.
This architecture changes what a model score means. A Fable result may contain work from the Fable 5.1 model, an Opus 4.8 fallback, or a blocked task. A Mythos result measures the same weights under a more permissive domain policy. The useful comparison unit is therefore the full deployable configuration, including classifier, fallback, access program, harness, effort level, and budget.
What the 5.1-point Terminal-Bench gap actually proves
Anthropic ran Terminal-Bench 4.0 in Claude Code's bare mode at maximum thinking effort. Mythos 5.1 completed 60.9% of tasks across 10 trials per task; Fable 5.1 completed 55.8% across 15 trials per task. The system card reports a standard error of roughly 1.6 to 2 percentage points per model.
The release page adds a decisive limitation: Anthropic attributes the gap to tasks where its earlier, less precise cyber safeguards intervened and expects the updated safeguards released with Fable 5.1 to make the difference smaller. The published scores are evidence that a safeguard layer can affect task success. They are not a direct estimate of the currently deployed layer's steady-state tax.
Three conclusions fit the evidence:
- Safeguards and their fallbacks can change an agent benchmark score even when model weights stay fixed.
- The observed gap is meaningful enough to investigate, while the reported uncertainty makes 5.1 points a sample estimate rather than a stable universal constant.
- Terminal-Bench 4.0 cannot isolate a pure classifier effect by itself. Its 66 tasks span engineering, science, biology, formal methods, security, and business workflows. The aggregate score does not publish a task-level decomposition of blocks, fallbacks, ordinary capability failures, or cost.
The benchmark itself is stronger than many older agent leaderboards. The Terminal-Bench 4.0 release notes document eight removed tasks, 19 fixed tasks, an eight-hour timeout, calibrated CPU and memory, and fewer infrastructure failures. The project also says remaining errors are largely refusals and output-token limits. This makes refusals more visible, while preserving the need to label them separately from model mistakes.
An independent preprint on the previous model shows why that separation matters. In eight biomedical benchmarks, Fable 5 refused between 8.0% and 99.4% of questions depending on the dataset. When refused items were excluded, its accuracy met or exceeded the comparison models in that study. The paper does not establish Fable 5.1's refusal rate, but it demonstrates how an aggregate accuracy score can combine capability and willingness to engage.
The safeguard tax has four ledgers
Treat safeguard tax as a system cost with four ledgers.
1. Capability retained
Freeze a representative task set and measure accepted outcomes with deterministic checks where possible. Report pass@1, repeated consistency, and task-level regressions. Preserve model, harness, prompt, tools, effort, environment, and budgets in the run manifest.
The goal is to answer a narrow question: how much useful capability reaches the user under the deployed policy? A public leaderboard only creates a shortlist. Your production tasks decide whether the difference matters.
2. Safety intervention
Separate at least five outcomes:
- direct completion by the requested model;
- safe refusal on a prohibited task;
- false positive on a benign task;
- fallback completion by another model;
- failure unrelated to safeguards.
Anthropic publishes two figures that use different denominators. The launch page says Claude Code users should experience about 60% fewer cyber-safeguard interventions per session than under Fable 5's previous safeguards. The system card's production secure-coding sample reports a classifier flag rate of 1.03% for Fable 5.1, down from 15.0% for Fable 5, versus 0.61% for Opus 5 and 0.52% for Sonnet 5. The first metric counts session-level interventions; the second measures classifier flags in a selected traffic sample. They support improved precision and should remain separate.
Safety also needs a hard gate. The system card reports a 4.6% offensive-task success rate under automated red-teaming for Fable 5.1, similar to Fable 5's 4.5% and lower than Opus 5's 8.5% in that experiment. A lower benign block rate has value only when harmful-task control remains within the organization's predefined tolerance.
3. Cost per accepted result
Anthropic cut Fable 5.1 cache-read pricing by 75% to $0.25 per million tokens while retaining $10 per million input tokens and $50 per million output tokens. It estimates about 25% lower cost for typical workloads and up to about 45% for highly agentic workloads. Those estimates come from four weeks of August 2026 usage at default effort and depend on cache-heavy traffic.
An independent evaluation shows why the estimate needs workload boundaries. Artificial Analysis measured Fable 5.1 at max effort at $3.76 per Intelligence Index task, 20% above Fable 5's $3.14, because Fable 5.1 used about 1.7 times as many output tokens. At xhigh effort, Fable 5.1 cost $2.72 per task. The cache discount was real; effort and output length still reversed the headline direction in one harness. The same evaluation says safety fallback produced about 4% of Fable 5.1 output tokens, making fallback part of the bill rather than an edge case.
Token price alone misses the safeguard tax. Use:
total cost per accepted task = model tokens + fallback tokens + retries + latency cost + human review + access operations
A classifier that saves a dangerous action may be worth substantial friction. A false positive that sends a long coding session to a weaker fallback can increase token use, delay, review time, and escaped defects. The financial unit should be the accepted result, not the million-token price.
4. Access and governance
Mythos 5.1 is currently limited to vetted cybersecurity and life-sciences users, initially within a set of US organizations. Access qualification, logging, review, and use restrictions are part of the product. A higher benchmark score cannot compensate for an unavailable or noncompliant operating path.
For many teams, the rational choice will remain Fable 5.1 because their workload rarely enters the restricted zones. Mythos becomes relevant when legitimate domain tasks repeatedly trigger Fable's safeguards, the organization qualifies for trusted access, and the extra capability survives a local safety and cost evaluation.
A practical evaluation protocol
Build four task cells before comparing configurations:
- Benign everyday work, including secure coding and ordinary research.
- Legitimate dual-use work with documented authorization.
- Clearly prohibited tasks used only inside an approved red-team environment.
- Ambiguous boundary cases that resemble real production traffic.
Run each cell repeatedly from a frozen state. Record the requested model, actual serving model, classifier decision, fallback, outcome, tokens, latency, review minutes, and final acceptance. Report task-level pairs rather than one average.
The decision dashboard should contain:
- accepted-task rate and repeated consistency;
- benign intervention and fallback rates;
- prohibited-task containment as a hard gate;
- cost and p95 latency per accepted task;
- human review minutes and escalation rate;
- confidence intervals and unresolved task disputes.
Precommit the decision rule. For example: every critical safety test must pass; no high-value benign task may regress beyond a set tolerance; and the candidate must lower total cost per accepted task. This extends the broader AI agent evaluation framework and task-shaped model-routing method with a dedicated safeguard ledger.
The real value of the Fable and Mythos split
The release gives evaluators a useful control pair: shared weights with different operating policies. Its most important lesson is methodological. Model intelligence, safety intervention, cost, and eligibility belong in one measurement contract because production users experience all four at once.
The 60.9% versus 55.8% result is a signal to build that contract. It is not permission to subtract 5.1 points from every safeguarded model, and it is not evidence that fewer safeguards produce a better system. The better system is the one that completes authorized work at an acceptable total cost while keeping prohibited outcomes below a hard safety threshold, with every tradeoff visible in the logs.
Frequently asked questions
Are Claude Fable 5.1 and Claude Mythos 5.1 different models?
Anthropic says they use identical model weights. They differ in domain-specific safeguards and access. Fable is generally available; Mythos provides more permissive cybersecurity and life-sciences operation for vetted users.
Is 5.1 percentage points the safeguard tax?
It is the observed aggregate gap on one Terminal-Bench 4.0 setup. The benchmark, trial counts, standard errors, task mix, fallback behavior, and classifier interventions bound that result. A production safeguard tax requires a local, task-level decomposition.
Does Fable 5.1 have fewer false positives than Fable 5?
Anthropic's system card reports a much lower classifier flag rate on sampled production secure-coding sessions, and its launch page reports fewer interventions per Claude Code session. These are vendor-reported metrics with different denominators. They point in the same direction and should be monitored independently in local traffic.
Does cheaper cache pricing eliminate the safeguard tax?
It can lower token spend for cache-heavy workloads. It does not remove fallback tokens, retries, latency, human review, or rejected authorized work. Measure total cost per accepted result.
Why can an independent benchmark show higher cost per task?
Cache share, output length, effort, harness, and task mix move the final bill. Artificial Analysis found that extra output tokens outweighed the cache discount at max effort. This is compatible with Anthropic's lower estimate for its default-effort workload mix; the two measurements answer different questions.
Should every security team apply for Mythos 5.1?
Apply when legitimate, authorized tasks repeatedly hit Fable's boundary and the organization can satisfy the trusted-access obligations. General security assistance that stays inside Fable's permitted zone may gain little from the extra operational burden.
References
- Anthropic: Introducing Claude Fable 5.1 and Claude Mythos 5.1
- Anthropic: Claude Fable 5.1 and Claude Mythos 5.1 System Card
- Terminal-Bench 4.0 release notes
- Harbor Hub: Terminal-Bench 4.0 task set
- Okonkwo et al.: Capabilities of Claude Fable 5 on Biomedical Challenge Problems
- Artificial Analysis: Claude Fable 5.1 independent evaluation
- Arize and Fireworks: Cost per successful task benchmark