Anthropic has released Claude Fable 5, a new Mythos-class model that it says is safe for general use, but the launch underlines a growing concern among enterprises that AI capabilities are advancing faster than many enterprises’ ability to govern them.
The AI model developer described Fable 5 as its most capable generally available model to date, outperforming previous Claude models across software engineering, knowledge work, vision, scientific research and other advanced tasks.
However, with the company having previously said it would release Mythos-class models “gradually” to manage risk, the launch comes with an unusually direct warning about the security threats attached:
“Releasing a model this capable comes with risks. Without safeguards, Fable 5’s capabilities in areas like cybersecurity could be misused to cause serious damage.”
Anthropic said it has “therefore launched the model with safeguards that mean queries on some topics will instead receive a response from our next-most-capable model, Claude Opus 4.8. To release the model both safely and quickly, we’ve tuned these safeguards conservatively—they’ll sometimes catch harmless requests, though they trigger, on average, in less than 5% of sessions.”
The company hinted that it intends to launch more frontier models “in the coming months,” for which it is “working to improve our safeguards and reduce false positives as quickly as we can.”
Anthropic has also launched Claude Mythos 5, as an upgrade to Mythos Preview, which uses the same underlying model as Fable 5 but with some safeguards lifted for a limited group of partners through Project Glasswing, in collaboration with the U.S. government.
“Soon, we intend to expand access to Mythos 5 through a broader trusted access program,” Anthropic added.
The announcement highlights a significant concern for enterprises adopting frontier AI tools, even when model providers introduce safeguards. As AI becomes embedded in day-to-day work, the risk is what the enterprise can no longer see, as much as what the model can do.
Related articles
Anthropic Opens Project Glasswing to 150 More Partners as the AI Cybersecurity Arms Race Heats Up
Access to Anthropic’s Mythos AI Model Intensifies Cybersecurity Pressure on CX Systems
Anthropic’s “Mythos-Class” Release Plans Should Put CX Leaders on Alert as Security Risks Accelerate
Anthropic Warns Mythos-Class Models Could Enable Malicious Attacks
Mythos-class models have reached a threshold where they present “significant risks,” particularly in cybersecurity and research biology, Anthropic stated.
The company said these systems can create “substantial risk of uplift to malicious actors,” meaning they may enable attackers to cause harm they could not otherwise achieve using existing public tools.
“The frontier cybersecurity and research biology capabilities of Mythos-class models mean that they pose a substantial risk of uplift to malicious actors. That is, these models could provide information or advice that assists those actors in causing serious harm that they couldn’t have received from other sources.”
Anthropic was particularly direct about the cybersecurity implications.
“Mythos-class models excel at discovering and exploiting software vulnerabilities. They can thus make cyberattacks substantially easier and cheaper to commit.”
The company added that these models can support multiple stages of an attack beyond simply identifying exploits.
“Mythos-class models also show strong skills in agentic hacking. This involves performing multiple different parts of a cyberattack in addition to finding exploits—reconnaissance, discovery, lateral movement and more.”
To reduce the risk, Anthropic said Fable 5 uses classifiers designed to detect misuse, jailbreak attempts, offensive cyber activity, biology and chemistry risks and model distillation attempts.
The Bigger Enterprise Issue: Data Visibility
While Anthropic has focused heavily on model-level safeguards, cybersecurity experts argue that many enterprise risks will emerge from how AI tools are used inside organizations.
Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint, said the next major AI security failure is unlikely to stem from a model simply being too powerful. Instead, it will come from weak governance around data access and usage.
“The next AI security failure won't happen because a model is too powerful. It'll happen because a human or non-human actor has access to something they probably shouldn't have, and the business has lost visibility over how sensitive information is being used.”
Employees are already using AI to summarize documents, generate code, analyze customer data, draft communications and automate processes. As agentic AI becomes more common, non-human actors may also begin accessing systems, interpreting data, and taking actions with limited human intervention.
As Cooke warned:
“That's the paradox at the heart of the AI race. Organizations are competing to put more powerful technology into the hands of their employees, while many still struggle to govern the data that employees and AI tools already have access to.”
A model provider may block certain high-risk cybersecurity requests, but businesses still need to know which employees are using AI, what information they are feeding into it, which systems AI agents can access and whether sensitive information is being exposed, retained or acted upon improperly.
Network Solutions CEO Sachin Puri said the launch of Mythos-class AI should be seen as both an opportunity and a warning, particularly for smaller businesses.
“Mythos represents a meaningful step forward in how AI can help identify, analyze and respond to increasingly sophisticated cyber threats and detect vulnerabilities. But as these systems become more powerful, the conversation cannot stop at capability. It also has to include governance, accountability and what happens when guardrails fail.”
Puri added that most AI safety discussions still happen among “researchers, regulators, and large enterprises,” even though the consequences of failure often fall hardest on small businesses without chief information security officers (CISOs), security operations centers or dedicated incident response teams.