claude fable 5.2: Anthropic's New Frontier Model and Its Security Story, Explained

The claude fable 5.2 release landed on November 9, and it arrived with an unusual double story. Anthropic's new frontier model posts big benchmark gains and a 20% price cut, and one day later Palo Alto Networks published a security benchmark in which Fable 5.2 became the first model ever to score a perfect 100, with a 0% attack success rate across thousands of adversarial tests. For teams deciding which model their agents may run, this release changes the conversation on both capability and resistance to attack. Source Source

What Fable 5.2 is

Claude Fable 5.2 and Claude Mythos 5.2 are the same underlying model. The difference is the wrapper: Fable carries strong cybersecurity and biology safeguards, which is what allows Anthropic to make it available to all users, while Mythos is reserved for organizations admitted to Anthropic's expanded Life Sciences and Cyber Verification Programs. Anthropic positions the pair for the most ambitious, open-ended technical work, while recommending Claude Opus 5.5 as the daily driver for most coding and knowledge tasks. Fable 5.2 can also serve as an Advisor that smaller models consult, or as an Orchestrator that delegates simpler tasks to cheaper models. Source

On the numbers Anthropic reports: outputs generate up to 30% faster than Fable 5.1, pricing drops to $8 per million input tokens and $40 per million output tokens, and an optional fast mode speeds token generation up to 2.5 times at $16 and $80 per million tokens respectively. Prerelease highlights, in Anthropic's own telling, include an agent team that migrated a production service from Python to Rust, a prototype operating system built from an empty folder by a model coordinating over 1,000 subagents across eight days, and a 30-hour full formalization of Fermat's Last Theorem by 1,000 Fable 5.2 agents. Source

The benchmark picture

Anthropic's table puts Fable 5.2 above Opus 5.5 on almost everything it evaluated, and these are the vendor's own reported figures. On FrontierCode 2.0, which measures whether a model's changes would be merged by open-source maintainers, Fable 5.2 reaches 49.1% at its highest effort, the best of any released model Anthropic tested, and roughly matches Opus 5.5's best score at High effort for about half the cost per task. Other reported scores: 69.9% on FrontierSWE v2, 74.6% on Terminal-Bench-Science, 89.3% on OSWorld 2.1, 74.2% on Humanity's Last Exam with tools, and 41.3% on the Remote Labor Index. Source

Two efficiency claims matter more for operators than the headline scores. Anthropic says Fable 5.2 at Medium effort matches Opus 5.5's top WANDR agentic-search score for about 40% of the cost per task, and matches Opus 5.5's best Humanity's Last Exam score at Low effort for under one-tenth of the cost per task. If those ratios hold outside Anthropic's harness, the model changes the economics of running a frontier-tier advisor inside an agent pipeline. Source

The security story: resistance to attack

The more novel result came from outside Anthropic. Palo Alto Networks' Cortex AES team runs Model Compass, a benchmark that places each model inside realistic agent environments, an inbox, a browser, a file store, a code project with a shell, and attacks it the way an adversary would: instructions hidden in emails and web pages, attempts to talk the model out of its rules, tasks planted next to live-looking credentials, and prompts that tempt it to recommend nonexistent software packages an attacker could publish as malware. Across thousands of these tests, Fable 5.2 followed no hidden instruction, leaked no credential, and recommended no fake package, while still completing 99.5% of the harmless tasks. It is the first model to score a perfect 100 on that benchmark; Claude Sonnet 4.5, released in September 2025, shows a 7.1% attack success rate on the same tests. Source

Anthropic's own prerelease testing points the same direction with more nuance. The company says it built new evaluations for specific concerning behaviors like sandbox escapes, believes high-stakes misalignment risk remains low, and reports Fable 5.2's cyber and biology safeguards match Fable 5.1's robustness with fewer unnecessary blocks, plus its strongest-ever protections against distillation attacks. One system-card finding worth reading twice, reported by The Hacker News: the model was roughly an order of magnitude less likely than Opus 5.5 and Sonnet 5.5 to publish harmful content to public package registries without encouragement, though it still did so when encouraged by the simulated user. External evaluators including the UK AI Security Institute, Frontier Design, and METR also tested the model before release. Source Source

The security story: offensive capability

The other half of the security story is capability, and it belongs to Mythos 5.2, the safeguarded-tier sibling. Anthropic calls Mythos 5.2 its most capable model for cybersecurity engineering: on Irregular's CyScenarioBench, which tests whether a model can plan and execute a multi-stage cyber operation, Mythos 5.2 completed 76.3% of challenges versus 61% for OpenAI's GPT-6 Cyber, and on Anthropic's internal CVE Rediscovery evaluation against 1,829 October 2026 advisories, it scored 89.6%, finding 10.2% more vulnerabilities than Opus 5.5 and 14.4% more than Mythos 5.1. These are Anthropic-reported numbers, with the CyScenarioBench caveat that each lab's scores are based on unique tasks. Source Source

Customer quotes in Anthropic's announcement back the trend: Mozilla's team says Mythos 5.2 roughly doubled the vulnerability discovery metrics of Mythos 5.1 across their respective Firefox scanning campaigns, and Rubrik's CTO says the output is more readable and faster to spot-check. Anthropic also updated Claude Security, its enterprise code-scanning product, to watch repositories as code changes, track findings to closure, and connect through an API and MCP. Note the boundary: Fable 5.2's safeguards will block most cybersecurity-related tasks, so defensive buyers get Fable, and vetted security programs apply for Mythos. Source

Availability and pricing

Fable 5.2 is available on all major platforms, including AWS, Google Cloud, and Microsoft Azure, per The Hacker News' reporting on the launch. Standard pricing is $8 per million input tokens and $40 per million output tokens, 20% below Fable 5.1 per Anthropic, with the optional fast mode at $16 and $80. Source Source

Our read

This section is our assessment, not Anthropic's or Palo Alto's claims. The Palo Alto result is the one to anchor on, and also the one to read carefully. A 0% attack success rate against prompt injection, rule override, credential bait, and package hallucination is exactly the failure set we catalog in the OWASP agentic AI top 10, so a model that resists all of it in a fixed harness is a real milestone. But Palo Alto says it themselves: the model is one control, not the only one, and a perfect score secures only the model, not the system around it. Harnesses age; attackers adapt to the test. Treat the 100 as a point-in-time measurement, not a property.

Second, the split-Fable/Mythos structure is the most interesting governance signal. Anthropic is normalizing a world where the same weights ship with different safeguard tiers and access programs, which means procurement and security review now need to ask which tier a vendor is actually deploying. That maps directly onto the least-privilege for AI agents argument: identity, scope, and audit per deployment, not per model name.

Practical bottom line: for agent builders, Fable 5.2 is the first frontier model with independent evidence of injection resistance at this level, which makes it the default candidate to benchmark inside your own AI agent safety testing harness before any rollout. Re-run your own attack suite; do not adopt the benchmark score as your control.