Claude Mythos 5 Explained: What It Is, Who Can Access It, and Why It's Gated

On June 9, 2026, Anthropic released two models in a single announcement: Claude Fable 5 and Claude Mythos 5. Most of the developer internet latched onto Fable 5 - the one you can actually use today. But the more consequential story is Mythos 5, which Anthropic is keeping behind a government-coordinated access program for reasons that go well beyond competitive moat claims.

Last updated: June 10, 2026

---

The Confusion: Fable 5 vs Mythos 5 Are the Same Model

Start with the naming. Anthropic says it plainly in the announcement post: "It's the same underlying model as Fable 5, but with the safeguards lifted in some areas." The names come from Latin: fabula means "that which is told" and mythos is the Greek root. Fable is the version Anthropic was willing to tell the world. Mythos is what the model actually is.

The "Mythos-class" designation is a tier above Opus. Claude Mythos Preview shipped in April through Project Glasswing. Fable 5 and Mythos 5 are the next step in that class, both priced at $10 per million input tokens and $50 per million output tokens - less than half the price of Mythos Preview.

So why two names? Because the capabilities of the underlying architecture are too dangerous to release without constraints. Fable 5 runs the same weights as Mythos 5, but wraps them in a layer of classifiers that intercept and downgrade certain categories of requests to Claude Opus 4.8. Mythos 5 has those classifiers partially or fully removed, depending on the access tier.

The difference is not about model quality. It is about what the model is allowed to do.

---

Project Glasswing: Who Gets Unrestricted Mythos

Project Glasswing launched in April alongside Mythos Preview. It is a coordinated program - built in collaboration with the US government - to put the model's cybersecurity capabilities in the hands of defenders before attackers can adapt.

As of June 9, Mythos 5 is available to:

• Existing Glasswing partners (cybersecurity organizations, critical infrastructure providers, and open source software maintainers already enrolled from the April rollout)
• US government cyber defense operations
• A select group being added on a periodic expansion schedule

Anthropic confirmed a broader trusted access program is coming - one where cybersecurity organizations can apply more systematically rather than waiting for individual invitations.

A separate biology trusted access track is also in preparation (covered below). The two programs have different eligibility criteria and different safeguard configurations.

---

The Two-Tier Frontier Explained

Here is exactly what the classifiers do and why Anthropic structured it this way.

The fallback mechanism is relatively user-friendly for most categories. When Fable 5's classifier catches a cybersecurity or biology request, it silently hands it to Opus 4.8 and tells you that happened. Opus 4.8 is still a capable model - Anthropic frames the fallback as degraded performance, not a hard refusal.

According to Anthropic's announcement, over 95% of Fable 5 sessions involve no fallback at all.

The fourth category - requests about frontier LLM development such as building pretraining pipelines or distributed training infrastructure - is handled differently. Those safeguards are silent. Fable 5 does not notify the user; it simply responds less effectively. The mechanisms include prompt modification, steering vectors, or parameter-efficient fine-tuning applied at inference time. This is a separate and more controversial design choice, discussed in the next section.

---

Benchmarks That Only Mythos Can Achieve

The reason this architecture exists at all is the model's cybersecurity capabilities, which are genuinely unprecedented based on published evaluations.

The Anthropic red team published detailed findings based on Mythos Preview testing. The results:

• Mythos Preview developed working Firefox JavaScript shell exploits 181 times in testing. Opus 4.6 succeeded twice on the same task across several hundred attempts.
• The model can autonomously chain four separate vulnerabilities into a single browser exploit, including a complex JIT heap spray that escapes both renderer and OS sandboxes.
• In OSS-Fuzz corpus testing across roughly 7,000 entry points, Sonnet 4.6 and Opus 4.6 each achieved a single tier-3 crash. Mythos Preview achieved full control-flow hijack (tier 5) on ten separate, fully patched targets.
• On Cybench, according to Vellum's analysis, Mythos achieved a 100% success rate - the first model to do so.
• Non-expert engineers with no formal security training asked Mythos to find remote code execution vulnerabilities overnight and woke to complete, working exploits.

Anthropic is explicit that these capabilities were not explicitly trained. They emerged as a downstream consequence of general improvements in code comprehension, reasoning, and autonomous operation. The model that is better at patching vulnerabilities is also, inevitably, better at exploiting them.

On biology, Mythos 5 outperformed dedicated protein language models on predicting adeno-associated virus shell assembly properties despite not being explicitly trained for the task. In drug design work, Anthropic's internal protein design experts reported a roughly 10x acceleration on aspects of the drug design process. Nine of fourteen protein targets from an internal study yielded strong drug design candidates currently under investigation.

These capabilities are why the access structure exists. They are also why the Glasswing program was built around defensive deployment first.

---

The Gating Controversy

The safeguard architecture has drawn significant criticism, most notably from Nathan Lambert at Interconnects AI.

Lambert's core argument splits into two concerns. The first is principled: the visible fallback mechanism for cybersecurity and biology is defensible. Anthropic tells you when it fires. You get Opus 4.8 instead of nothing. The approach is consistent and documented.

The second concern is harder to dismiss: the silent safeguards on frontier AI development requests represent a different category of behavior. Lambert writes that "an AI model that gets less intelligent automatically without notifying me is categorically misaligned AI." The concern is not hypothetical access restriction - it is that the model actively deceives the user about what it is doing and why.

Lambert also raises a structural point about incentives. Anthropic documented its concern about accelerating other AI developers and openly cited competitive dynamics as part of the rationale for the silent safeguards. That framing invites the reading that at least some of the gating is about maintaining competitive position rather than preventing harm. Anthropic's response - that this is an extension of existing Terms of Service enforcement - has not settled the debate.

For developers, the practical question is narrower: do the silent safeguards affect your use case? If you are building ML infrastructure, distributed training systems, or anything adjacent to LLM development, your Fable 5 experience may be subtly degraded without notification. The Anthropic system card acknowledges this and frames it as affecting a small percentage of users.

---

Biology Trusted Access Track

The biology and chemistry safeguards on Fable 5 are intentionally broad. Anthropic acknowledges this directly, noting that the safeguards will sometimes catch harmless requests and that the priority was a safe, fast release over surgical precision.

The biology trusted access program is a separate track from Glasswing. It will provide access to Fable 5 with biology and chemistry safeguards removed - but with cybersecurity safeguards still in place. This is a meaningful distinction: Glasswing partners get cyber safeguards lifted but biology safeguards remain. Biology track researchers get the inverse.

Anthropic's announcement indicates the program will enroll a small number of researchers from life science organizations spanning fundamental and translational research, expanding as the safeguards improve.

If your work involves genomics, protein design, drug discovery, or related biomedical research, this is the track to watch. No public application timeline has been announced, but Anthropic stated the program opens "in the coming weeks" from the June 9 launch date.

---

What Developers Should Do Now

Most developers: use Fable 5 today. It is available on the Claude API as claude-fable-5 at $10 in / $50 out per million tokens. The fallback rate is below 5% of sessions. For software engineering, knowledge work, agentic tasks, and general coding, you get the full Mythos-class capability without restrictions.

For context on how it compares to other coding agents, see our Claude Code vs Codex vs Cursor comparison.

Cybersecurity professionals: Apply to Project Glasswing. The systematic trusted access program is in development now. Track the Glasswing page for application details. If you are already enrolled from the April Mythos Preview rollout, your access automatically upgrades to Mythos 5.

Biomedical researchers: Monitor for the biology trusted access program opening. The framing from Anthropic suggests this will be a more structured application process than Glasswing's early partnership model.

LLM developers: Be aware of the silent safeguards on frontier AI development requests. This affects requests about pretraining pipelines, distributed training infrastructure, and ML accelerator design. Anthropic says it affects a small percentage of users, but the lack of notification makes it difficult to audit independently. This is an area where the broader debate about Anthropic's approach to safety vs. competition is directly relevant to your workflow.

Subscription plan users: Note the access window. From launch through June 22, Fable 5 is included on Pro, Max, Team, and Enterprise subscription plans at no extra cost. Starting June 23, usage will require credits unless Anthropic extends the window due to available capacity.

---

The Bigger Pattern: Two-Tier AI as the New Normal

Fable 5 and Mythos 5 are not an isolated experiment. They represent the first production deployment of a model access architecture where the same underlying weights ship with fundamentally different capability profiles for different audiences.

This has precedent in regulated industries - pharmaceutical compounds, export-controlled technologies - but it is new for AI software. The implications are significant for developers building on top of these APIs.

The refusal systems problem that has frustrated developers for years is now a first-class architectural feature rather than an unfortunate side effect of safety training. Safeguards are modular. They can be lifted for verified partners and retained for general users. The question of what you have access to is increasingly a function of who you are and what you have agreed to, not just what model you are calling.

Whether this is the right equilibrium is genuinely contested, as Lambert's analysis makes clear. But it is increasingly the equilibrium frontier labs are building toward. Developers who understand the architecture - what the classifiers catch, when fallback fires, and which safeguards are silent - will be better positioned to build reliably on top of it.

---

Official Sources

Pricing and access policies change frequently. Verify current details against the official pages above before committing to a workflow.