Claude Fable 5.2 Posts Top Cyber Scores, but Its Safety Fallback Weakens Agent Defences

The numbers come with two complications that matter for any company deciding where to run security work or autonomous agents. The comparison with OpenAI is less direct than it looks. And the safeguards Anthropic built to keep those offensive capabilities away from most users have, by the company's own published testing, made agents built on Fable 5.2 easier to hijack through prompt injection.

Anthropic released Fable 5.2 and a restricted sibling, Mythos 5.2, on November 9, and cut Fable's price to $8 per million input tokens and $40 per million output tokens, from $10 and $50 for Fable 5.1.

What the Benchmarks Show

On its product page, Anthropic also reports a score of 89.6% on CVE Rediscovery, an internal test of whether a model can independently find known vulnerabilities given only the affected source code, up from 78.3% for Fable 5.1. According to The Hacker News, the test drew on 1,829 advisories for open-source projects published in October 2026. Claude Opus 5.5, tested without safeguards, scored 67.6% on CyScenarioBench and 81.3% on CVE Rediscovery.

The page places the cyber scores in the Fable columns but labels them "Mythos 5.2" and "Mythos 5.1", without explanation. Mythos is the version Anthropic offers to vetted organisations and describes as its "most capable model for cybersecurity engineering". Notebookcheck reported that the two are the same underlying model, with Fable wrapped in additional safeguards, so the published scores may reflect the unrestricted configuration rather than what most customers receive.

The OpenAI comparison is also loose. A footnote on Anthropic's page says each lab's CyScenarioBench scores are based on unique tasks. The Hacker News noted that Fable's figure is a completion rate while GPT-6 Cyber's 61% is an average success rate from a separate report by Irregular, the security firm behind the benchmark, which also found that GPT-6 Cyber completed all 11 long-horizon scenarios at least once.

The Cost of the Fallback

To make Fable 5.2 broadly available, Anthropic runs classifiers that screen requests touching offensive security, risky biology and parts of AI development. When one is flagged, a less capable model answers instead: Claude Opus 4.8 for cyber topics and Claude Opus 5 for biology, according to Notebookcheck. The checks cover everything the model reads, including files, web results, memory and connector content, so text a user never typed can trigger a switch. Anthropic's page says API customers must configure a new Fallback API to handle these hand-offs.

Figures from Anthropic's system card, as reported by Notebookcheck, show what that means for agents. On Gray Swan's indirect prompt-injection benchmark, attacks succeeded 4.09% of the time against Fable 5.2, compared with 1.02% for Fable 5.1 and 0.96% for Opus 5.5. More than half of attempts against Fable 5.2, 53%, ended up being answered by Opus 4.8, against 23% for Fable 5.1. Attacks succeeded 2.05% of the time when Fable 5.2 answered itself and 5.17% when Opus 4.8 did.

Against an adaptive attacker making 200 attempts per coding scenario, 89.82% of attempts on Fable 5.2 succeeded without safeguards, almost all of them answered by Opus 4.8. Anthropic's prompt-injection probes brought that down to 28.16%, still well above the 11.13% Opus 5.5 recorded under the same conditions. None of the 43 requests Fable 5.2 handled itself in that test were compromised, though the sample is small.

Automatic switching is on by default in Claude's apps, Cowork and Claude Code. Users can turn it off, in which case a flagged request pauses for editing or a model choice instead of going to Opus 4.8. Notebookcheck suggested doing so for agents that process untrusted inboxes, websites or third-party code repositories.

Security teams that need the full offensive capabilities can apply to Anthropic's Cyber Verification Program, which covers Mythos 5.2, Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models. Anthropic recommends Opus 5.5 for most tasks and Fable only for the most demanding work, and the cyber and prompt-injection figures cited here have not been independently replicated.