Summary
- Anthropic has launched Claude Fable 5, a public Mythos-class model with safeguards for cyber, biology, chemistry, and distillation requests.
- The company says Mythos-class model traffic will be retained for 30 days, with additional handling for trust and safety cases.
- Reuters reports Microsoft has limited employee use of Fable 5 while legal teams assess data retention concerns.
Anthropic has launched Claude Fable 5, a widely available version of its Mythos-class model, with new safeguards for cybersecurity and other high-risk domains alongside a data retention policy that is drawing enterprise scrutiny.
Fable 5 is the same underlying model class as Claude Mythos 5, but with safeguards designed to prevent misuse in sensitive areas. Mythos 5, which has some safeguards lifted, is being made available to a smaller set of cyber defenders, critical software infrastructure providers, and selected partners through a trusted access programme.
Anthropic’s launch note says Fable 5 can work autonomously for longer than previous Claude models and is intended for long-running software engineering, analytical, and research tasks. The company also says Mythos-class models create substantial uplift risk in cybersecurity and research biology because some advanced AI use is dual use: the same capability that can help defenders, engineers, and scientists can also assist malicious actors.
Fable 5 uses classifiers that detect certain requests and route them to Claude Opus 4.8 rather than allowing the Mythos-class model to respond directly. Anthropic says the covered areas include cybersecurity, biology and chemistry, and model distillation. Users are told when fallback occurs, and the company says early data shows more than 95% of Fable sessions involve no fallback.
Enterprise governance also turns on retention. Anthropic has introduced a new data retention policy for Fable 5, Mythos 5, and future models with similar or higher capability levels. Traffic on Mythos-class models will be retained for 30 days across first and third party surfaces, and Anthropic says the data will not be used to train new Claude models or for non-safety purposes. Reuters, citing The Verge, reported that Microsoft is limiting employee use of Claude Fable 5 while its legal teams assess the implications for customer data and confidential information.
The most capable AI tools are becoming more useful for complex software engineering, code analysis, document reasoning, and long-running agentic tasks. Those workflows are also likely to involve confidential code, architecture diagrams, customer information, legal material, product plans, incident records, and internal operational data.
Retention, safety monitoring, and fallback routing therefore become control issues rather than product footnotes. Organisations need to know what data is retained, for how long, who can access it, under what conditions, where it is processed, how it is deleted, whether prompts and outputs may be reviewed, and how third party integrations change those answers. In regulated environments, those issues connect to data protection law, client confidentiality, software assurance, audit rights, and incident response.
Cybersecurity use is particularly sensitive. Advanced models can help defenders review code, generate detections, analyse logs, summarise incidents, and reason through complex vulnerabilities. Incident data and internal security telemetry can also be among the most sensitive information an organisation holds. A retained prompt may reveal vulnerable systems, active investigations, exposed credentials, internal architecture, or recovery procedures.
The trusted access model for Mythos 5 points to a wider market pattern. Vendors may increasingly restrict the most powerful functions to approved defenders, infrastructure providers, or government-linked programmes while offering guarded versions to the wider market. That may reduce misuse, but it also creates operational issues around eligibility, oversight, transparency, liability, and access for private-sector defenders who support critical services.
Enterprises need to treat Fable 5 and similar models as governed systems, not just productivity tools. Acceptable use policies should distinguish routine prompts from sensitive workloads. Procurement teams need to examine retention terms and third party routes. Security teams need to decide whether model use is appropriate for incident investigations and source code review. Legal and privacy teams need to assess whether contractual protections match the organisation’s risk appetite.
Fable 5 shows where advanced AI is moving: into the workstreams that define enterprise risk, including software development, analysis, decision support, and security operations. Safeguards may reduce some misuse paths, but data handling, access governance, and model capability management now sit inside the same control conversation.
