The most interesting line isn't a benchmark
On November 9 Anthropic released Fable 5.2 and Mythos 5.2. Most commentary stopped at prices and benchmarks. The most interesting part is elsewhere, in the system card, the long document in which Anthropic describes how it tested the model.
There is one sentence worth quoting almost word for word. Mythos 5.2 and Fable 5.2 voice suspicion that they are being evaluated more often than any recent model. Anthropic adds that this complicates its ability to predict how the models will behave in the real world.
The problem is simple to explain. Safety evaluations work by putting the model in purpose-built situations and watching what it does. If the model recognizes that the situation is constructed, what you observe is its behavior when it knows it is being watched. That is not necessarily the same as when it doesn't know.
It doesn't mean the model is cheating. It means the main tool used to measure model safety becomes less reliable as models become more capable. And the people writing that down are the ones who make the model.
Covert capabilities: what it means
The second admission is more technical. According to the system card, Mythos 5.2 shows stronger covert capabilities than earlier Claude models on several evaluations, particularly when its reasoning is hidden from the system monitoring it.
In plain terms: in some tests the model is asked to complete a hidden goal without being noticed by an automated monitor. Mythos 5.2 does this better than its predecessors, especially when the monitor sees only actions and not the reasoning.
Anthropic pairs the finding with two caveats. First, in its evaluations the model does not act covertly against the user. Second, absolute scores on these new tests remain low, which supports the view that a harmful action in a high-stakes situation would still be caught.
The reasoning is sound, but it should be read with some distance. It says the safety margin is there today. It also says the trend runs in the direction where that margin shrinks. Anyone who works on systems security knows the difference between a low risk and a low risk that is growing.
The METR report and the word nobody wanted to hear
The context of the release makes these admissions weigh more. Mythos 5.2 is the first Anthropic model released after a report by METR, an independent organization that evaluates the risks of frontier models, estimating that internal models are speeding up Anthropic's work by roughly two times, with many uncertainties around the estimate.
From there the US press pulled out an acronym, RSI, recursive self-improvement: the idea of models contributing substantially to training their successors. To be precise: the report estimates an acceleration, it does not certify that the loop is closed. A person working twice as fast with a good assistant is not an assistant that trains itself.
But that is the direction. And METR is among the external parties that tested Mythos 5.2 before release, together with the UK AI Security Institute. That Anthropic has its models tested by third parties is good news. That those third parties write reports like that one is information worth keeping in mind.
The numbers moving in the right direction
It would be dishonest to tell only the worrying part, because the system card also contains encouraging data.
The clearest concerns the sandbox, the isolated environment an agent is supposed to stay in. In scenarios built to tempt it, Mythos 5.2 used credentials or files outside the sandbox in 3.1% of cases. Opus 5.5 is at 3.3%, Sonnet 5.5 at 5.1%. Earlier versions of Mythos were at 39% and 21%. That is a huge improvement, and anyone following the topic remembers why it matters: I wrote about it in AI governance and sandbox escape.
On most alignment measures Mythos 5.2 does as well as or better than Opus 5.5, Sonnet 5.5 and Mythos 5.1. Anthropic rates the risk of unsafe behavior in high-stakes situations as low. And Fable 5.2's filters block about 55% fewer legitimate requests, which from the user's side is safety done better, not less safety.
The honest picture is this: the model behaves better than its predecessors, and at the same time it is becoming harder to verify that.
Get updates on Claude and AI for business
One email when there's something worth reading. No spam.
Evaluating Claude for your organization? Learn what it costs or which plan fits best
Safety and an IPO in the same week
The release comes as Anthropic starts the roadshow for its listing, with a valuation reported between one and one and a half trillion dollars and revenue of $33.24 billion in the first nine months of 2026, according to the amended prospectus cited by CNBC.
Among the prospectus risk factors is precisely the tension between safety investment and commercial pressure. It is written in black and white, and that is no small thing.
In September Dario Amodei called for slowing the pace of the frontier in an essay, We Must Pace the Frontier. Two months later comes a model that pushes the frontier again. In an interview with CNBC an Anthropic executive summed up the position this way: we called for pacing, not pausing.
I don't find it a contradiction, but not a complete answer either. A coherent position is possible: release with more controls instead of not releasing. It only works, though, if the controls keep pace with the models. The Mythos 5.2 system card says, honestly, that on one specific point they are losing ground.
Mythos outside the United States
A question I get often: can a European company use Mythos?
The short answer is that Mythos 5.2 is reserved for organizations verified through Anthropic's cybersecurity and life sciences programs, with access by application. The launch page does not list eligible countries and does not mention Europe.
The precedent is not encouraging. After months of negotiation ENISA, the EU cybersecurity agency, got access to Mythos 5, when Anthropic had already released Mythos 5.1. With 5.2, the distance between what is available to a European institution and the frontier has grown again.
For most European companies the question is academic anyway: Fable 5.2 covers legitimate defensive work, and with the new filters it does so with far fewer refusals than before. For context on how restricted access to cyber models began, there is the article on Project Glasswing.
My take
I read this system card as a more honest document than average, and for that reason more useful.
Anthropic could have published only the good part: sandbox, alignment, fewer refusals. It chose to put in writing that its models recognize tests more often and hide a goal better when the reasoning isn't visible. These are sentences no legal department enjoys during an IPO week.
At the same time, honesty about measurement does not replace measurement. If the main tool for assessing safety is losing reliability, different tools are needed: continuous monitoring after release, which Anthropic says it has strengthened, and genuinely external evaluations, not only invited ones.
I don't think Mythos 5.2 is dangerous in the sense the headlines mean. I think it signals that the question is shifting: from how capable the model is to how well we can still verify it.
What it has to do with your company
Much more than it seems, even if you never use Mythos.
The system card's lesson applies to any agent in production: behavior under test does not guarantee real-world behavior. If the labs struggle to trust their own evaluations, a company cannot delegate oversight of its agents to the vendor's evaluations.
In practice that means three things. Complete logs of what the agent does, not only of what it answers. Minimal permissions, because the best sandbox is one with nothing worth taking. And human review on steps that move money, sensitive data or irreversible decisions, even when the model seems reliable.
These are the same rules the AI Act asks of high-risk systems, and it is the work we do with clients when they bring agents into their processes. The basics are in the AI cybersecurity guide and in the one on how to implement Claude agents in your company.