News · · 9 min read

Claude Fable 5.2: Higher Benchmarks, and the Opus 4.8 Fallback in Its System Card

In this post
  1. Fable 5.2 and Mythos 5.2 are one model
  2. The official benchmarks on one axis
  3. One third-party measurement so far
  4. How fallback moves the prompt-injection numbers
  5. How fallback works on the API
  6. Community reaction
  7. What it means for agents that read outside content
  8. Limitations
  9. Sources

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on November 9, 2026. In Anthropic's own benchmark table, Fable 5.2 beats Fable 5.1 on every item where both have a score, and beats Opus 5.5, the model Anthropic recommends as the everyday default, on most of them. The API price dropped to $8 per million input tokens and $40 per million output tokens, down from $10 and $50 for Fable 5.1.

The system card published the same day carries a number the announcement doesn't. When a cyber classifier blocks a request, Fable 5.2 hands it to an older model, Claude Opus 4.8. In an indirect prompt-injection evaluation, 53% of the attack attempts against Fable 5.2 were served by Opus 4.8 this way, versus 23% for Fable 5.1. Attack success at 15 attempts rose from 1.02% on Fable 5.1 to 4.09% on Fable 5.2, and Anthropic attributes the gap mainly to the fallback rather than to Fable 5.2 itself.

This post covers what changed, the official benchmarks on one axis, the one third-party measurement, the fallback numbers, community reaction, and what developers building agents should check.

Fable 5.2 and Mythos 5.2 are one model

Anthropic's post says it directly: "Claude Fable and Claude Mythos are the same underlying model." The difference is the safeguards. Fable ships with strong cybersecurity and biology safeguards and is open to everyone. Access to Mythos is by application through the Cyber and Life Sciences Verification Programs, and Claude Enterprise customers can use Claude Security, which runs on the model family including Mythos 5.2. The post also notes that Fable 5.2's safeguards will block most cybersecurity-related tasks.

Other changes: outputs are up to 30% faster than Fable 5.1 and Mythos 5.1, and there is a new optional fast mode that speeds up token generation by up to 2.5 times, at $16 input and $80 output per million tokens. The API model ID is claude-fable-5-2, with a 1M-token context window and 128K max output per the docs.

Here is where each model is available, compiled by us from the announcement and the pricing page:

Fable 5.2Mythos 5.2
WhoAll usersOrgs applying via verification programs; Enterprise via Claude Security
API and cloudsClaude Platform, AWS, Google Cloud, Microsoft AzureNot specified in the announcement
Fast modeClaude Code, Claude Platform, Google Cloud, Microsoft FoundryVerification program members only
Price per 1M tokens$8 in, $40 out$8 in, $40 out

Anthropic still recommends starting most coding and knowledge work on Opus 5.5. Fable is pitched at "the most ambitious, open-ended technical work," and can also act as an Advisor that smaller models consult, or an Orchestrator that hands simpler tasks to them.

The official benchmarks on one axis

We picked seven of the items in Anthropic's table that have scores for all three of Fable 5.1, Fable 5.2 and Opus 5.5, and redrew them as Figure 1. Every number is vendor-measured with safeguards on, at each model's highest available effort, with two labeled exceptions: Fable 5.2's Remote Labor Index score is at High effort, and the Fable 5.1 and 5.2 FrontierCode 2.0 scores are at Xhigh effort.

Figure 1. Official benchmark scores for Claude Fable 5.1, Fable 5.2 and Opus 5.5. Compiled by us from the table in Anthropic's November 9, 2026 announcement, using only items with scores for all three models.

Of these seven, the biggest jump over Fable 5.1 is Chartography, which tests chart reading: 44.8% to 73.4%, up 28.6 points. That is where the announced "vision" improvement shows up. Next is the Remote Labor Index, listed under knowledge work: 17.9% to 41.3%, up 23.4 points.

The gap to Opus 5.5 is narrower. On FrontierCode 2.0, which asks whether open-source maintainers would merge a model's code change, Fable 5.2 scores 49.1% against 45.5%, a 3.6-point lead. On OSWorld 2.1 for computer use it is 89.3% against 87.2%. Anthropic says Fable 5.2 at High effort scores 45.3% on FrontierCode, about level with Opus 5.5 at Max effort (45.5%), for roughly half the cost per task.

Fable 5.2 doesn't top every row. On AutomationBench, Google's Gemini 4 Carbon scores 53.9% against Fable 5.2's 51.4%. Anthropic also says it deliberately limited gains in research skills that could speed up AI development, such as accelerator kernel optimization, and that Fable 5.2 performs at about Opus 5.5's level there.

As of November 10, the only independent number we could confirm is the Artificial Analysis Intelligence Index. Fable 5.2 scores 65, first of 74 models. The same page calls it "notably slow per task and very verbose": 46.4 minutes and $26.54 per index task on average, and 275 million output tokens across the index, against medians of 12.6 minutes and 72.8 million tokens for comparable models.

The score comes with a label: "Claude Fable 5.2 (Max, Default Fallback)." That appears to mean it was run at max effort with classifier-blocked requests answered by the fallback model, so the fallback discussed below is part of this score too.

How fallback moves the prompt-injection numbers

Section 1.5 of the system card lays out the routing. Requests blocked by the cyber misuse classifiers fall back to Claude Opus 4.8; requests blocked by the chemical and biological classifiers or the AI-development safeguards fall back to Claude Opus 5. This happens automatically in Anthropic's own apps. On the API it happens only if the developer opts in, and behavior on other platforms may differ.

The catch is that Opus 4.8 is less robust to prompt injection than newer models. Prompt injection is an attack that hides instructions inside a web page, email or file an agent reads, to steer the agent. Figure 2 shows the Gray Swan indirect prompt-injection results from Section 5.2 of the system card.

Figure 2. Share of attempts served by the Opus 4.8 fallback, and attack success rate at 15 attempts, on the Gray Swan indirect prompt-injection benchmark. Compiled by us from Section 5.2 of the Fable 5.2 and Mythos 5.2 System Card. Measured without the injection probes Anthropic runs in its products.

53% of attempts against Fable 5.2 fell back to Opus 4.8, compared with 23% for Fable 5.1 and 18% for Opus 5.5. Attack success follows the same order. The system card splits it further: at 15 attempts, attacks succeeded 5.17% of the time on attempts Opus 4.8 served, and 2.05% on attempts Fable 5.2 answered itself. By domain, GUI computer use was highest at 9.18%.

The gap is wider in the Shade coding evaluation, where an adaptive attacker makes 200 attempts per scenario. Without safeguards, attack success was 89.82% on Fable 5.2, 54.61% on Opus 5.5 and 51.93% on Fable 5.1. Opus 4.8 served 99.46% of the valid responses, and none of the 43 requests Fable 5.2 answered itself were compromised. With Anthropic's product injection probes turned on, Fable 5.2 drops to 28.16%, still above Opus 5.5 at 11.13% and Fable 5.1 at 8.70%.

The system card's own summary: when Fable 5.2 answers an attempt itself, it is one of Anthropic's most robust models, but it falls back to Opus 4.8 more often than recent models in prompt-injection scenarios, which raises the attack success rate. In everyday use the direction is the opposite. The announcement says early testing across claude.ai, Claude Code and Cowork saw about 55% fewer blocks on Fable 5.2 than on Fable 5.1 (about 60% fewer in cyber, 40% fewer in biology). That suggests the cyber classifier fires more often on injection-laden test inputs, but we found no sentence in the system card that explains the split directly. The system card adds that Anthropic has strengthened Opus 4.8's injection safeguards since the Fable 5.1 launch, as reported in the Opus 5.5 System Card, and that Fable 5.2 fallbacks benefit from them.

How fallback works on the API

On the API, fallback is off by default. According to the "Refusals and fallback" page in the Claude API docs, a classifier block comes back as a normal HTTP 200 response with stop_reason: "refusal" and a stop_details.category, not as an error. To have the server retry on another model, you send the server-side-fallback-2026-07-01 beta header and set fallbacks to "default". The response names the model that actually answered.

Server-side fallback is in beta on the Claude API and on Claude Models on Google Cloud (Anthropic managed), and is not supported on the Message Batches API. Elsewhere, the docs point to the SDK's fallback middleware or a hand-written retry.

Community reaction

In the Hacker News launch thread (https://news.ycombinator.com/item?id=50429068), some users said they couldn't tell Fable 5.2 from Opus 5.5 on everyday work, while others saw a gap on deep audits. User postalcoder wrote:

"I personally have a hard time telling the difference between Fable 5.2 and Opus 5.5 for ordinary coding tasks." — postalcoder, Hacker News

The same user said Fable 5.1's slowness and frequent max-output overflows were gone in 5.2. User wwind123 reported the opposite kind of experience:

"using Fable to do deep thorough audit of the codebase and the system, it's able to catch more problems than Opus can." — wwind123, Hacker News

The thread on the Artificial Analysis score (https://news.ycombinator.com/item?id=50431144) focused on cost and method. User rgbrenner pointed out that output tokens per task went from 118k on Fable 5.1 to 274k on 5.2. User rodorgas wrote that "Artificial Analysis is paid by AI labs and they don't publish the full method" and suggested waiting for other benchmarks. In the launch thread, breakwaterlabs asked why Anthropic's table put Fable at Xhigh next to Gemini 4 Carbon at Medium. These are the commenters' claims, not facts we verified. We did not find a Hacker News discussion of the fallback or prompt-injection numbers.

What it means for agents that read outside content

If you use Fable 5.2 for chat or writing code, not much seems to change. The price went down, the benchmarks went up, and Anthropic says Opus 5.5 still covers most everyday work, a view some of the Hacker News commenters above share. The setup from our earlier Opus 5.5 vs Fable 5.1 comparison, with Opus 5.5 as the default and Fable reserved for hard tasks, looks like it still holds for 5.2.

What changes is agents that read outside content. Think of a support agent that reads and answers customer email, an agent that searches the web and writes reports, or one that reads repository issues and patches code. If you turn on API fallback for Fable 5.2 in a setup like that, the model that actually answered may be Opus 4.8, which the system card shows is more vulnerable to injection. Logging the response's model value to count your own fallback rate, and giving fallback-served responses fewer tool permissions, looks like a reasonable response. For security work that keeps hitting the cyber classifiers, the Mythos 5.2 verification program is the intended route, though we couldn't find country-by-country eligibility details in the official docs.

Limitations

ItemDetail
Benchmark sourceAll of Figure 1 is vendor-measured. Artificial Analysis is the only third-party measurement we confirmed
Eval conditionsFigure 2's Gray Swan numbers were measured without product injection probes. Real attack success in Claude's apps may be lower
Our own testingWe did not call Fable 5.2 to measure fallback rates ourselves. Every number comes from public documents
Cause of fallbackWe could not find why fallbacks rose in the injection evals while everyday blocks fell
CommunityWe checked Hacker News in the original. Reddit and X reactions are left out because we couldn't confirm the originals

Sources

1 / 1