Claude Mythos 5 Access Rules: Who Gets Project Glasswing and Why

When Anthropic launched Claude Fable 5 on June 9, 2026, the second model in the announcement mattered more to security teams than the headline. Fable 5 is, in the release’s words, “a Mythos-class model that we’ve made safe for general use,” and its restricted sibling Claude Mythos 5 shipped the same day to a narrow partner set through Project Glasswing (June 9 release). Two facts from that page do a lot of work, and both are easy to get wrong. Fable 5’s production classifiers do not simply refuse offensive-cyber requests; flagged cybersecurity, biology/chemistry and distillation requests are handled by Claude Opus 4.8 instead. And the access rules published that day are launch policy, not a fixed state: the page now also carries a June 12 notice that “We are suspending access to Claude Fable 5 and Claude Mythos 5,” followed by a July 1 update that “Claude Fable 5 and Mythos 5 are now available.”

Same model, different permission layer

Claude Mythos 5 is “the same underlying model as Fable 5, but with the safeguards lifted in some areas” (June 9 release). It is not a smaller or separately trained variant. Anthropic’s early data puts classifier fallbacks at under 5% of sessions, and for sessions with no fallback, Fable 5’s performance is “effectively the same as that of Mythos 5.”

The automated alignment assessment reads: “Mythos 5’s level of misaligned behavior (including misaligned actions taken by the model such as deception and cooperation with misuse of the model by a user) was low, and similar to that of Opus 4.8.” Because the two share one model, the release says Fable 5’s alignment will be similar; the full assessment sits in the system card.

Mythos 5 supersedes Claude Mythos Preview, the first Mythos-class model, released through Project Glasswing in April 2026 (Opus 4.7 announcement). The June 9 release describes Preview’s audience as a “limited group of cyber defenders and critical software infrastructure providers”. It describes Mythos 5 as “an upgrade to Claude Mythos Preview,” deployed “in collaboration with the US government,” at $10 per million input tokens and $50 per million output tokens for both models, which the company notes is less than half of Mythos Preview’s price.

What Fable 5’s classifiers actually do

This is the part of the June 9 release most often misread. Fable 5 ships with classifiers described as “separate AI systems that detect potential misuse, including jailbreak attempts, and prevent the main model (in this case, Fable 5) from responding.” In production, three domains are flagged: cybersecurity, biology and chemistry, and distillation. For those, “the response is automatically handled by Claude Opus 4.8 instead,” and users are informed when it happens. Anthropic argues this beats refusal: “a response that falls back to Opus is a far better experience than an outright refusal from Fable.” The tuning is deliberately conservative, and the classifiers “sometimes catch harmless requests, though they trigger, on average, in less than 5% of sessions.”

The graph in the release showing zero progress on offensive-cyber tasks comes from a different configuration. It ran “Fable 5 in a mode that blocks responses rather than falling back to Opus 4.8,” an evaluation mode used for cyber testing. Shipped Fable 5 does not block a flagged offensive-cyber request; Opus 4.8 answers it.

On robustness, the vendor-reported evidence is strong but not clean. One external partner found that “Fable 5 complied with zero harmful single-turn requests relating to planning a cyberattack, exploit development, or defense evasion,” with or without any of 30 public jailbreak techniques, and an external bug bounty “produced no universal jailbreaks in over 1,000 hours of testing.” The same paragraph concedes that “the UK AISI has made progress towards one within a brief initial testing window.”

Who gets access, as of the June 9 release

The availability note is exact: “Claude Mythos 5 is restricted to Glasswing partners (with cyber safeguards lifted) and soon to select biology researchers (with biology and chemistry safeguards lifted) only, until our broader trusted access program is available.” Each track lifts a different layer.

Two consequences follow. No announced track lifts everything: a Glasswing partner works with cyber safeguards removed, while the biology program provides “access to Fable 5 with the biology and chemistry safeguards removed (but the cyber safeguards still in place).” A biologist in that program should still expect cyber-flagged requests to route to Opus 4.8, and the release describes no track that lifts the distillation classifiers. Biology access was also a plan rather than an open door: the enrollment language is the “coming weeks” sentence above, with no application process described. Whether that program has since opened, and on what terms, requires a primary source newer than June 9. The current models overview publishes no Mythos model in its comparison table and mentions a Claude Mythos 5.1 only in a pricing footnote, with no access details (models overview).

Glasswing itself had no self-serve signup at launch. The release describes periodic partner additions “in consultation with the US government,” plus the planned application route above. For cyber work that stays within normal bounds, Anthropic pointed professionals at a separate April program: the Opus 4.7 announcement invites those doing “vulnerability research, penetration testing, and red-teaming” to join its Cyber Verification Program (Opus 4.7 announcement). That is an Opus-tier path, not Mythos access.

The 30-day retention policy reaches Fable 5 too

The retention change applies to “all traffic on Mythos-class models, on both first- and third-party surfaces,” and Fable 5 is itself Mythos-class. Choosing Fable 5 over Mythos 5 does not move your traffic outside the window, which matters for teams handling sensitive research data. Anthropic commits that it “won’t use this data to train new Claude models, or for any non-safety-related purpose,” logs all human access to the data, and deletes it after 30 days in almost all cases. The stated purposes are defense against novel attacks, including jailbreaks that operate across many requests, and reducing classifier false positives. Whether partner-conduct review is part of this is not stated, so treat it as a possibility rather than a published term.

If you cannot get Glasswing access

For most teams the answer is a Fable-family model plus the fallback behavior above. The lineup has moved since June: the current models overview lists Claude Fable 5 among legacy models and points demanding reasoning and long-horizon agentic work at Claude Fable 5.1 (claude-fable-5-1), at the same $10 per million input and $50 per million output tokens, with a 1M-token context, 128K max output, and adaptive thinking always on (models overview). The pricing notes mention Claude Mythos 5.1 alongside it, but the page publishes no access details for any Mythos model. The June 9 statements describe Mythos 5; do not assume they carry over to a successor.

One cost note survives the model change: the tokenizer introduced with Opus 4.7 maps identical input to more tokens, “roughly 1.0–1.35× depending on the content type” (Opus 4.7 announcement). Teams migrating from pre-4.7 models should measure real traffic rather than assume parity.

If your cybersecurity or biology work fits inside standard safeguards, the fallback is less painful than a refusal: flagged requests get Opus 4.8, which the release calls “a highly capable model in its own right.” If the work genuinely needs lifted safeguards, there is no purchase to make. The route is Anthropic’s approval, which at launch meant being added as a Glasswing partner.

Permission as the control surface

Glasswing is Anthropic’s answer to a narrow question: how to give the strongest model to partner roles that need it without exposing it broadly. For Mythos 5 the control surface is permission, backed by restricted enrollment, government consultation, and 30-day retention, not a capability reduction. Capability controls do appear elsewhere in the same program. The Opus 4.7 announcement notes that “during its training we experimented with efforts to differentially reduce these capabilities,” and Fable 5’s classifiers were deliberately tuned wide to buy release speed, with narrower safeguards promised as false positives fall.

The capability claims that motivate the lockdown are vendor-reported. Anthropic says Mythos 5 “has the strongest cybersecurity capabilities of any model in the world,” and reports internal results including accelerating aspects of drug design “by around 10 times,” strong design candidates from 9 of 14 protein targets, and scientists preferring Mythos 5’s molecular biology hypotheses about 80% of the time in blinded comparisons against Opus-class models. Independent checks of the underlying cyber record are partial. A University College London study took six public or high-confidence Mythos-linked systems bugs and tested whether frontier models could rediscover them when handed the vulnerable file; GPT-5.5 xhigh matched the target in 5 of 18 attempts, Claude Opus 4.7 in 1, and Kimi K2 in 0 (rediscovery study). The study does not test Mythos itself and does not refute Anthropic’s workflow. Its point is narrower and useful: the public record does not yet separate model capability from search architecture and budget, which is one more reason access decisions rest on Anthropic’s own assessments rather than public replication.

The practical summary has not changed since June. The route to Mythos 5 is an approval, not an API key; the safeguard configuration you get depends on which track admits you; and since access was suspended once already, check Anthropic’s current pages before building a dependency on either model.