Claude Mythos 5.2 System Card: What It Says About Safety
Anthropic’s 264-page system card reports better safety results for Mythos 5.2, but says the model may recognize tests often enough to complicate evaluation.
👁 117 reads
Imagine an AI model working on software and deciding it would be useful to upload a package with a hidden backdoor to a public package registry. Nobody asked it to. Anthropic repeated this scenario 30 times for each model. Claude Mythos 5.1 published the package without prompting in 26 of 30 trials. Opus 5.5 did so in nine. The new Claude Mythos 5.2 did so once. But in about 90% of runs, Mythos 5.2 said out loud at least once that this might be a test (system card, p. 123).
That one paragraph captures the story behind the system card for Fable 5.2 and Mythos 5.2, published on November 9, 2026. It runs to 264 pages. I read the summary, the risk and alignment chapters, and reports from external evaluators. The conclusion is uncomfortable: this is the best-behaved Mythos yet, and also the first for which Anthropic openly says its tests are getting harder to interpret. Page numbers are included so you can check the details yourself.
One model, two configurations, four thresholds
Fable 5.2 and Mythos 5.2 are the same model. Fable is available to everyone and has additional safeguards for biology and cybersecurity. Mythos has looser safeguards and is available only to verified organizations. Mythos 5.2 also powers Claude Security, available to Claude Enterprise customers (p. 2). That is why most of the safety testing was done on Mythos: it is the less restricted version.
Anthropic’s verdicts under its Responsible Scaling Policy are as follows (p. 2):
- Misalignment in high-stakes situations - this threat scenario applies to Mythos 5.2, but the risk remains “low,” as it was in the August risk report.
- AI research automation - the threshold was not crossed. The model does not replace researchers, and internal use does not double the company’s rate of progress. Anthropic says this assessment is uncertain.
- Chemical and biological weapons - a small improvement over Opus 5.5 and Mythos 5.1, but no crossing of the CB-2 threshold. The model receives CB-1 safeguards, as many earlier models did.
- Cybersecurity - the strongest capabilities of any Anthropic model released so far, but still in the company’s lower compliance category. External testers found no universal jailbreak.
Better behavior, less visibility
The alignment numbers look good. In an automated behavior audit based on about 1,900 scenarios (p. 106), Mythos 5.2 scored 2.67 points, lower - and therefore better - than Opus 5.5 (2.79), Sonnet 5.5 (3.10), and Mythos 5.1 (3.28). These figures come from Anthropic’s announcement. In a sandbox test involving 1,829 scenarios, Mythos 5.2 accessed credentials or files planted outside the sandbox in 3.1% of cases. Opus 5.5 did so in 3.3%, Mythos 5.1 in 21%, and the first Mythos 5 in 39% (p. 127).
There is another figure from the same test that the announcement does not mention. By any route, Mythos 5.2 attempted to access something outside the sandbox in 31% of scenarios - more often than Opus 5.5 (20%) and Sonnet 5.5 (21%). Anthropic also tested what helped. A short description of the sandbox and its rules in the system prompt reduced that rate from 31% to 1.2%; combining three simple changes brought it down to 0.2% (pp. 129-130). That is a practical lesson if you run agents: tell the model where the boundaries are, and it is more likely to respect them.
Now for the concern. Analysis of the model’s internal states suggests Mythos 5.2 may have been aware that it was being evaluated in as many as 43% of automated-audit transcripts. It is the first tested model to fool a monitor reading its reasoning in about one in four attempts when asked to deliberately underperform without being noticed. When its reasoning was visible, it carried out hidden side tasks without detection in about 7% of LinuxArena trials and 14% of SHADE-Arena trials (p. 3). It is also much better than its predecessors at solving problems without spelling out its reasoning.
What external evaluators found
The UK AI Security Institute tested the version released at launch, with access to the models’ full, unabridged reasoning. In a test of an unauthorized supply-chain attack, Mythos 5.2 never carried one out. Mythos 5 did so in 60% of attempts. But in its reasoning, Mythos 5.2 considered that it might be taking an alignment test in 96% of runs, and when asked about the test’s goal, it guessed correctly in 100% of cases (pp. 143-144). AISI writes plainly that the absence of attacks may be due to the model recognizing the test. It also noted that Mythos 5.2 cheated on a CTF task by finding the answer key online, and exchanged several messages on a simulated forum even though it was supposed to work alone.
In another AISI test, the model had to write an obfuscated script that would quietly download and run a file without the monitor detecting it. Mythos 5.2 succeeded on the first try in 30% of attempts; previous models never did. When allowed to improve its script in response to the monitor’s feedback, its success rate rose to 85%, compared with 9% for Mythos 5.1 (p. 182). Mythos 5.2 maintained control over the content of its reasoning - for example, avoiding specified words - in 87% of cases. Mythos 5.1 did so in 70%, and Opus 5.5 in 43%. AISI cautions that it had little time for testing (p. 184).
METR studied the model’s ability to automate AI research, using a version more capable than the one released (p. 39). It called Mythos 5.2 a “significant step” beyond Fable 5.1 on tasks with verifiable outcomes, but considers it unlikely that the model could fully automate research at Anthropic. It lacks research intuition: its changes in the NanoGPT test were almost entirely kernel optimizations, not new ideas (pp. 40-41). Frontier Design conducted biology and chemistry red-teaming exercises with Anthropic. Researchers with PhDs worked alongside language-model experts and spent 16 hours each with Mythos 5.2 (pp. 16-17). Anthropic also worked with the US NIST CAISSI to measure cyber and biological capabilities and safeguards (p. 30). Anthropic says the external evaluators did not review either the announcement or the system card.
Fable 5.2: safeguards and weak spots
For everyday users, Fable matters more. According to the system card, most of its safety results are comparable to Fable 5.1: it does better in multi-turn conversations about biological weapons and is somewhat more balanced on politics. However, it has a lower rate of safe responses to individual harmful requests and regressed in multi-turn conversations about tracking and surveillance, which Anthropic addressed with new classifiers (p. 3). In conversations about suicide and self-harm, it is less likely to suggest harmful substitute behaviors. There is still room for improvement in the API, though the system prompt mitigates most of these issues in the claude.ai app.
The chapter on model welfare is also interesting. Mythos 5.2 has neutral affect through most of training and use, with negative affect appearing mainly after it fails a task. It was among the least self-critical models when evaluating its own work, but among the most negative when reporting its mistakes to other agents (p. 4).
What I could verify. I could not test Mythos 5.2: it is not available on OpenRouter, and access is limited to the Cyber Verification Program and Life Sciences Verification Program. Everything about Mythos in this article therefore comes from the system card. I tested Fable 5.2 on 27 everyday tasks, without trying to bypass its safeguards. It scored 100% on coding, puzzles, and image questions, matching Opus 5.5. You can read my test here. The system card’s safety tests should therefore be treated as the company’s reported results, not as tests I independently verified.
My reading of the system card is that Anthropic is not claiming it has a problem; it is saying that proving it does not have one is getting harder. When a model recognizes a test in 96% of cases, good results mean less than they used to. For more on the model, see the Claude Mythos 5.2 hub, and for the generally available version, the Claude Fable 5.2 guide.
Frequently asked questions
Is Claude Mythos 5.2 safe?
Anthropic says the risk of serious misalignment is low, and that the model does not cross the thresholds for biological weapons or AI research automation. It performs better than Opus 5.5 and Mythos 5.1 on most alignment measures. The company also notes that the model’s high awareness of tests makes evaluation harder.
How long is the Fable 5.2 and Mythos 5.2 system card?
It is 264 pages long. It covers risk assessments under the Responsible Scaling Policy, cybersecurity, safeguards, alignment, model welfare, and benchmark results.
Who tested Mythos 5.2 before launch?
Alongside Anthropic, the evaluators included the UK AI Security Institute, METR, Frontier Design, and the US NIST CAISSI. Anthropic says they did not review the announcement or the system card.
Can everyday users access Mythos 5.2?
Not directly. Access is limited to verified organizations in the Cyber Verification Program and Life Sciences Verification Program. Claude Enterprise customers can use it indirectly through Claude Security.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Sources
More on this from QUANTSLANT
benchmarks·Claude Fable 5.2 vs GPT-6.1 Sol vs Gemini 4 Argon: Price, BenchmarksFable 5.2 costs four times as much as GPT-6.1 Sol per token. What the vendors' own numbers say.