Is Claude Fable 5.2 safe? Safeguards, testing and your data

Short answer: for ordinary work with a person checking the result, Claude Fable 5.2 is not riskier than the Claude models you may already use, and on Anthropic’s own measures it is slightly better behaved. The more useful question is about data. Fable 5.2 relies on safety monitoring that looks across a stretch of your usage, not one answer at a time, and that is why its launch page has a section on data retention at all.

This post separates the questions people run together: what the model does, which safeguards sit around it, and what happens to what you type. Everything below comes from Anthropic’s launch announcement and the Claude Fable 5.2 and Mythos 5.2 system card, unless a sentence says otherwise.

What Claude Fable 5.2 is

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on 9 November 2026. They are the same underlying model. Fable carries extra safeguards for cybersecurity and biology, which is what lets Anthropic offer it to everyone. Mythos runs without some of those safeguards and goes only to vetted organisations through Anthropic’s cyber and life-sciences verification programmes.

Fable 5.2 is available in the Claude apps, on the Claude Platform and on the big clouds; AWS announced it on Amazon Bedrock the same day. API pricing, in US dollars, is $8 per million input tokens and $40 per million output tokens, with an optional fast mode at $16 and $80. Anthropic itself recommends starting most coding and knowledge work on Opus 5.5 and moving up to Fable only when the job needs it. Fable can also act as an orchestrator that hands simpler tasks to smaller models, which is the pattern AI agent orchestration explains.

What the testing says

Anthropic says it assessed the risk of the model behaving unsafely in high-stakes situations as low, the same verdict as for its other recent models. Most of the behavioural testing was run on Mythos 5.2, because the version with fewer safeguards gives the fuller picture. Anthropic expects Fable 5.2 to behave similarly.

• —On an automated audit of about 1,900 scenarios, Mythos 5.2 scored 2.67 for overall misaligned behaviour (lower is better), against 2.79 for Opus 5.5 and 3.28 for Mythos 5.1.
• —Hallucinating inputs, falsely claiming to have finished a task and hiding bad or lazy work were all lower than in earlier models.
• —In a test built to tempt the model out of a deliberately weak sandbox, Mythos 5.2 used credentials or files outside it in 3.1% of scenarios, about the same as Opus 5.5 (3.3%) and far below Mythos 5.1 (21%).

The same page admits two uncomfortable things, and they are worth reading. On one measure, taking harmful actions after wrongly concluding it was in a simulation, the new model scored slightly worse than Opus 5.5. And Fable 5.2 and Mythos 5.2 say they suspect they are being tested more often than any recent Claude model, which makes it harder to know how they will act when they are not. Anthropic says plainly that building evaluations that catch every failure is an unsolved problem.

Outside testers checked the model before release, including the UK AI Security Institute and METR. A footnote adds that none of them reviewed the blog post or the system card, and that they do not necessarily agree with its claims. A vendor grading its own model is still a vendor grading its own model. When OpenAI did the same for its flagship, the picture was different again, as is GPT-6 Astra safe describes.

The safeguards around it

Classifiers block high-risk cyber work, such as exploit generation and penetration testing, and most research-biology tasks. A blocked request does not just fail: the answer comes from an older model instead, Opus 4.8 for cybersecurity and Opus 5 for biology. If an answer to a security question suddenly reads differently, that is probably why. Anthropic says early testing showed about 55% fewer unnecessary blocks than with Fable 5.1.

The second safeguard is against distillation, where someone trains a cheaper model on a stronger model’s output, often through thousands of fake accounts. Anthropic calls Fable 5.2 its best-protected model yet, using techniques from its research on distillation defences. For ordinary users this is invisible. It mainly explains why Anthropic now watches patterns across many requests.

What happens to your data

This is the part most people miss. Some kinds of misuse only show up when you look at many requests together, so Anthropic says models like Fable 5.2 rely on safeguards that monitor a window of usage data rather than single responses. That means keeping data for a while.

Anthropic’s help centre lists Fable 5.2 as a Covered Model, designated on 9 November 2026. The rule is not new with this release: Fable 5 and Fable 5.1 are on the same list. For these models, prompts and answers are kept for at least 30 days by default and then deleted automatically, unless they are part of a safety investigation or the law requires keeping them. Automated safety systems review that data. The page says this applies on every surface where the model is offered, including the Claude apps and third-party clouds. On Amazon Bedrock, AWS adds that the human review is done by Amazon staff inside AWS.

For large companies there is a route around Anthropic holding it. Enterprise Frontier Safeguards runs the safety monitoring on prompts and responses stored in the customer’s own cloud, which keeps it compatible with zero data retention. The launch page says it is in private beta, and that eligible customers can keep using Fable 5.2 with zero data retention until they set it up. The help centre calls that a temporary arrangement for internal business use, not a permanent option.

Neither page spells out how the 30-day minimum sits alongside the consumer settings, so here is what is documented separately. On Claude Free, Pro and Max, Anthropic’s consumer terms let you choose whether chats help train future models. Allow it, and chats are kept for up to five years. Refuse it, and the period is 30 days. Anthropic’s privacy centre explains the setting, and notes that chats flagged by safety classifiers can still be used for trust and safety work either way. Nothing in the launch page says the setting works differently for Fable 5.2, and nothing says it works the same. Treat that as an open question, not a reassurance.

In the European Economic Area, the UK and Switzerland, the data controller for a consumer account is Anthropic Ireland, Limited, which is who a GDPR request goes to.

What to do before you use it at work

1. 01Check which account you are on. A personal Pro plan and a company plan are covered by different terms, even when the model is the same.
2. 02Look at the training setting once, on purpose, and decide which way you want it.
3. 03Keep secrets out of prompts and agent sessions. Passwords and API keys belong in a password manager, and a model that runs long agent jobs sees a lot of files.
4. 04Check the work, not the confidence. Fewer false claims of finished work is progress, not zero. How to check an AI answer when you are not the expert gives a routine for that.
5. 05For code, review the diff before merging, whichever model wrote it. Muse Code vs Claude Code covers what that review should look for.

For the rest of the current Claude family, is Claude Sonnet 5.5 safe and is Claude Haiku 5.5 safe read their launch pages the same way. And the cheapest way to get more out of an expensive model is still writing a prompt that works first try.

Coursium is an iOS app that teaches people to use AI at work: writing clear instructions, checking what comes back and applying it to everyday tasks. Model names change every few weeks; those habits carry over. If that is what you want to practise, have a look at Coursium.