Same Model, Two Safeguard Profiles, and a Cache Read That Costs 2.5 Percent of Input

On 1 September 2026 Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. The headline rate did not move: input stays at 10 dollars per million tokens and output at 50, the same as Fable 5. What moved is the cache. A cache read fell from 1 dollar per million tokens to 25 cents, a 75 percent cut, which puts a cached token at 2.5 percent of the price of a fresh input token. Anthropic states that typical workloads land around 25 percent cheaper than on Fable 5 and that agentic workloads can reach roughly 45 percent. The capability numbers moved too, and by more than a point release usually implies: Terminal-Bench-Science 0.1 went from 24.7 to 52.6 percent, CursorBench 3.2.0 from 70.5 to 73.4, and Humanity’s Last Exam without tools from 57.8 to 60.9. Underneath the benchmark table sit two changes that will outlast the news cycle, and neither of them is a score.

The first is what a near free cache read does to how you build. For most of the last two years the standard cost advice was to trim context, because every token in the prompt was a token you paid full rate for. At 25 cents per million on a read, that advice inverts for anything repetitive. A long, stable system prompt, a fixed repository map, a set of instruction files, a retrieved policy document: if those are identical turn after turn, the expensive part is no longer holding them, it is changing them. Cache hit rate becomes a first class operational metric alongside latency and token count, and the design goal shifts from making the prompt short to making the prefix stable. That is a genuinely different discipline. It rewards teams who treat prompts as versioned, reviewed artefacts and punishes teams who edit a system prompt in a dashboard on a Tuesday afternoon, because every edit invalidates the prefix and every invalidated prefix is paid for again at full input rate.

The second thing worth knowing before you rewrite anything is where the discount does not apply. A cache write still costs more than a plain input token, so caching only pays when reuse actually happens, and a workload with high prompt variance or low request volume can spend more on writes than it saves on reads. Caches also expire, which means a chat product with long idle gaps between turns behaves very differently from an agent loop that fires continuously for twenty minutes. And a discount this large invites the specific mistake of stuffing more context in because it now feels free, which costs you in latency and in the quality of the attention the model gives the part that mattered. Measure the hit rate, not the invoice. An invoice that fell 25 percent while the hit rate sat at 40 percent is telling you there is another 25 percent still on the table.

The other half of this release has nothing to do with money. Fable 5.1 and Mythos 5.1 are, by the vendor description, the same underlying model with the same capabilities, differing only in which safeguards apply. Mythos 5.1 loosens restrictions for vetted professionals and is available only through two verification programmes, the Cyber Verification Program for defensive security work and the Life Sciences Verification Program for research and development, and only to organisations in the United States for now. Read that carefully, because it is a structural statement about how frontier models are going to be sold. The thing separating the permissive product from the general one is not the weights, the architecture or the training data. It is an eligibility decision and a policy configuration held entirely by the supplier, applied to your account, and revocable by them.

That has a direct consequence for anyone running an AI management system. If your organisation holds trusted access, the model you are using is not the same system as the one your colleagues call from the general API, and it does not belong in the same inventory row. Under ISO 42001 it earns its own entry: which safeguard profile is in force, which programme granted it, who inside the company is verified, what the intended use is, and what your fallback is on the day verification lapses or is withdrawn. That last one is the question most teams will not have asked. A workflow built around permissive vulnerability analysis that silently reverts to standard refusals is not a degraded workflow, it is a broken one, and finding out during an engagement is the wrong time. Vanta, Drata, Secureframe, Sprinto, Thoropass and Hyperproof will all track this as a monitored control with an owner and a review date once somebody tells them there are two entries rather than one. None of them will discover the second entry on their own.

There is a change in Fable 5.1 that reaches everyone, not only the verified minority, and it is easy to miss in the pricing coverage. The general model now permits identifying software vulnerabilities, with the vendor reporting roughly 60 percent fewer safety interventions per session than the previous generation. If you are building on Claude, the set of requests that used to come back refused just got smaller, without you changing a line. Plenty of products have been relying on model refusal as a de facto control, sometimes without anyone writing it down: the model would not do the risky thing, so no one built a guardrail for it. That was never a control you owned, it was a vendor default you inherited, and this release is a clean demonstration of why the distinction matters. If a category of output would be a problem in your product, the check for it belongs in your code, your system prompt and your evaluation suite, where you can version it and evidence it.

Framed properly, this is an ordinary change management event with an unusual trigger. Under SOC 2 and ISO 27001 a supplier altering the behaviour of a component in your production path is exactly the kind of change your process exists to catch, and the fact that the price list did not move makes it easier to miss, not less significant. The practical control is version pinning: if any part of your stack resolves a model by a floating alias rather than an explicit version, a capability and safeguard change lands in production the moment the vendor flips it, and your evaluation suite runs after the fact if it runs at all. That applies well beyond direct API use. Cursor, Devin, an app assembled in Bolt, v0 or Lovable, or an ElevenLabs voice front end calling a text model behind the scenes will each inherit both the cache discount and the safeguard change on whatever schedule their own vendor chooses, which is a schedule you do not control and usually cannot see. For teams inside the European Union there is one more line for the register: the permissive tier is currently limited to United States organisations, so the option simply is not available to you, and under the EU AI Act it is better to record that asymmetry deliberately than to trip over it mid incident.

The work this week is small and worth doing in order. Measure the cache hit rate on your highest volume path before you touch anything, because you cannot claim a saving you did not baseline. Freeze the prompt prefix and start treating prompt edits as releases with a diff and an owner, which is the change that converts the 75 percent cut into a real number rather than a theoretical one. Re-run any evaluation that depends on the model declining a request, because that behaviour has demonstrably shifted and your suite is the only thing that will tell you by how much. And if anyone in your organisation has applied for or holds trusted access, get a second row into the AI inventory today with a named owner and a documented fallback. None of that requires a project. It requires an afternoon and someone willing to write down which model is actually running, under which safeguards, at whose discretion.