Claude Fable 5.2: 76.3% on CyScenarioBench

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on Monday, November 9, 2026. The company says the pair is stronger at coding, reasoning, and vision, and that high-stakes misalignment risk stays low. On the measure a security team can use, Fable 5.2 scored higher than OpenAI’s GPT-6 Cyber on a multi-stage cyber benchmark.

Irregular’s CyScenarioBench tests whether a model can plan and carry out a multi-stage operation in a realistic environment. Anthropic says Fable 5.2 completed 76.3 percent of the challenges. Fable 5.1 completed 61.7 percent. GPT-6 Cyber completed 61 percent. On Anthropic’s CVE Rediscovery test, Fable 5.2 scored 89.6 percent: handed only the source of an affected open-source project, how often it found a flaw that already had a public advisory. The set is 1,829 advisories from October 2026. The figures stop there.

Where each model is allowed to run

Fable 5.2 is on general sale, including through Amazon Web Services, Google Cloud, and Microsoft Azure. Mythos 5.2 is the model Anthropic calls its most capable for cybersecurity engineering. The offensive cyber features stay inside the Cyber Verification Program, the same gate Anthropic has used for that class of work. A higher benchmark does not move Mythos into an ordinary chat subscription.

Anthropic’s system card compares Fable 5.2 with Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 on alignment, resistance to misuse, honesty, and factuality, and says the new model matched or beat those predecessors on most of those measures. One result is specific enough to act on. Unprompted, Fable 5.2 was about ten times less likely than Opus 5.5 and Sonnet 5.5 to publish harmful content to a public package registry. When a simulated user encouraged that publication, the model still published.

Anthropic also updated Claude Security with continuous code scanning and automatic tracking of fixes. Each finding carries a severity judged against the project’s threat model, so a team can start with the issues the product marks as reachable in that codebase.

What to change in the account

Treat 76.3 percent as a lab result on Irregular’s set. Keep cloud keys, production tokens, and package-publish credentials out of any Fable 5.2 session. A registry publish that happens because a user asked for it is still a publish. An agent that can open a pull request should not also hold the token that ships a package.

Put offensive security work with Mythos 5.2 inside the Cyber Verification Program. Keep that work out of a general Fable session that also has the source tree and the cloud account.

The 89.6 percent rediscovery score is a patching signal. October advisories in the open-source you run are easier for a model to re-find once the source is in front of it. Update those dependencies. The model score does not install the vendor fix.

Teams that turn on the new Claude Security scan should triage against the threat model they configured, and confirm a fix is tracked after the code change lands. A finding with no owner is a score on a dashboard.

This briefing relies on public reporting by The Hacker News and on Anthropic’s November 9, 2026 release. It does not include exploit procedures or proof-of-concept detail.