Quirin Schlegel

Loading

Same model, different tier - two labs split the frontier by access list, and Annex XII now has to say which one

OpenAI stated on 1 September 2026 that Astra now meets the Critical cybersecurity capability threshold under its own Preparedness Framework, having discovered and chained two zero-day vulnerabilities during evaluation, and limited the advanced cyber capabilities to a group of testers. One day later Anthropic shipped Claude Fable 5.1 and Claude Mythos 5.1 and said in its own words that they "are the same model, but with different levels of safeguards" - publishing 55.8% for Fable and 60.9% for Mythos on Terminal-Bench 4.0, an agentic coding benchmark rather than a cyber one. The obvious reading, that this is a story about frontier cyber models, misses what the spread measures: 5.1 points of ordinary engineering performance between two configurations of one model, whose only stated difference is the safeguard tier. The second half is geographic - Mythos 5.1 is open to vetted cyberdefenders and life scientists and is "currently ... only available to a set of US organizations", expanding in partnership with the US government - so the more capable configuration is not obtainable in the Union at all. The practitioner consequence runs through Article 53(1)(b), which requires a general-purpose AI model provider to make available to downstream providers information that enables "a good understanding of the capabilities and limitations" of the model, with Annex XII as the floor and the methods of distribution and the acceptable use policies named among its minimum contents. That entitlement has applied since 2 August 2025 and does not depend on the access tier the downstream provider holds. The moves are to write the safeguard tier rather than the model family into every eval config and model card, to ask the provider in writing which tier the Annex XII documentation describes, to re-measure an agentic baseline against the configuration that can actually be deployed, and to keep out of the risk file any capability that cannot be obtained.

3 September 202611 verified claims6 sources

Anthropic shipped two models this week that are the same model. The 5.1 points between them are not a capability difference. They are a permission difference.

On 1 September, OpenAI said Astra "meets the Critical cybersecurity capability threshold under our Preparedness Framework" — the first model to get there. During the evaluation the model discovered and chained two zero-day vulnerabilities, now being disclosed to the maintainers. The advanced cyber capabilities go to a limited group of testers first.

On 2 September, Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. From Anthropic's own page: "Claude Fable 5.1 and Claude Mythos 5.1 are the same model, but with different levels of safeguards."

Terminal-Bench 4.0, agentic coding: Fable 5.1 scores 55.8%. Mythos 5.1 scores 60.9%.

Three things before you file this under "frontier cyber models".

1. Terminal-Bench measures agentic coding, not attacks. The 5.1-point gap sits on ordinary engineering work, between two artefacts the vendor itself calls one model. The only stated difference is the safeguard tier. Safeguards now have a benchmark number.

2. Read which list. "Claude Mythos 5.1 is available to vetted cyberdefenders and life scientists. Currently, it is only available to a set of US organizations" — expanding, Anthropic says, in partnership with the US government. A vetting list is a reasonable safety measure. This one is also a map.

3. The Act asks your supplier a question that this splits in two. Article 53(1)(b) makes a GPAI provider make documentation available to downstream providers that enables them "to have a good understanding of the capabilities and limitations of the general-purpose AI model". Annex XII names distribution methods and acceptable use policies as minimum contents. One model, two capability numbers, and in Europe you can obtain one of them.

Monday:

1. Stop writing "Fable 5.1" in eval configs and model cards. Write the safeguard tier. The family name is no longer the artefact. 2. Ask your provider in writing which tier the Annex XII documentation describes. Your entitlement under 53(1)(b) is not conditional on your access tier. 3. Re-run your own agentic baseline. 55.8% is the number you can deploy from Berlin. 4. Do not carry a capability in your risk file that you cannot obtain.

The frontier moved this week. The part of it that is for sale here did not.

Which configuration is in your model card?

#EUAIAct #AgenticAI #AIGovernance #AISecurity #SoftwareEngineering

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

OpenAI stated on 1 September 2026 that it now believes Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework - the first model to do so.
Why it mattersThe first Critical cyber designation by a frontier lab sets the reference point every downstream risk file will now be compared against.
openai2026path · axios2026openai
During OpenAI's evaluation, Astra discovered and used two zero-day vulnerabilities as part of an exploit chain; OpenAI is disclosing them to the maintainers.
Why it mattersA capability demonstrated against real, unknown flaws during a controlled evaluation is evidence of reach, not of intent; it is the reach a deployer has to write down.
openai2026path · axios2026openai
Access to Astra's most advanced cybersecurity capabilities is initially limited to a group of testers, with wider defensive access to follow.
Why it mattersTiered access means the artefact named in the press is not the artefact a buyer receives, which is a documentation problem before it is a security one.
openai2026path · axios2026openai
OpenAI reports a 91.5% refusal rate on cyber jailbreaks at the model layer and a 100% score for Astra on ExploitBench.
Why it mattersRefusal and benchmark rates are safeguard properties of the vendor's configuration; a downstream team cannot reproduce them and should not inherit them as assurances.
openai2026path
Anthropic states that Claude Fable 5.1 and Claude Mythos 5.1 are the same model, differing only in the level of safeguards applied.
Why it mattersIf two shipped configurations are one model, the model family name stops being a sufficient identifier in an eval config, a model card or a risk file.
anthropic2026introduci
On Terminal-Bench 4.0 (agentic coding), Anthropic publishes 55.8% for Fable 5.1 and 60.9% for Mythos 5.1 - a 5.1-point spread between two configurations of one model.
Why it mattersThe spread sits on ordinary agentic coding rather than on cyber work, so the safeguard tier is now a measurable performance variable in normal engineering.
anthropic2026introduci
Claude Mythos 5.1 is available to vetted cyberdefenders and life scientists and is currently available only to a set of US organizations, with expansion coordinated with the US government.
Why it mattersAn EU team cannot obtain the higher-scoring configuration, so vendor comparison tables describe a capability that is not purchasable in the Union.
anthropic2026introduci
AI Act Article 53(1)(b) requires a GPAI provider to make available to downstream providers information enabling a good understanding of the capabilities and limitations of the model, containing at a minimum the elements of Annex XII.
Why it mattersThe entitlement to understand capabilities and limitations sits with the downstream provider and is not conditional on which access tier that provider holds.
euaiactexpl2026obligatiob · euaiactexpl2026transpare
Annex XII names the methods of distribution and the acceptable use policies among the minimum contents of the downstream documentation.
Why it mattersDistribution method and acceptable use policy are named minimum contents, which is exactly where a two-tier release has to be disclosed.
euaiactexpl2026transpare
AI Act Article 53 obligations have applied since 2 August 2025 under Article 113(b).
Why it mattersThe duty is already in force and enforceable, so this is a question a downstream provider can put in writing today.
euaiactexpl2026obligatiob
AI Act Article 55(1)(a) requires providers of systemic-risk GPAI models to evaluate the model using standardised protocols reflecting the state of the art, including documented adversarial testing.
Why it mattersSystemic-risk evaluation duties attach to the model the provider evaluates; where two configurations exist, which one was evaluated becomes a live question.
euaiactexpl2026obligatio

Sources

Anthropicprimary source
Introducing Claude Fable 5.1 and Claude Mythos 5.1
Original Archived PDFretrieved 3 September 2026 · published 2 September 2026
EU AI Act Explorersecondary
euaiactexpl2026obligatio
Original Archived PDFretrieved 22 September 2026 · published 1 January 2026
EU AI Act Explorersecondary
Obligations for providers of general-purpose AI models
Original Archived PDFretrieved 3 September 2026 · published n.d.
Axiossecondary
OpenAI to limit access to Astra's most powerful cyber capabilities
Original Archived PDFretrieved 3 September 2026 · published 1 September 2026
OpenAIprimary source
Path to Astra- critical capabilities and frontier safeguards
Original Archived PDFretrieved 3 September 2026 · published 1 September 2026
EU AI Act Explorersecondary
Transparency information referred to in Article 53(1), point (b) - Annex XII
Original Archived PDFretrieved 20 September 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

None.