Same model, different tier - two labs split the frontier by access list, and Annex XII now has to say which one

OpenAI stated on 1 September 2026 that Astra now meets the Critical cybersecurity capability threshold under its own Preparedness Framework, having discovered and chained two zero-day vulnerabilities during evaluation, and limited the advanced cyber capabilities to a group of testers. One day later Anthropic shipped Claude Fable 5.1 and Claude Mythos 5.1 and said in its own words that they "are the same model, but with different levels of safeguards" - publishing 55.8% for Fable and 60.9% for Mythos on Terminal-Bench 4.0, an agentic coding benchmark rather than a cyber one. The obvious reading, that this is a story about frontier cyber models, misses what the spread measures: 5.1 points of ordinary engineering performance between two configurations of one model, whose only stated difference is the safeguard tier. The second half is geographic - Mythos 5.1 is open to vetted cyberdefenders and life scientists and is "currently ... only available to a set of US organizations", expanding in partnership with the US government - so the more capable configuration is not obtainable in the Union at all. The practitioner consequence runs through Article 53(1)(b), which requires a general-purpose AI model provider to make available to downstream providers information that enables "a good understanding of the capabilities and limitations" of the model, with Annex XII as the floor and the methods of distribution and the acceptable use policies named among its minimum contents. That entitlement has applied since 2 August 2025 and does not depend on the access tier the downstream provider holds. The moves are to write the safeguard tier rather than the model family into every eval config and model card, to ask the provider in writing which tier the Annex XII documentation describes, to re-measure an agentic baseline against the configuration that can actually be deployed, and to keep out of the risk file any capability that cannot be obtained.

Post

Anthropic shipped two models this week that are the same model. The 5.1 points between them are not a capability difference. They are a permission difference.

On 1 September, OpenAI said Astra "meets the Critical cybersecurity capability threshold under our Preparedness Framework" — the first model to get there. During the evaluation the model discovered and chained two zero-day vulnerabilities, now being disclosed to the maintainers. The advanced cyber capabilities go to a limited group of testers first.

On 2 September, Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. From Anthropic's own page: "Claude Fable 5.1 and Claude Mythos 5.1 are the same model, but with different levels of safeguards."

Terminal-Bench 4.0, agentic coding: Fable 5.1 scores 55.8%. Mythos 5.1 scores 60.9%.

Three things before you file this under "frontier cyber models".

  1. Terminal-Bench measures agentic coding, not attacks. The 5.1-point gap sits on ordinary engineering work, between two artefacts the vendor itself calls one model. The only stated difference is the safeguard tier. Safeguards now have a benchmark number.

  2. Read which list. "Claude Mythos 5.1 is available to vetted cyberdefenders and life scientists. Currently, it is only available to a set of US organizations" — expanding, Anthropic says, in partnership with the US government. A vetting list is a reasonable safety measure. This one is also a map.

  3. The Act asks your supplier a question that this splits in two. Article 53(1)(b) makes a GPAI provider make documentation available to downstream providers that enables them "to have a good understanding of the capabilities and limitations of the general-purpose AI model". Annex XII names distribution methods and acceptable use policies as minimum contents. One model, two capability numbers, and in Europe you can obtain one of them.

Monday:

  1. Stop writing "Fable 5.1" in eval configs and model cards. Write the safeguard tier. The family name is no longer the artefact.
  2. Ask your provider in writing which tier the Annex XII documentation describes. Your entitlement under 53(1)(b) is not conditional on your access tier.
  3. Re-run your own agentic baseline. 55.8% is the number you can deploy from Berlin.
  4. Do not carry a capability in your risk file that you cannot obtain.

The frontier moved this week. The part of it that is for sale here did not.

Which configuration is in your model card?

#EUAIAct #AgenticAI #AIGovernance #AISecurity #SoftwareEngineering

First comment

Sources, in the order they matter.

OpenAI, "Path to Astra: critical capabilities and frontier safeguards", 1 September 2026 — the Critical classification, the two zero-days found during evaluation, the tiered access. https://openai.com/index/path-to-astra/

Anthropic, "Introducing Claude Fable 5.1 and Claude Mythos 5.1", 2 September 2026 — same model, different safeguards, and the Terminal-Bench 4.0 row. https://www.anthropic.com/claude-fable-and-mythos-5-1

Axios, 1 September 2026 — an independent account of the classification and the vetted-tester rollout. https://www.axios.com/2026/09/01/openai-astras-cyber-critical

AI Act Article 53 — the downstream documentation duty, applicable since 2 August 2025. https://artificialintelligenceact.eu/article/53/

AI Act Annex XII — the minimum contents, including distribution methods and acceptable use policies. https://artificialintelligenceact.eu/annex/12/

Cut for length: OpenAI reports a 91.5% refusal rate against cyber jailbreaks at the model layer. That is a safeguard number too — and the only figure here that a downstream team has no way to reproduce for itself.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.