2026-08-05

Anthropic's current top tier is Fable 5, with Mythos 5 as its counterpart through Project Glasswing: same capabilities, same pricing, same API surface, different door. I have been reading the migration notes rather than the marketing, because the interesting parts of a model release are usually the things it breaks.

> Thinking is not optional any more

On these models extended thinking is always on. You do not enable it, and you cannot turn it off. An explicit request to disable it is rejected outright. The old fixed thinking budget is gone entirely; depth is controlled through an effort level instead. A million token context window is both the default and the maximum, with 128k of output.

> You do not get to read the reasoning

The raw chain of thought is never returned. You can ask for a summary of it, and the default is to return nothing at all, with the thinking blocks arriving empty. Ask the model to reproduce its own reasoning in the response text and you can trip a refusal for exactly that.

I understand the argument. The chain of thought is where a model is most exposed, and exposing it hands attackers a map. But it does make evaluation harder in a way that matters for security work specifically. If a model tells me a finding is a false positive, the reasoning is the thing I want to audit, and increasingly the reasoning is the one thing I cannot have.

> Refusals as a normal response

These models run safety classifiers that can decline a request, and a decline is not an error. It comes back as a perfectly successful response with a refusal stop reason and a category. Code that reads the first content block without checking will break, because on a refusal there may be no content at all.

Worth knowing if you work in security: benign work in this field trips those classifiers occasionally. Anthropic publish a fallback mechanism that re-runs a declined request on another model automatically, which is a tacit acknowledgement that false positives happen often enough to need engineering around.

There is also a hard requirement for thirty day data retention. These models are not available under zero retention at all, and an organisation configured that way gets a validation error on every request rather than a useful message. That one will cost somebody an afternoon.