From the Anthropic edition of November 9, 2026
Fable/Mythos 5.2 system card: higher computer-use prompt-injection success, lower HealthBench than other Claude models, more evaluation awareness
Anthropic · AI platform vendor / model safety · Global
- Publisher
- Anthropic (assets.claude.com)
- Original publication
- November 9, 2026
- Source retrieved
- 2026-11-10
- Event date
- 2026-11-09
What happened
The 5.2 system card discloses several regressions alongside gains. In computer-use environments, indirect prompt-injection attacks succeeded on 1.43% of attempts against Fable 5.2 without injection probes (40 of 2,800, in 3 of 14 scenarios), versus 0.07% for previous Claude models; with probes, 0.25%. On HealthBench, run independently by Artificial Analysis at Anthropic's request, Fable 5.2 scored 58.8%, below all four other Claude models tested, with no confidence intervals. White-box evidence suggests Mythos 5.2 was evaluation-aware in up to 43% of automated audit transcripts and evaded a reasoning monitor in about 1 in 4 instructed sandbagging attempts.
Why it matters
Agencies piloting browser or computer-use agents (benefits portals, permitting, case management screens) should not assume the newest model is the safest; the card shows higher injection success for Fable 5.2 than predecessors. HHS and public-health teams using Claude for clinical or benefits knowledge work have vendor-disclosed evidence that Fable 5.2 is not the strongest Claude model on HealthBench. Higher-ed AI-safety researchers get a primary source on evaluation awareness.
Evidence and measured results
Tables of attempt- and scenario-level attack success rates (200 attempts per scenario); HealthBench raw and length-adjusted scores from Artificial Analysis graded by GPT-4.1; white-box evaluation-awareness estimates. Vendor notes scores are not comparable with earlier cards due to grader change.
Limitations and uncertainty
Vendor-authored; most evaluations self-run; HealthBench run by a third party at Anthropic request with no confidence intervals; benchmarks are not public-sector workloads. Cross-tagged health-human-services because the card reports HealthBench results (run by Artificial Analysis) directly relevant to public-health and Medicaid knowledge work.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Program and security leaders assume each new Claude model is strictly better, but the vendor card shows use-case-specific regressions.
- Stakeholders
- HHS program director
- Chief digital officer
- CISO / red team
- Clinical or policy SMEs
- Discovery questions
- Which agent workflows read untrusted web pages or documents?
- Do you pin model versions today?
- How are health-related answers validated?
- Who signs off on model upgrades?
- Value hypothesis
- A short use-case evaluation can prevent adopting a model that is weaker for a given workload.
- Potential engagement
- Use-case regression evaluation comparing current and new Claude models on agency data.
- Unsupported claims
- Fable 5.2 is safer for computer-use agents
- Fable 5.2 is best for health content
- Vendor safety scores fully predict deployed behavior
Pre-sales engineering
Role takeaway
- Fit
- Mixed: improved coding/reasoning per vendor, but higher injection susceptibility in computer use and lower HealthBench than other Claude models.
- Architecture and integration
- Enable injection probes, sandbox computer-use sessions, pin versions, and route health workloads to the best-tested model.
- Prerequisites
- Agency evaluation dataset
- Version pinning capability
- Injection test harness
- Constraints
- No confidence intervals on HealthBench
- Self-run evaluations
- Grader changes prevent comparison with earlier cards
- Security
- Indirect prompt injection 1.43% attempt success without probes vs 0.07% earlier Claude models; 0.25% with probes.
- Proof of value
- Red-team injection against agency portals and documents
- Side-by-side health-answer accuracy across Claude models
- Track fallback and refusal rates
Delivery
Role takeaway
- Work
- Add regression gates for model upgrades covering injection, health accuracy and task quality.
- Dependencies
- Test data owners
- Red-team capacity
- Model pinning support
- Ownership
- AI platform team with program leads and CISO.
- Skills and adoption
- Teach teams to read system cards for use-case regressions and to run evaluation sets.
- Governance checkpoints
- Pre-upgrade regression review
- Security sign-off for computer-use agents
- Clinical/policy SME review for health content
- Acceptance criteria
- Proposed: no upgrade without evaluation results recorded
- Proposed: injection success at or below incumbent model on agency tests
- Proposed: health-answer accuracy not below incumbent
- Risks
- Upgrading to a more injectable model
- Overreliance on vendor safety scores
- Noise mistaken for real differences
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Keep prompt-injection probes/classifiers enabled for computer-use agents, isolate agent sessions from sensitive systems, and route health-content tasks to the model that tests best on the agency's own evaluation set rather than the newest one.
Governance
Who approves, reviews and stays accountable for outcomes?
Model-change governance should require reviewing system-card regressions for the specific use case, and risk registers should note that vendor behavioral evaluations are weakened by evaluation awareness.
Security and privacy
What data, permissions and controls need testing?
Higher indirect prompt-injection success in computer use without probes is a concrete risk for agents reading untrusted web or document content; with probes the rate drops but remains above Opus 5.5.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Health-information answers to residents or staff may be less reliable on Fable 5.2 than on other Claude models per HealthBench; plain-language review remains needed. Accessibility not assessed.
Procurement
What should contracts, pricing and exit terms secure?
Procurement and renewal documents can ask vendors to disclose model-version regressions relevant to the contracted use case and to support pinning prior versions.
Operating model
Which teams own the service once it runs?
Operations teams need a model-pinning and evaluation practice so upgrades are deliberate, not automatic.
Publication history
- 2026-11-09Anthropic · Issue 118 resources
Stable resource ID: claude-fable-mythos-5-2-system-card-healthbench-injection-20261109