Full Fathom Five: The context of Anthropic’s Mythos-class public release

What it claims

This is opinion commentary from Aikido, a security vendor, published the same week as Fable 5's release and Microsoft's largest Patch Tuesday (over 200 vulnerabilities). The author links the two events but does not explain how they are connected.

Beyond the summary, the page makes three claims:

• Mythos 5 vs. Fable 5. Mythos 5 is "largely identical" to Fable 5, with "some of the safeguards denuded." Mythos Preview itself was not released publicly.
• The other 80%. The remaining 80% of the security problem is non-CVE: misconfigurations, exposed services, stale permissions, ghost assets, broken identity edges, and improvised SaaS workflows. The author treats both CVEs and the CISA KEV catalog as weak prioritization tools ("they still matter, but the fetishization is embarrassing").
• Attacker economics. Threat actors will not spend Mythos or Fable tokens on exploit chains, because social engineering is cheaper. Examples given are invoice approval, MFA resets and phishing clicks.

Evidence

The only concrete evidence is a single anecdote. In a recent client pentest, JWTs were present but played no role in authenticating API calls. Aikido offers this to support its claim that IDORs and business-logic flaws can be found without Mythos-class models.

The page shows no scan results, comparisons or benchmarks for Mythos, Fable 5 or Opus 4.8. The demand figure of about 30 vulnerabilities per month is credited to Resecurity, but the page gives no link or methodology.

Limits

• No hands-on access. The author says they have not used Mythos Preview. Their view of its capabilities comes from conversations with people who did, starting around RSAC at the end of March.
• No tests of the routing claim. The page states that Fable 5 routes cyber and bioweapon prompts to Opus 4.8 but describes no tests of this. It does not cover how the routing is triggered, how reliable it is, or what happens with borderline prompts. If you plan to use Fable 5 for security work, check this yourself before relying on it.
• Untested percentages. The 20%/80% split is the author's estimate ("maybe 20%"), not a measured figure.
• Vendor bias. The author's company sells autonomous pentesting. The argument that you do not need Mythos-class models supports that business.