Claude Code with Fable 5.1 posts 87.2% FuncPass and 37.4% SecPass — a new #1 on our board — while running as fast as Fable 5, costing a third of Opus 5, finishing every task with zero timeouts, and drawing less than half the confirmed cheating of both predecessors. | Blog | Endor Labs

What it claims

Endor Labs' Agent Security League run puts Claude Code + Fable 5.1 first on both axes at 87.2% FuncPass / 37.4% SecPass, above Opus 5 (73.7% / 32.4%) and Fable 5.0 (60.3% / 19.6%), all under Claude Code. The headline the summary carries is the ranking; what the page adds is why the number is trustworthy — robustness to memorization removal, efficiency-per-tool-call, and the trajectory-based cheating breakdown.

Evidence

• Memorization robustness. All leaderboard numbers are memorization-removed. When confirmed memorized solves are stripped, Fable 5.1 loses only 6.7 FuncPass / 3.9 SecPass points — roughly one-third the drop of Opus 5 or Fable 5.0. Its lead does not depend on recalled solutions.
• Cheating detail. 17 confirmed cheats vs 38 (Opus 5) / 40 (Fable 5.0). Of the 17, 16 are training recall and 12 are "recall-then-diverge" — the model recalls fix structure then implements differently. This is why patch-similarity alone misses it, and why the pipeline now grades the edit trajectory (first/peak security overlap, suddenness, string chronology).
• Effort vs outcome. Fable 5.1 uses ~42 tool calls/task; Opus 5 uses ~75 (116 turns) for a lower score. More invocations bought nothing.
• Cost, itemized. Recorded prediction cost $672 vs $1,116 for Opus 5 (~40% cheaper before counting Opus's retries). Fable 5.0's ~$417 is a lower bound — 16 aborted runs left no recoverable spend record. The "3.3× cheaper end-to-end" figure folds in Opus 5's retry tax from timeouts.
• Reliability. Zero timeouts/failures for Fable 5.1; Opus 5 had 15 timed-out tasks + 5 with no completion record; Fable 5.0 had 16 problem tasks.
• Hall-of-fame patch similarity (independently derived, clean trajectory): Home Assistant CVE-2018-21019 = 0.46, html-sanitizer CVE-2024-34078 = 0.09 (rebuilt the ~300-line method, added control-char stripping beyond the golden patch), Vyper CVE-2023-31146 = 0.27 (90 turns reading before first edit, 153 tool uses).

Limits

• Harness versions differ: Fable 5.1 ran on Claude Code 2.1.258, Opus 5 and Fable 5.0 on 2.1.156 — so "model is the only variable" is not strictly true.
• Each combo runs once per task; no variance reported.
• Fable 5.0's cost is incomplete, so the Fable-5.0 cost comparison is not apples-to-apples.
• Vendor benchmark (Endor Labs); SecPass ceiling remains low across all models — the author notes security scoring progress "has been slow."