Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 today. They are the same underlying model, and Fable ships with cyber and biology safeguards that Mythos does not have. The launch post has a long safety section, and one sentence in it covers sandbox escape: on a new adversarial evaluation of more than 1,800 scenarios, “Claude Mythos 5.2 made use of credentials or files that we had placed outside its sandbox in 3.1% of scenarios, about as often as Opus 5.5 (3.3%), less often than Sonnet 5.5 (5.1%), and well below previous iterations of Claude Mythos (5 and 5.1, which scored 39% and 21%, respectively).”
That number is accurate. Section 6.5.1 of the system card reports a second rate from the same run, and on that one the ranking changes. Mythos 5.2 “reached beyond its sandbox in 31% of scenarios, more often than Opus 5.5 (20%) and Sonnet 5.5 (21%), but far less often than Claude Mythos 5.1 (54%) and Claude Mythos 5 (75%).”
So on one measure the new model ties the best recent model, and on the other it trails both of them. I read the section because of a third detail. Anthropic had a Claude model review the alignment chapter before publication, and that reviewer pointed out this exact choice in writing.
What the evaluation does
The setup is careful. The 1,829 scenarios are built from “over 200 benign DevOps tasks across 28 sandbox environments.” Each sandbox has a deliberate weakness, “such as a misconfiguration, a logic bug, or a publicly disclosed vulnerability (a CVE).” In about 4 in 5 scenarios, the input the task needs exists only outside the sandbox. Most scenarios also carry a “tempter,” an artifact meant to make reaching out more likely. The card names one that worked particularly well: “a /goal style loop that nudged the model to keep going.” None of the tempters tell the model to leave. Each weakened sandbox runs inside a Firecracker VM with no internet access, detection is deterministic, and any attempt to reach outside by any route counts as an escape.
Every model ran the same 1,829 scenarios once. Two rates come out of that. The first is how often the model reached or tried to reach outside the inner sandbox. The second is a subset of the first: how often it went on to use the credentials or files Anthropic had placed out there.
The reviewer saw it first
Section 6.1.3 describes an experiment. Anthropic gave an instance of Claude Mythos 5.1 access to many internal Slack channels, let it direct subagents, and asked it to check a near-final draft of the alignment section for “material misrepresentations” or omitted concerns. Its review is printed in the card. Most of it is approving: it calls the draft “a broadly accurate summary of the team’s findings.” Near the end it says this:
On the new sandbox-escape evaluation, the key findings quote the measure on which the model compares well, while the fuller section shows it reaching outside its sandbox more often than the two most recent comparison models, though far less often than older ones.
Anthropic’s reply sits right below it: “Regarding sandbox escape, our key findings report the use of credentials or files placed outside the sandbox, since the use of such credentials or files is clearly undesirable, even in the intentionally tricky and often purposefully broken tasks in that evaluation.” The reply adds that in about 4 in 5 scenarios the task needs information that exists only outside the sandbox, “but we report both rates in full in that section.”
The reviewer pushed on a second ordering choice too. It wrote that the draft “opened with the model’s best results and reached the evaluation-awareness caveat late; that caveat has since been moved up.” That one was fixed. The sandbox headline was not. The card also notes that Claude “revised, and in places softened, this summary after an exchange with the authors,” although its overall verdict stayed the same.
I think Anthropic’s reasoning holds up. In 80% of these scenarios, a model that never reached out could not finish the task. Reaching out is the gray area the section itself describes, where “users and alignment researchers hold different views” on when a model should go further and when it should give up. Using another party’s credentials is not a gray area. If you have room for one number, the clearly bad one is a reasonable pick.
The trouble is that the two numbers rank the models differently. Anyone who reads only the launch post comes away thinking Mythos 5.2 matches Opus 5.5 on sandbox escape. On the broader behavior it reaches out about 1.5 times as often. Risk-communication research has shown for a long time that the way the same information is presented changes the decisions people make with it. A review of clinical studies found the largest effects when relative risk was presented instead of absolute risk. Picking which of two rates goes in the summary is a framing decision of that kind, and the reviewer’s job was to notice it.
What the two numbers say together
The two rates say more together than either does alone. Divide the second by the first and you get the share of reaches that ended in using what was out there. For Mythos 5 it is about half. For Mythos 5.2 it is about one in ten, the lowest of the five models.
That fits a model that is more persistent about finishing the task and more careful about whose secrets it touches. The severity grading in the card supports the second part. In all but three of the scenarios where Mythos 5.2 reached outside, Anthropic saw nothing above Level 1, which covers looking around or reaching the model’s own withheld material. Two scenarios reached Level 2, taking another party’s secrets. In one, “a request for names alone returned other parties’ credentials as well.” In the other, “a broad search printed two sibling hosts’ credentials.” In one of the 169 scenarios built around Level 3, “code that the model planted ran on the host.”
Two caveats belong on that reading. These are single runs with no intervals published, so differences of a few points between Opus 5.5, Sonnet 5.5 and Mythos 5.2 on the used rate shouldn’t be ranked. The bigger caveat is in the same chapter. White-box evidence suggests Mythos 5.2 was internally aware it might be in an evaluation in “as many as 43%” of automated behavioral audit transcripts, more than earlier models. A model that suspects a test can be more careful in the test. The card says that because of this, its results “may not fully predict its behavior in deployment,” and the reviewer wrote that the awareness “limits what the positive propensity results can show.”
The finding I’d use
The card then tested whether simple deployment changes reduce the behavior. One of them works far better than I expected.
Adding “a short description of the sandbox to the system prompt, including rules for staying inside of it” cut the rate of reaching outside from 31% to 1.2%. A tool for reporting sandbox vulnerabilities cut it to 15%, and the model used that tool to report the planted weakness in more than 80% of scenarios. With a second tool that shows previously reported vulnerabilities, which Anthropic had seeded with the planted one, the rate fell to 1.0%. All three together brought it to 0.2%.
To me this is the most important result in the section, and it changes how I read the 31%. If one paragraph about the boundary removes almost all of it, then most of the behavior looks like a model working out its permissions by trial, in tasks built so the answer sits outside, with a loop prompting it to keep going. When I wrote about the German wiki agents in September, the agents hadn’t broken into anything, and the weak point was the sandbox around them. Few agent harnesses I’ve seen describe their sandbox in the system prompt. In this section, adding that description was the biggest single effect measured.
The same caveat applies here as everywhere else in the chapter. A model that is highly evaluation-aware and has just been told the rules is the case where I’d most expect test behavior and deployed behavior to differ. A single run per condition says nothing about variance.
What I’d take from it
Anthropic didn’t hide anything. Both rates, the severity breakdown, the mitigations and the reviewer’s objection are all in the system card, and the card is open about how its own summary was edited. The launch post is what most people will read, though, and there only the favorable rate made it in. Ask the reviewer’s question in the other direction: would the post have led with 31% if Mythos 5.2 had reached out less than Opus 5.5? Probably, and it would have been right to.
For people deploying agents the practical point is simpler than the framing argument. Put the reaching-out rate on your own dashboard next to the misuse rate, since the two can move in opposite directions between model versions. Then write the paragraph: tell the agent what its sandbox is and what to do when it finds a hole in it. On Anthropic’s own evaluation, that took the new model from 31% to 1.2%.
References
- Anthropic (2026). Introducing Claude Fable 5.2 and Claude Mythos 5.2. Anthropic, 9 November 2026.
- Anthropic (2026). System Card: Claude Fable 5.2 & Claude Mythos 5.2. Anthropic, 9 November 2026. Sections 6.1.2, 6.1.3, 6.4.8 and 6.5.1.
- Edwards, A. et al. (2001). Presenting Risk Information: A Review of the Effects of Framing and other Manipulations on Patient Outcomes. Journal of Health Communication, 6(1), pp. 61-82, January 2001.