Anthropic Shipped the Same Model Twice Under Two Names, and the Difference Is Who Is Allowed to Use It

A model good enough to design a protein binder is good enough to design a dangerous one. A model good enough to find a vulnerability is good enough to exploit it. There is no version of the weights that is excellent at defence and incapable of offence, because they are the same skill pointed in different directions.

So the split is not in the model. It is in the classifiers wrapped around it and in the contract you sign to reach it. Anthropic reports 60 per cent fewer false positives on the cybersecurity safeguards, which is the number a security team cares about most: a safety system that refuses legitimate work is a safety system that gets routed around.

We wrote about this two tier structure when the previous generation introduced it, in the debate over two tier access, and about how it arrived in the Fable and Mythos class launch. The arguments have not changed. The stakes have gone up, because the capability claims have.

The geography is the uncomfortable part

Mythos 5.1 is currently available to a set of American organisations, through government partnership programmes.

Read plainly, that means the more permissive configuration of a frontier model is reachable by institutions in one country and not by their equivalents elsewhere. A hospital research group in the Gulf, a European biosecurity lab and an American national laboratory are not being offered the same tool, and the difference is not technical.

There is a defensible case for that. Safeguards need somebody accountable on the other end, verification takes relationships, and relationships start where the company and its regulators are. There is also an obvious cost, which is that the rest of the world gets the safer model and the slower science, and did not vote on the arrangement.

It is also a reminder that this company's relationship with its own government is not simple. A federal judge ruled last week that the Defense Department unlawfully retaliated against Anthropic for refusing to drop its usage limits, which we covered in the ruling on the supply chain risk label. The same firm now distributes its least restricted model through government partnerships. Both of those are true.

What developers should read the release notes for

Two changes that will break existing code rather than improve it.

Forced tool use is gone: asking the model to call a specific tool, or any tool, is now rejected outright rather than obeyed. Anything built on that pattern has to move to asking politely in the prompt and validating what comes back.

And thinking is now bound to the turn that produced it, so a harness that rewrites its own conversation history breaks. Systems that edit earlier turns, or compact them, need to become append only. Accounts created from 31 August are already subject to it.

Both are the same lesson in different clothes. The model is being handed more autonomy, and the API is closing the routes by which a developer could quietly rewrite what the model was told it had already decided.