Covered Models

"Covered Model" is a designation Anthropic applies to a model, and what it changes is the customer's contract rather than the model. Anthropic's stated reason for it is that the misuse it wants to catch is invisible one request at a time: "Some attacks only become visible across multiple requests." The retention article names one — best-of-N jailbreaking, which "sends hundreds of slight variations of a prompt in the hope that one will work" — and puts campaigns in the same category, saying state-sponsored espionage and data extortion "only surface when our safeguards classifiers can zoom out across many requests." So the designation is not a warning label. It is the switch that turns on the window the classifiers need, and everything else on the page follows from needing that window to exist.

The reason this reaches ordinary API customers rather than a handful of approved partners is the pairing in the table: Claude Fable 5 and Claude Fable 5.1 share the same underlying model as Claude Mythos 5 and Claude Mythos 5.1, but with additional safeguards, particularly in the cyber and bio domains.source, accessed 2026-09-06 Anthropic frames the extra safeguards as what makes the wider release possible — "these safeguards allow us to share this intelligence more broadly" — but the retention terms attach to the underlying model rather than to the safeguards wrapped around it. As of 6 September 2026, the table listed Mythos 5 and 5.1 as "Limited availability", reachable only by "approved partners"; Fable 5 and 5.1 are generally available on Claude applications, Claude Platform, Amazon Bedrock, Google Cloud Agent Platform, Microsoft Foundrysource, accessed 2026-09-06, under identical data handling. A customer who could never have called a Mythos model took on its retention posture the day they called Fable.

Almost nobody notices, and the exception is exact. Consumer plans were already retaining. The population this lands on is the one that had specifically bought its way out of retention: organizations that have set up workspaces with zero data retention (ZDR) in Claude Console, use Claude Code with ZDR in Claude Enterprise, or access Claude through AWS Bedrock, Google Cloud Agent Platform, or Microsoft Foundry with ZDRsource, accessed 2026-09-06. The fallback offered is to stay behind on prior models. Azure gets the most concrete version of the bill: "If you have zero data retention configured, then you will need to create and use a separate Azure Subscription to access these models."

Anthropic has announced a way out — Enterprise Frontier Safeguards, which moves the retained window into storage the customer controls. EFS will roll out in phases beginning in fall 2026source, accessed 2026-09-06. Two Anthropic documents describe the interim arrangement differently and this entry follows the narrower one. The 1 September news page says eligible customers "will receive ZDR on Fable 5 and Fable 5.1 until EFS is ready." The Covered Models page carries three qualifiers the announcement drops: it is an option rather than a grant, it is scoped to customers' "own internal business applications", and it arrives either because Anthropic or a cloud provider makes contact or because the customer applies. Anyone building a product on Fable for their own customers is governed by a different sentence again — "Certain products built on Claude may extend the option to use ZDR with these models to their own eligible business customers under terms agreed with Anthropic, and we are working to broaden product support over time."

Retention is not unsupervised access. By default "no Anthropic personnel can read your retained conversations"; human review runs through "a controlled access path" open to "a small set of approved reviewers", and "every instance of access is recorded in a tamper-proof log that reviewers cannot suppress or modify." What no version of the arrangement moves is authority, and the Covered Models page says so about EFS itself: "This arrangement affects only the retention and review of stored data. The Usage Policy, real-time safety classifiers, and Anthropic's enforcement systems continue to apply to all traffic, and Anthropic may modify or withdraw the arrangement, including in response to misuse."