Anthropic's strongest public model now watches patterns across your usage. Firms can keep that watch in-house, in beta

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

On 9 November Anthropic released Claude Fable 5.2 and Claude Mythos 5.2, which it describes as the same underlying model. Fable carries strong cybersecurity and biology safeguards and is available to all users, including on AWS, Google Cloud and Microsoft Azure; Mythos, without those safeguards, goes only to vetted organisations through Anthropic's verification programmes. The price fell to $8 per million input tokens and $40 per million output tokens. Anthropic says Fable 5.2 produces about 55% fewer unnecessary blocks than Fable 5.1 in early testing, and still recommends Claude Opus 5.5 as the starting point for most coding and knowledge work.

The part of the launch that matters most to regulated firms is near the bottom. Anthropic says some misuse "can be detected only when observing patterns across multiple requests", so its most powerful models rely on safeguards that monitor "a window of usage data". Its answer for customers with zero data retention agreements is Enterprise Frontier Safeguards, which runs that automated monitoring on prompts and responses stored in the customer's own infrastructure. It is in private beta, with Bridgewater, Salesforce and Stripe named as customers. Eligible customers can keep using the models with zero data retention before they implement it. "For other customers, we have 30-day retention for safety monitoring."

Four days earlier, on 5 November, Anthropic made inference hooks generally available for Claude Enterprise. A hook sends each governed prompt, and optionally each tool call, to a security server the customer or its vendor runs; the documentation says a denied request never reaches the model. The default timeout is five seconds, and the customer chooses whether an outage blocks requests or lets them through uninspected. The hooks see extracted text, not raw images, so a screenshot of a document is not inspected, and they can allow or deny but not redact. They are not available on Amazon Bedrock or Google Cloud, or for API access through the Claude Platform.

Why it matters

Put the two announcements together and the shape of frontier-model control becomes clearer. There is now a checkpoint on each side. The customer's checkpoint looks at one request at a time, before it reaches the model. The provider's checkpoint looks across many requests, after the fact, to spot patterns no single prompt reveals. Both are reasonable. Both need data, and the second needs it kept for a while.

Before a bank turns on a new frontier model, it should know who watches its prompts, for how long, and where.

For banks and insurers that negotiated zero data retention, 30-day retention for safety monitoring is a contract question, not a technical detail. It touches data-residency, outsourcing and privacy commitments. Enterprise Frontier Safeguards is the obvious fix, and the named beta customers include a hedge fund and a payments company, but it is a private beta. In my view risk teams should ask now which retention terms apply to them, rather than learn it from a usage audit later.

The hooks deserve the same practical reading. The fail-open setting is the one I would review first. A security check that quietly lets everything through when the security server is slow is not a control; it is a preference. And because image-only content is not inspected, a DLP policy that relies on hooks alone will miss a photographed statement.

What I'd watch

• When Enterprise Frontier Safeguards leaves private beta, and whether it reaches firms outside the US.
• Whether other labs adopt cross-request monitoring for their top models, and on what retention terms.
• Whether inference hooks extend to API customers and to Claude on Amazon Bedrock and Google Cloud.