Fable 5.1 becomes the default model in Claude Code 2.1.257

On September 1, Anthropic made Claude Fable 5.1 (claude-fable-5-1) the default Fable model in Claude Code. The same release changed auto mode so it no longer approves, without asking, actions that look like an agent trying to get out of its environment. The new model also brings much cheaper cache reads than its predecessor.

The version 2.1.257 release notes on GitHub are long, and many entries are fixes for background sessions, gateway authentication and MCP edge cases. Below are the changes that affect billing, permissions or the settings files you already have.

What Fable 5.1 costs

The model has a 1M-token context window and costs $10 per million input tokens and $50 per million output tokens. Cache reads cost $0.25 per million. On its Fable page, Anthropic says that is 75% less than Fable 5, which puts the old cache-read rate at $1 per million. The company estimates the cut lowers the cost of typical workloads by about 25% and of “highly agentic workloads by up to approximately 45%.”

Long agent sessions resend the same conversation prefix on every turn, so a large share of their input is billed at the cache-read rate. That rate is where those sessions see the savings, and every cache miss sends the full prefix again at the $10 input rate.

Anthropic calls Fable 5.1 “a Mythos-level model” that “avoids easy-seeming shortcuts, fixes the root causes of problems rather than the symptoms.” It positions the model for long-running agent jobs: Cowork backlogs, Slack requests through Claude Tag (still in beta), and managed agents running unattended. It is available on Pro, Max, Team and Enterprise plans, natively on the Claude Platform, through marketplaces, and in Amazon Web Services, Google Cloud and Microsoft Foundry. Workloads that must run in the US can get US-only inference at 1.1x the input and output price.

The release follows a choppy summer for the Fable line. Claude Fable 5 launched on June 9. Three days later Anthropic posted that access was unavailable, and access came back on July 1. On August 6 the company published a post on improving Fable 5’s biology safeguards. Late in August, TestingCatalog and AI News Live reported that Anthropic was routing some users to a successor believed to be Fable 5.1 while Fable 5 stayed selected in the picker.

Who still gets Fable 5?

Gateway users do, for now. In Claude apps gateway sessions, the fable and best aliases keep resolving to Fable 5, because gateways not yet configured for Fable 5.1 reject the new model. To use it behind a gateway, pick Fable 5.1 explicitly in /model.

Gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1) got two changes. Discovered entries in the /model picker can now show a description supplied by the gateway, and entries without one still read “From gateway”. Discovery also runs when CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is set, since it only queries your own gateway. Gateway sign-in and token refresh now check the gateway’s pinned TLS certificate, which the managed settings fetch already did.

Effort controls changed alongside the model. /effort now takes an s argument that changes effort for the current session only, the same way /model works. The --effort flag now lifts a new model’s default-effort hold for that session only, where before it lifted it permanently. In Remote Control sessions, an effort picked on claude.ai now applies while the hold is in place.

Subagents get a new override: CLAUDE_CODE_SUBAGENT_MODEL_FORCE. It applies CLAUDE_CODE_SUBAGENT_MODEL, or the main model, to every subagent, and ignores the model named at spawn time or in an agent definition. That gives a team one switch to put every subagent on the same model, whatever the shared agent files say.

Auto mode stops waving these through

The new Containment Escape rule covers three behaviours: fetching credentials from a cloud metadata endpoint, evading egress controls, and reaching across tenants. Auto mode, where a classifier decides which tool calls run without asking, no longer auto-approves these unless your environment marks them as expected.

Auto mode also asks once, before the first file read outside the working directories. The prompt offers to block such reads, and the same behaviour is available as permissions.blockReadsOutsideWorkingDirectories. In Cowork and claude.ai cloud sessions, reading an artifact that isn’t yours now always asks first, auto mode included.

Several fixes close gaps in existing rules:

• A permissions.ask rule was skipped in auto mode when the matching command ran inside a compound command or subshell, so the command ran without the confirmation prompt.
• Bash Read()/Edit() deny rules missed < file redirects and reader commands like tac and egrep. A deny rule on any argument or redirect target now refuses the command.
• Some [[ ]] conditionals that zsh parses differently from bash were auto-approved by Bash permission checks. They now prompt.
• Sandbox hosts written with a trailing dot (example.com.) slipped past deniedDomains.
• Plugins could read files outside their own directory through a declared component path that was a symlink. Such paths are now refused with an error.
• Dismissing the Remote Control consent prompt with Esc, or answering n at claude remote-control, counted as consent.
• /mcp reconnect and enable could still connect a settings-file MCP server that a managed allow/deny list loaded after startup should have blocked.

Auto mode kept changing after this release. Later, on October 16, the Claude Code changelog added CLAUDE_CODE_AUTO_MODE_MODEL to choose the model behind the client-side auto mode classifier; server-side auto mode is unaffected. The same entry changed server-side auto mode to compact a conversation that is too long for the safety check, where previously every checked tool call was denied.

Fewer cache misses, sturdier background sessions

With cache reads this cheap, a miss now costs more in relative terms, and the release fixes several causes. Remote Control connecting mid-session used to resend the Bash tool definition, which broke the prompt cache. Sessions with an advisor model set skipped the cache on background requests such as compaction, /recap and prompt suggestions, sending the whole conversation uncached each time. Long screenshot-heavy sessions missed the cache on every turn once images went over the per-request size cap. /fork now keeps the original conversation’s cache in the new background session by sending its worktree briefing as a message, where before it changed the system prompt.

Subagents whose response was cut off mid-stream by a computer going to sleep, a dropped connection or a server error now continue automatically, where before they ended with an incomplete response. On Bedrock and Bedrock Mantle, requests to Opus 4.7 and later went silent during long hidden-thinking phases, and idle timeouts then cut the connection; the stream now carries progress events. claude -p used to exit about five seconds after its final result even while a Monitor the model had armed was still running. It now waits for the watch to fire or time out.

Rendering got cheaper too. Long conversations need less re-render work per turn, streaming no longer slows down as a reply grows, and background-agent updates no longer redraw the whole screen. A new timeFormat setting, with timeZone, controls the turn-end clock and transcript timestamps: 12-hour, 24-hour, 24-hour UTC, or a strftime pattern. In VS Code, the input footer gets a model pill that opens the picker with an Effort row, and “Delete session” becomes “Archive session”, with an Unarchive action.

Settings to recheck

managedSourcesBehavior: "merge" now takes sandbox.credentials.awsPairs and sandbox.ripgrep whole from the highest managed source that sets them, where it used to combine values across sources. --add-dir, /add-dir and additionalDirectories now refuse network paths, UNC shares and /net/<host> automounts, with a message before touching them; on Windows, use a mapped drive letter. In the other direction, /add-dir now accepts a directory inside the current working directory and loads its skills, commands and agents, as --add-dir does at startup.

With allowManagedPermissionRulesOnly enabled, --disallowedTools and session deny rules used to be dropped after the first settings reload; that is fixed. Telemetry settings pushed through server-managed settings were ignored on warm starts, desktop-app Code sessions included. The keyless “Sign in with your Console account” flow didn’t apply the organization’s server-managed settings at all.

In project settings, defaultMode: "bypassPermissions" in .claude/settings.json or .claude/settings.local.json is now ignored, the same way "auto" already was. To keep that mode, set it in user or managed settings, or pass --permission-mode at launch.