Fable 5.2 and how to stay in control of AI agents

Hey 👋

Welcome back! Anthropic released Claude Fable 5.2 on Monday, its most capable model on the paid plans, and the first reactions are strong.

Ethan Mollick, the Wharton professor who writes One Useful Thing, found it as good as most human experts on many of the tasks he gave it. Every, which tested it in its own work, says it is the first model that lets professionals build production-grade tools without reading the code.

We start with what is new in Fable 5.2. After that, our focus is how to stay in control when an agent does more than you can watch. Jump to the AI News section further down for the other news from last week.

In this issue

• Claude Fable 5.2, what is new and when to use it
• Four ways to stay in control of AI agents, each with a prompt
• A bootcamp and a Build Day for everyone at Mesh on 30 November
• Our Build Night with CFA Society Norway and NFKF
• AI News, with GPT-6 Cyber and a security centre for Claude Enterprise

Claude Fable 5.2 is here

Claude Fable 5.2 comes two months after Fable 5.1, and it is built for the hardest technical work in coding, finance and science.

• Better at long jobs. It solves about half of Anthropic's business workflow tasks, up from under a third.
• Faster and cheaper. Up to 30 per cent faster, and 20 per cent cheaper for companies that build on it.
• Fewer blocked requests. About 55 per cent fewer than Fable 5.1, Anthropic says.
• Where you find it. On all paid plans from Pro up. Pro and standard Team can use it within their plan until 16 November, and after that through usage credits.

Anthropic's own advice is to start with Opus 5.5 for most coding and knowledge work, and move up to Fable when the job is harder. Claude Mythos 5.2 is the same model with fewer blocks, and only vetted security and life science teams get it.

How to stay in control of AI agents

We let agents do more and more of our own work. The more we hand over, the less we can watch each step. So most of the control now sits in how you set the agent up, before it starts. Here are four ways from our new guide.

1. Keep the blast radius small

Blast radius is how much can go wrong if the agent makes a mistake or is tricked into one. Treat it like a new colleague. On day one they get the files the job needs, not the whole company drive. Give the agent copies, and its own account with only the access the task needs.

Remember that the folder you pick in an agent tool such as Claude Code or Codex is where the agent works. It can still read files outside it unless you block that in the settings, so ask it before the first run.

Which folders can you read and which can you change? Then set it up so you cannot read or change anything outside this folder, and tell me what you changed.

2. Be careful when one agent can read, see and send

Simon Willison, the developer who gave prompt injection its name, calls it the lethal trifecta. An agent becomes dangerous when it can read your private data, see content you do not control, such as a web page or an email, and send things out.

With all three, a hidden instruction in an email can make the agent send your data to someone else. Check every new agent and connector against the list before you switch it on.

Check this project for the lethal trifecta, and tell me what to turn off.

3. Put a lock on what must never happen

A line in an instruction file such as CLAUDE.md is guidance, and the agent can miss it on a long task. A hook is a small script that Claude Code runs by itself at a fixed moment, every time, whatever the agent thinks. An instruction is a request, and a lock holds.

You do not have to write the hook yourself. Start by asking where one would help.

How can I use hooks in my project?

Hooks belong to agent tools such as Claude Code and Codex. Ordinary chat does not have them, and in Cowork they only come as part of a plugin.

4. Ask what the check proved

Addy Osmani, an engineer at Anthropic, points to a paradox in Critical thinking when agents do the work. The better the agent gets, the fewer errors you see, and the less you check.

Before you sign off, ask four questions. What did the check prove? What did it not check? What did it decide for me? Can I explain the result?

How to stay in control of AI agents covers the rest, from permission modes and connector settings to letting an agent run on its own with /goal and /loop. It applies to Codex, Copilot and Gemini CLI too.

Build with us on Monday 30 November

We run two events at Mesh in Oslo on the same day. Come to one, or stay for both.

Claude Code bootcamp for everyone, 09:00 to 15:30. A full day, hands-on, where you use Claude Code on files, analysis, writing and research. No coding experience needed. Registration closes on Sunday 29 November.

Sign up for the bootcamp →

Claude Build Day, 16:00 to 20:00. The Claude Community meetup for everyone who uses Claude Code. Bring a laptop and an idea, build alone or in a team, and finish with demos. Seats are limited.

Sign up for Build Day →

Build Night with CFA Society Norway and NFKF

On Tuesday 3 November we ran a Claude Build Night with CFA Society Norway and NFKF at DNB. More than 50 members and students spent the evening building with Claude Code. Thank you to everyone who came, and to DNB for hosting. Simon's post has more.

• A workshop first. Shubin Yu from HEC Paris opened the evening, and everyone built a financial analyst agent on synthetic data.
• Then a hackathon. The teams built investment analyses in Claude Code on patent data from Quant IP, which they reached through a connector.
• The winning team took the hardest task and turned the patent data into a tested investment strategy in under an hour.

Coming up

NDC Porto, 17 to 20 November. Aleksander speaks at Kopke Hotel in Porto.

We also run company bootcamps built around your team's tools, workflows and priorities. Get in touch if you want one for your team.

AI News

Here are the other updates from last week worth a look.

Claude can read your bank accounts. You link your bank and card accounts, then ask Claude about balances and spending. Access is read only, so Claude cannot move money. It is a beta for Pro, Max and Ultra in the US.

Claude Enterprise gets a security centre. It compares a company's settings with the setup Anthropic recommends, and can send prompts and tool calls to the company's own security tools. The security centre is in beta, and sending prompts and tool calls is available now.

Anthropic is improving its models about twice as fast as before. METR, an independent evaluator, spent August to October assessing Anthropic's research. Its rough estimate is that AI itself drives about 80 per cent of the speed-up, but Anthropic kept most of the strongest evidence private.

OpenAI rates GPT-6 Cyber Critical risk. The model finds and tests security holes, and only vetted security teams can use it. OpenAI gave GPT-6 Astra the same rating in September.

Grok can make phone calls for you. Paying users of xAI's Grok Bot in the US can now let it call businesses for them. xAI's terms make the user responsible for every call it makes.

Grok can mark the text it writes for businesses. xAI's API can now hide an invisible watermark in Grok's text, but it is off until a company admin turns it on. From 2 December, the EU rule on marking AI content also applies to tools already on the market.

Copilot Cowork can use your own browser. Cowork can finish web steps in a separate tab of Edge, with your logins kept on your machine.

Gemini reads your Google Forms answers. It counts and finds trends in the responses and suggests what to do next. It is rolling out on Business, Enterprise and Google AI plans, and the last companies get it from 19 November.

If you know someone who just gave an agent access to their email, feel free to forward this.

Best, Aleksander and Simon