Anthropic's Fable 5.1 moves the hard part from prompting to bounding what it may do

A permission prompt does two jobs. It authorises the next action, and it gives you a cheap place to read the plan and kill the run. The Neuron's report that Fable 5.1 is more willing to keep working without asking every few minutes ^[18] takes away both at once. Longer stretches between returns mean a wrong turn costs forty commands instead of one, so the artifact you now have to get right is the harness: the allowlist, the working directory, the sandbox boundary, and the definition of done.

The Blender episode is the clearest exhibit. Their MCP setup was broken, Corey proposed letting the model repair it through computer use, and the team granted permission ^[10]. At 25:30 the model had found the ZIP and was installing it ^[11]. Read that as an agent editing its own toolset mid-task. The approval covered one install; the install changes what every later step can reach. If your permissions are scoped per action, that is contained. If they are granted once per session, you have handed over a standing capability.

Cat Doom is the team's own repeated house test, which they call a wonderfully unscientific benchmark, and their description of earlier attempts as code that technically ran and visually resembled regret is the most honest benchmark note I have read this month ^[7]. For that result to transfer to your queue, your task has to look like theirs: greenfield, no schema to respect, no credentials, and verifiable by watching it run. The extension is the part worth copying. They asked for 12 levels of rising difficulty and told the model to use subagents if needed ^[9]. That hands fan-out and spend decisions to the model, which is where a long run's bill actually gets set.

Which brings up what this material does not contain. The cost claim is the load-bearing one, and the writeup carries no token counts; pricing, safeguards and benchmarks sit in a separate launch piece, and one of this article's own section headings concedes that the cost story may matter more than the benchmark story ^[5][3]. The timestamps do bound the walltime. The best-yet verdict landed at 17:58 ^[8] and the ZIP install at 25:30 ^[11], seven minutes and 32 seconds later ^[16]. Grant's callout about computer-use speed came at 26:44, inside the first 45 percent of the roughly one hour they had allotted ^[12][17]. That is quick for an environment repair, and walltime is not a cost model.

Two other reads point the same way with different emphasis. Every's Dan Shipper ran a week of testing, Kieran Klaassen rebuilt Every's Proof editor from a single prompt and ran multi-day jobs, and Shipper says a computer-use Mac app called Hands was one-shotted after other models failed ^[13]. Klaassen's own framing was Fable-class depth plus a collaborator he can trust ^[14]. All of it is one publisher's account of its own and its colleagues' sessions.

In my context the review question changes shape. It stops being whether the prompt is specific enough and becomes what the agent can reach between checkpoints and what reversing that costs. Permissions are configuration you can inspect before the run. Judgement is something you can only assess after it.