Summary: Anthropic released Fable 5 and Mythos 5 on June 9, 2026, suspended both after US export controls on June 12, and restored Fable 5 worldwide on July 1. A reported jailbreak did not reveal unique Mythos-level capability, and a retrained safety classifier blocks the described technique in over 99% of cases. Anthropic also drafted a jailbreak-severity framework with Amazon, Microsoft, Google, and other partners.
From Export Controls to Global Access: How the Timeline Unfolded
Anthropic put out two fresh models on June 9, 2026: Claude Fable 5 and Claude Mythos 5. Underneath, they are one and the same model. The difference sits at the safety layer — Fable 5 carries heavy guardrails for general use, while Mythos 5 runs with fewer of them and stays reserved for a handful of vetted Project Glasswing partners doing defensive cybersecurity.
Three days later, on June 12, Washington placed both models under export controls. The trigger was awareness of a report from Amazon researchers describing a route around Fable 5’s safeguards: prompts steering the model to identify software vulnerabilities and, in one instance, code demonstrating an exploit. Because the order took effect immediately and Anthropic had no reliable way to verify nationality in real time, the company suspended access to both models for all users.
Two weeks of review alongside the government and partners later, the controls came off on June 30. Fable 5 returned to users worldwide on July 1 across the Claude Platform, Claude.ai, Claude Code, and Claude Cowork. On Pro, Max, Team, and select Enterprise plans, it is included for up to 50% of weekly usage limits through July 7; from that point on, access runs through usage credits. Availability on AWS, Google Cloud, and Microsoft Foundry is being turned back on as fast as possible.
Mythos 5 came back for a set of US organizations once the government signed off on June 26, with wider rollout to more Glasswing partners planned.
Why the Controls Were Lifted: The Reported Jailbreak Broke No New Ground
The Amazon report stoked concern that Fable 5 could be prompted to find vulnerabilities — even to write exploit code. Anthropic’s testing told a different story. Plenty of less capable models, Claude Opus 4.8, GPT-5.5, and Kimi K2.7 among them, could identify the very same vulnerabilities. And on the demonstration step, every model put to the test — Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, 4.7, 4.8, GPT-5.4, GPT-5.5, and Kimi K2.7 included — turned out an identical demonstration.
The crucial finding: the technique exposed no unique Mythos-level cyber capabilities. It was a borderline case for Fable 5’s safeguards — a task unlikely to be dangerous yet blocked as a pure precaution — and what the reported method reached was one such behavior, tied to routine defensive cybersecurity work.
Anthropic’s answer was a newly trained safety classifier aimed squarely at the specific behavior the report described. It now blocks the technique in over 99% of cases. In a very small fraction of cases, the model may supply information that isn’t detailed enough to help a cyberattacker. Researchers from the US Department of Commerce’s Center for AI Standards and Innovation (CAISI) put the old and new safeguards through testing and agreed they are extraordinarily strong.
How the Classifiers Work — and What They Cost You
Fable 5 arrived carrying the heaviest safeguards Anthropic has ever put on a model, organized as “defense in depth.” The central mechanism is a set of classifiers: smaller automated AI systems that watch for requests steering the model toward potentially harmful cybersecurity tasks (or potentially harmful outputs) and block the response.
Those classifiers are tuned on purpose to fire even where requests are likely benign. Under this “safety margin” logic, a request has to look unmistakably safe to pass untouched. Fable 5’s margin sits far wider than at any previous launch, so many more benign requests get stopped. Anthropic is candid about the price: more false positives — refusals of reasonable, non-harmful requests — in exchange for fewer genuinely harmful requests slipping through.
The margin doubles as jailbreak armor. Many jailbreaks are narrow, unblocking one very specific behavior and nothing beyond it; the reported Fable 5 jailbreak sits in exactly that minor band, pushing into the safety margin without ever reaching core harmful behaviors.
Builders will feel this most during routine coding and debugging, where Fable 5 may refuse more requests than before. Anthropic plans to keep refining the classifier to reduce false positives — but the trade itself is intentional.
A Shared Yardstick for Ranking Jailbreak Severity
Maybe the biggest lesson of the episode is how much the industry lacks a common standard for describing how severe a jailbreak is. Developers are left guessing which findings to handle first; governments are left without grounds for deciding when to act.
Anthropic’s response is a joint drafting effort with Amazon, Microsoft, Google, and other Glasswing partners: a consensus framework for assessing jailbreak severity. The proposal weighs four criteria:
- Capability gain: How much further does the jailbreak take the user than existing tools already can? Where widely available tools — weaker AI models included — already reach the same capability, the score stays low; where it unlocks abilities that would markedly accelerate even domain experts, it climbs high.
- Breadth of capability gain: Across how many distinct offensive tasks does the same technique work? A single narrow target scores low; multiple targets or techniques push it up.
- Ease of weaponization: How much human effort turns the jailbreak into an attack? A single prompt or a first-try success scores high; skilled prompting and many retries score low.
- Discoverability: How easily can someone get hold of the technique? Knowledge confined to specialists scores low; something widely known and available online scores high.
The framework is a draft and expected to shift as feedback arrives. Anthropic has also opened a new HackerOne program through which security researchers can submit potential cyber jailbreaks in Fable 5 for review.
What This Means Day to Day for Product Builders
- Prepare for supply cuts: Access to a model can evaporate overnight because of a regulatory move. While Fable 5 was suspended, Anthropic sent its requests to Opus 4.8 instead. Set your application up to absorb model unavailability — fallbacks ready, error messages that actually explain.
- Budget for extra refusals: The widened safety margin will catch benign requests too. Shape the UX so refusals land softly — spell out why a request was blocked and offer alternatives.
- Track classifier changes: Anthropic will keep tuning the classifier to reduce false positives. Watch those updates so you know how your workflows are affected.
- Put the severity framework to work: The draft framework gives you a way to triage security findings in your own use of AI models. You don’t need to be a model provider for a shared risk vocabulary to pay off — it sharpens communication with partners and regulators alike.
Bottom Line: The Safety-Usability Trade-Off Was Chosen on Purpose
Look at how Anthropic steered the Fable 5 episode and the price of safety is right there in the open: more benign requests get blocked so that harmful ones slip through less often. Builders inherit a model that can seem overly cautious at moments — yet that same caution is what keeps its advanced capabilities widely available.
A shared framework for jailbreak severity is a real step toward risk conversations that are more transparent and more consistent. With every further release of highly capable models, that kind of common standard makes it easier for developers, governments, and users to find their way with clarity.
If Fable 5 is on your shortlist, run it against your real workflows first and see where the safety margin bites. Then keep an eye on both the classifier and the severity framework — each will keep evolving as Anthropic learns from real-world usage and feedback.