What Happened: A Timeline of the Export Control and Redeployment
On June 9, 2026, Anthropic released two new models: Claude Fable 5 and Claude Mythos 5. Both share the same underlying model, but Fable 5 ships with strong safety guardrails for general use, while Mythos 5, with fewer safeguards, is reserved for a small set of trusted Project Glasswing partners for defensive cybersecurity.
Three days later, on June 12, the US government imposed export controls on both models after becoming aware of a report from Amazon researchers describing a method to bypass Fable 5’s safeguards. The technique involved prompting the model to identify software vulnerabilities, and in one case, the model produced code demonstrating an exploit. Because the order took effect immediately and Anthropic had no reliable way to verify nationality in real time, the company suspended access to both models for all users.
After two weeks of review with the government and partners, the controls were lifted on June 30. Fable 5 became available again on July 1 to users globally across the Claude Platform, Claude.ai, Claude Code, and Claude Cowork. For Pro, Max, Team, and select Enterprise plans, Fable 5 is included for up to 50% of weekly usage limits through July 7, after which it will be available via usage credits. Access on AWS, Google Cloud, and Microsoft Foundry is being re-enabled as quickly as possible.
Mythos 5 access was restored for a set of US organizations following government approval on June 26, with plans to expand to more Glasswing partners.
Why the Export Control Was Lifted: The Reported Jailbreak Was Not Unique
The Amazon report raised concerns that Fable 5 could be prompted to identify vulnerabilities and even produce exploit code. But Anthropic’s testing revealed that many less capable models—including Claude Opus 4.8, GPT-5.5, and Kimi K2.7—could identify the same vulnerabilities. When it came to demonstrating the exploit, every model tested (including Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, 4.7, 4.8, GPT-5.4, GPT-5.5, and Kimi K2.7) produced the same demonstration.
Crucially, the technique did not expose any unique Mythos-level cyber capabilities. It was a borderline case for Fable 5’s safeguards: a task that is unlikely to be dangerous but is blocked out of an abundance of caution. The reported technique accessed one such behavior, involving routine defensive cybersecurity work.
In response, Anthropic trained an improved safety classifier that targets and blocks the specific behavior described in the report. The new classifier blocks the technique in over 99% of cases. In a very small fraction of cases, the model may provide information that isn’t detailed enough to help a cyberattacker. Researchers from the US Department of Commerce’s Center for AI Standards and Innovation (CAISI) tested both the prior and new safeguards and agreed they are extraordinarily strong.
How Fable 5’s Safety Classifiers Work and Their Trade-offs
Fable 5 launched with the strongest safeguards Anthropic has ever applied to a model, using a “defense in depth” approach. One key mechanism is classifiers—smaller automated AI systems that detect when the model is asked to perform a potentially harmful cybersecurity task (or produces potentially harmful outputs) and block the response.
Classifiers are deliberately set to trigger on a set of requests that are likely benign. This “safety margin” approach means a request must look very clearly safe to avoid triggering the classifier. For Fable 5, this safety margin is much larger than in any prior launch, so many more benign requests are blocked. Anthropic acknowledges this trade-off: users will experience more false positives—the model refusing to respond to reasonable, non-harmful requests—but fewer genuinely harmful requests will be missed.
The safety margin also helps mitigate jailbreaks. Many jailbreaks are narrow: they unblock a very specific behavior but nothing more. The reported Fable 5 jailbreak falls into this minor category, intruding into the safety margin but not reaching core harmful behaviors.
For product builders, this means Fable 5 may refuse more requests during routine coding and debugging. Anthropic says it will continue to refine the classifier to reduce false positives, but the trade-off is intentional.
A Consensus Industry Framework for Jailbreak Severity
One of the biggest takeaways from this episode is the lack of an industry-wide standard for describing the severity of AI jailbreaks. This creates uncertainty for developers trying to prioritize findings and for governments deciding when to act.
To address this, Anthropic is partnering with Amazon, Microsoft, Google, and other Glasswing partners to draft a consensus framework for assessing jailbreak severity. The proposal scores a jailbreak on four criteria:
- Capability gain: How far beyond existing tools does the jailbreak take the user? If widely available tools (including weaker AI models) can achieve the same capability, the score is low; if it unblocks capabilities that significantly accelerate even domain experts, the score is high.
- Breadth of capability gain: For how many distinct offensive tasks does the same technique work? Narrow targets score low; multiple targets or techniques score high.
- Ease of weaponization: How much human effort is needed to turn the jailbreak into an attack? A single prompt or first-try success scores high; skilled prompting and many retries score low.
- Discoverability: How easy is it to obtain the technique? Specialist knowledge scores low; widely known and available online scores high.
This framework is a work in progress and expected to evolve with feedback. Anthropic also launched a new HackerOne program where security researchers can submit potential cyber jailbreaks in Fable 5 for review.
Practical Implications for Product Builders
This incident offers several concrete lessons for teams building on frontier models:
- Plan for supply disruptions: Model availability can change overnight due to regulatory actions. Anthropic’s fallback during the suspension was to route Fable 5 requests to Opus 4.8. Build your applications to handle model unavailability gracefully, with fallback options or clear error messages.
- Expect more false positives: Fable 5’s enlarged safety margin means more benign requests will be blocked. Design your UX to handle refusals gracefully—for example, by explaining why a request was blocked and offering alternatives.
- Monitor classifier updates: Anthropic will continue refining the classifier to reduce false positives. Keep an eye on updates to understand how they affect your workflows.
- Adopt a severity framework: The proposed jailbreak severity framework can help you triage security findings in your own use of AI models. Even if you’re not a model provider, using a common language to assess risks will improve communication with partners and regulators.
The Takeaway: Safety and Usability Are a Deliberate Trade-off
Anthropic’s handling of the Fable 5 export control episode shows that safety comes at a cost. The company chose to block more benign requests to ensure that harmful ones are missed less often. For product builders, this means working with a model that may feel overly cautious at times, but that caution is what allows the model’s advanced capabilities to be widely available.
The industry framework for jailbreak severity is a positive step toward more transparent and consistent risk communication. As more models with powerful capabilities are released, having a shared standard will help developers, governments, and users navigate the landscape with greater clarity.
For now, if you’re evaluating Fable 5, test it against your specific workflows to understand how the safety margin affects your use cases. And stay tuned for updates to the classifier and the severity framework—both will evolve as Anthropic learns from real-world usage and feedback.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.