On 12 June 2026, three days after Anthropic launched Claude Fable 5 and Claude Mythos 5, the US government issued an export control directive that barred any foreign national from accessing the two models. Because it could not verify users' nationality in real time, Anthropic suspended both models for every customer worldwide. The controls were lifted on 30 June after Anthropic shipped a stronger safety classifier, and Fable 5 returned on 1 July. The episode shows that US export controls now reach model access itself, not just chips, and that model availability has become a regulatory risk that development teams need to plan for.

Key Facts#

  • The directive: Issued on Friday, 12 June 2026, citing national security authorities. It suspended access to Fable 5 and Mythos 5 by any foreign national, inside or outside the United States, including Anthropic's own foreign-national employees.
  • The models: Fable 5 launched on 9 June 2026 as a generally available "Mythos-class" model with strong safeguards, priced at $10 per million input tokens and $50 per million output tokens. Mythos 5 is the same underlying model with safeguards lifted in some areas, offered only to a small group of cyber defenders and infrastructure providers through Project Glasswing.
  • The trigger: A report by Amazon researchers described a way to bypass Fable 5's safeguards by prompting it to identify software vulnerabilities. In one case, the model produced code demonstrating how a vulnerability could be exploited.
  • The fix: A retrained classifier blocks the reported technique in over 99% of cases, and blocked requests are answered by Claude Opus 4.8 instead.
  • The timeline: The government approved restoring Mythos 5 for a set of US organizations on 26 June, lifted the controls on 30 June, and Fable 5 became available globally again on 1 July.
  • Other models: Anthropic said access to its other models was not affected.

What Happened#

Anthropic says it received the directive at 5:21 p.m. Eastern time on 12 June. According to the company, the letter did not describe the specific national security concern, but Anthropic understood that the government believed it had found a way to "jailbreak" Fable 5. Since the order took effect immediately, Anthropic said the practical result was that it "must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance."

Anthropic complied but disagreed publicly. In its statement the same day, it said the demonstration it had reviewed involved identifying a small number of previously known, relatively simple vulnerabilities that other public models could also find without any bypass. It argued that applying the same standard across the industry would "essentially halt all new model deployments for all frontier model providers." Anthropic said it supports the government having the ability to block unsafe deployments, but through a statutory process that is transparent, fair, clear and grounded in technical facts, which it said this action was not.

Over the next two weeks, Anthropic worked with the government and Amazon to review the report. Its testing found that several less capable models, including Claude Opus 4.8, GPT-5.5 and Kimi K2.7, could identify the same vulnerabilities, and that every model it tested could reproduce the single exploit demonstration. Anthropic nonetheless trained an improved classifier targeting the reported behavior. It said researchers from the Commerce Department's Center for AI Standards and Innovation (CAISI) tested both the old and new safeguards and judged them "extraordinarily strong." Anthropic also acknowledged a cost: the new classifier flags benign requests more often during routine coding and debugging.

Background#

Fable 5 grew out of Project Glasswing, the program Anthropic started in April 2026 to give a limited group of cyber defenders access to Claude Mythos Preview, a model it considered too capable at finding and exploiting vulnerabilities for general release. Fable 5 was Anthropic's attempt to bring that capability level to everyone behind layered safeguards. Classifiers detect requests related to cybersecurity, biology and chemistry, or distillation and hand them to Opus 4.8, which Anthropic said happened in fewer than 5% of sessions at launch. The company also began requiring 30-day retention of all traffic on Mythos-class models, on its own and third-party platforms, to investigate jailbreaks.

The directive also followed new executive action. Anthropic says it spent ten weeks working with the Office of the National Cyber Director, the Office of Science and Technology Policy, the Treasury, the Commerce Department and national security agencies as the administration developed the approach in the 2 June 2026 executive order on Promoting Advanced Artificial Intelligence Innovation and Security. That order set up an interagency cybersecurity vulnerability clearinghouse, which Anthropic has committed to join.

Why It Matters for Developers#

Most teams treat model retirement as a slow, announced process. This episode shows that a model can disappear overnight for regulatory reasons, and that the provider may have no choice but to switch it off for everyone. That has several practical consequences.

  • Design for provider and model substitution. Keep model identifiers in configuration, not code, and put calls behind an abstraction such as IChatClient from Microsoft.Extensions.AI so that a fallback model is a configuration change. Anthropic's own safeguards use the same pattern, routing flagged requests to Opus 4.8. Our guide to AI agent architecture patterns covers fallback and routing designs.
  • Record which model actually answered. With classifier-based fallbacks, a request sent to Fable 5 may be served by a different model. Log the model identifier returned with each response so that evaluations, cost reports and incident reviews stay accurate. The LLM observability guide shows how to capture this with OpenTelemetry.
  • Treat nationality-based access rules as a real possibility. The directive restricted people, not countries. If you embed a frontier model in a global SaaS product, map where your users and staff are and how quickly you could restrict or reroute access by segment.
  • Expect friction in security workflows. Stricter cyber classifiers mean more false positives for legitimate vulnerability scanning and secure code review. Test those workflows for refusals and fallbacks before you depend on them.
  • Review data handling. The 30-day retention requirement for Mythos-class traffic affects what code and data you should send, so check it against your data processing agreements.

What's Next#

Anthropic says it is drafting an industry framework for scoring jailbreak severity with Amazon, Microsoft, Google and other Glasswing partners. The draft rates each jailbreak on capability gain, breadth, ease of weaponization and discoverability. It has opened a HackerOne program for cyber jailbreaks and committed to expanded pre-release government access, rapid sharing of jailbreak findings and dedicated joint research staff. The open question is procedural. Anthropic has called for these rules to be codified in regulation, applied equally to all frontier developers and backed by "a durable, transparent process" for government involvement in AI releases. Whether such a process emerges, and whether similar directives will be used for other providers, remains an open question rather than an announced plan.

Sources#