On 9 June 2026, Anthropic launched Claude Fable 5 with a clear statement of intent: the most capable model ever made available to the general public, and also the most closely guarded. Three days later, the United States government switched it off for the rest of the world.
What happened in that 72-hour window concentrates one of the most complex —and potentially most consequential— debates in modern artificial intelligence development: what counts as a real security risk when we are talking about a language model? And who has the authority to define it?
A model built on unprecedented safeguards
To understand why the government's decision surprised a significant part of the industry, you have to grasp the scale of the safety apparatus Anthropic deployed around Fable 5.
Unlike its earlier models, Fable 5 shipped with an architecture of classifiers that actively intercept queries before the model answers them. When the system detects a request relating to cybersecurity, biology and chemistry, or attempts at model distillation, the response is generated not by Fable 5 but by Claude Opus 4.8, a previous-generation model. The user is notified of the switch. Anthropic reported that more than 95% of sessions triggered no rerouting at all [1].
Months of work sat behind that system. Anthropic worked with the US government, the UK AI Safety Institute (UK AISI), multiple third-party private organisations and internal teams to put the classifiers through more than a thousand cumulative hours of red teaming. The programme included a bug bounty open to the public. The stated result: no team found a "universal jailbreak", defined as a method capable of bypassing the safeguards broadly and systematically [1].
The one exception, mentioned in the official launch documentation, was the UK AISI, which made "progress towards" a universal jailbreak during a brief testing window on long-horizon agentic tasks —but did not complete one [1].
The 48 hours that changed everything
The security researcher known online as "Pliny the Liberator" published, less than 48 hours after launch, a demonstration of what they described as a bypass of Fable 5's classifiers. According to reports from CyberSecurityNews and GBHackers, the technique combined multiple attack vectors simultaneously: Unicode character substitution and Cyrillic homoglyphs to evade keyword classifiers; long-context framing to spread the malicious intent across extended conversations; presenting the content as narrative fiction or academic review; and a decomposition-recomposition strategy that split a potentially harmful request into apparently innocuous subtasks [2] [3].
The result, according to those reports, was the generation of stack exploits —software vulnerabilities that can be used to compromise computer systems. Anthropic itself, on reviewing the demonstration, concluded that the vulnerabilities identified were previously known, relatively simple, and reproducible by other publicly available models [4].
That last claim is central to everything that followed.
The GPT-5.5 standard: the comparison that stings
In its official statement, Anthropic made an explicit reference to OpenAI. The company said it had reviewed "the report we believe underlies the government directive" and validated that "the capability level demonstrated there is broadly available in other models, including OpenAI's GPT-5.5" [4].
To support that claim, Anthropic cited directly the GPT-5.5 cybersecurity evaluation page on OpenAI's Deployment Safety portal [4]. The reference matters: GPT-5.5 is a model with capabilities comparable to Anthropic's Mythos models in cybersecurity evaluations, according to analyses published by the UK AISI itself in May 2026 [5].
In fact, one UK AISI finding on GPT-5.5 is especially relevant in this context: during testing of OpenAI's model, evaluators found a universal jailbreak for its cybersecurity safeguards that took six hours of expert red teaming to develop. That jailbreak yielded violating content across every malicious cybersecurity query supplied, including in multi-turn agentic settings [5].
As of publication of this article, OpenAI's GPT-5.5 remains available to foreign nationals inside and outside the United States. It has received no export control directive.
Anthropic publicly framed this asymmetry as one of its central objections to the measure: "if this standard were applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers" [4].
The directive: what the government said, and what it did not
At 5:21 PM Eastern on 12 June, Anthropic received a letter signed by Howard Lutnick, Secretary of Commerce, addressed to CEO Dario Amodei. The directive ordered the suspension of all access to Fable 5 and Mythos 5 for any foreign national, inside or outside the United States, with immediate effect [6].
According to Axios, citing an administration official, the Department of Commerce made the decision after "another company" reported having achieved a jailbreak of Mythos. The identity of that company was not publicly disclosed [6].
What the letter did not contain, according to Anthropic's own statement, was a specific technical description of the national security threat justifying the measure. The company said it had received only "verbal evidence" of a possible narrow, non-universal jailbreak that "essentially consists of asking the model to read a specific codebase and fix any software flaws" [4].
That description —read some code and find bugs in it— describes a task thousands of developers and defensive security teams perform daily with commercially available AI tools.
The question of standards
The debate that emerges from these facts is not simple, and its implications reach far beyond the specific case of Fable 5.
Anthropic was explicit, before launch, about the inevitability of jailbreaks. In technical documentation published on 9 June, the company wrote: "We suspect that perfect jailbreak resistance is not currently possible for any model provider. Every safeguard used in the industry is vulnerable to non-universal jailbreaks [...] and universal jailbreaks are likely to be found eventually in the future. We stated this clearly when we launched Fable 5" [1].
That statement —technically honest— raises an uncomfortable question: if the industry has accepted that no model can be perfectly jailbreak-proof, what is the acceptable threshold of vulnerability for a model to be deployable? And who sets that threshold?
Anthropic's doctrine was "defence in depth": making jailbreaks expensive to produce, narrow in scope, and detectable through monitoring. To that end the company implemented a 30-day data retention policy for Mythos-class models —a measure that created friction with some corporate customers, but which allowed it to investigate and respond to emerging attacks [1].
The government, in issuing its directive, implicitly rejected that doctrine as insufficient. But it did not explain which alternative doctrine it considers acceptable, nor under what technical standard it assessed the severity of the reported jailbreak.
The precedent the government did not mention
One data point complicates the picture further: the UK AISI, in its pre-launch testing of Fable 5, had made "progress" towards a universal jailbreak during an initial testing window. That finding was publicly documented by Anthropic at launch [1]. It prompted no action from any government.
Similarly, the UK AISI found and documented a real universal jailbreak —not merely "progress towards one"— in OpenAI's GPT-5.5, which took six hours of expert work to develop [5]. That finding likewise produced no directive suspending access for foreign nationals.
The question these precedents raise is not easy to answer from outside: why was the government response different in the case of Fable 5?
Axios reported that the administration had previously pressed Anthropic to pause the launch of the new models, and that the company declined [6]. If that reporting is accurate, Anthropic's prior refusal to halt its launch introduces a variable that goes beyond the strictly technical.
What we know and what we do not
As of publication, the documented facts are these: a narrow, non-universal jailbreak of Fable 5 exists and was publicly demonstrated by "Pliny the Liberator"; the US government received a report of that vulnerability through an unidentified company; the export control directive was issued the same day Anthropic received the report; Anthropic itself validates that the capabilities demonstrated in the jailbreak are reproducible by GPT-5.5; and GPT-5.5 was subject to no equivalent measure.
What is not publicly documented: the specific technical details of the jailbreak the government received; the identity of the company that reported it and its possible conflict of interest; the exact methodology by which the government assessed the risk; and whether any formal technical standard guides this kind of decision.
Anthropic publicly committed to sharing more technical detail within 24 hours of the directive being issued [4]. The full picture could change with that information.
What does not change, whatever that additional information reveals, is the institutional precedent set: for the first time in history, the United States government used an export control instrument originally designed for chips and military technology to suspend global access to a commercial language model, distributing the cost of that decision to hundreds of millions of users around the world.
This article is part of an ongoing series of analyses on the Fable 5 case and its implications for the global artificial intelligence industry. We will keep updating this coverage as events develop.
Sources {#sources}
-
Anthropic. (9 June 2026). Claude Fable 5 and Claude Mythos 5. https://www.anthropic.com/news/claude-fable-5-mythos-5
-
CyberSecurityNews. (2026). Anthropic's Claude Fable 5 Alleged Jailbreak to Generate Stack Exploits. https://cybersecuritynews.com/anthropics-claude-fable-5-jailbroken/
-
GBHackers Security. (2026). Anthropic's Claude Fable 5 AI Model Jailbroken for Stack Exploit Creation. https://gbhackers.com/anthropics-claude-fable-5-ai-model-jailbroken/amp/
-
Anthropic. (12 June 2026). Statement on the US government directive to suspend access to Fable 5 and Mythos 5. https://www.anthropic.com/news/fable-mythos-access
-
UK AI Safety Institute (AISI). (2026). Our evaluation of OpenAI's GPT-5.5 cyber capabilities. https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities
-
Axios. (12 June 2026). Scoop: Trump admin blocks foreign access to Anthropic's most powerful AI. https://www.axios.com/2026/06/12/anthropic-trump-mythos-fable-national-security
-
CNBC. (12 June 2026). Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive. https://www.cnbc.com/2026/06/12/anthropic-disables-access-to-fable-5-and-mythos-5-to-comply-with-government-directive.html
-
The Hacker News. (2026). Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards. https://thehackernews.com/2026/06/anthropic-releases-claude-fable-5-its.html
-
DEV Community. (2026). Claude Fable 5 Was Jailbroken in 48 Hours. Here's What Actually Stopped Nothing. https://dev.to/coridev/claude-fable-5-was-jailbroken-in-48-hours-heres-what-actually-stopped-nothing-3hk4
-
Fortune. (13 June 2026). Anthropic disables Fable and Mythos AI models following U.S. government export ban. https://fortune.com/2026/06/13/anthropic-disables-fable-mythos-export-controls-national-security-threat/
