Hello!

In our previous article, we covered Claude Fable 5 and Claude Mythos 5, announced by Anthropic on June 9, 2026.

Fable 5 took Mythos-class capability, added safeguards, and brought it down into a form that could be offered to general users.

We described it as "the myth descending to become a fable."

But that fable would vanish from public availability in just three days.

At 5:21 p.m. ET on June 12, 2026 (6:21 a.m. on June 13, JST), Anthropic announced that, having received an export-control directive from the U.S. government, it would suspend access to Fable 5 and Mythos 5.

The directive's scope was not limited to users outside the United States.

According to Anthropic's explanation, it also covers foreign nationals inside the United States, including foreign-national employees of the company itself.

And the response Anthropic actually took was not to filter out only the covered users, but to suspend both models for all customers.

This episode cannot be fully understood as a purely technical question of whether Fable 5's safeguards were sufficient.

What it reveals is the arrival of an era in which the availability of AI models is shaped not only by performance, pricing, and outages, but also by export controls, users' legal status, and government policy decisions.

Note: this article is based on information publicly available as of June 14, 2026. The full text of the government's directive to Anthropic, and the technical materials underlying the decision, have not been made public.

What happened

On June 9, 2026, Anthropic announced Fable 5 and Mythos 5.

The two share the same underlying model but differ in how they are offered.

Fable 5 shipped with safety classifiers that detect requests involving cybersecurity, life sciences, model distillation, and similar areas. When a classifier detects risk, Fable 5 itself does not answer; instead, the request is handed off to the next most capable model, Claude Opus 4.8.

Mythos 5, by contrast, was offered as a model with restrictions lifted in certain areas, available only to a limited set of users such as cyber-defense organizations and critical-infrastructure operators.

Regarding Fable 5's safety measures, Anthropic had explained that they were designed conservatively enough to sometimes flag harmless requests by mistake.

While still anecdotal, this matches our own experience — we ran into it repeatedly, as shown below.

Even so, Anthropic judged this degree of caution necessary in order to offer Mythos-class capability to the general public.

Then, on June 12, 2026, the U.S. government, citing national-security authority, directed Anthropic to suspend access to Fable 5 and Mythos 5 by foreign nationals.

According to Anthropic, the directive arrived at 5:21 p.m. Eastern Time that day. The letter reportedly contained no concrete explanation of the national-security concern.

Reuters confirmed with U.S. government officials that the Commerce Department had issued an export-control directive demanding suspension of both models for foreign nationals.

However, neither the directive itself nor the materials underlying the technical judgment have been made public at this time.

The government's concern, and Anthropic's rebuttal

Anthropic explains
that the government had identified a so-called jailbreak technique that circumvents Fable 5's safety mechanisms — at least, that is the company's understanding
.

In the demonstration the company reviewed, the technique reportedly involved having the model read a specific codebase and discover several known, minor vulnerabilities.

Anthropic has pushed back on this, making the following points.

The technique in question is not a "universal jailbreak" that disables safety mechanisms broadly, but a narrow method that works only in limited circumstances.

The vulnerabilities discovered were relatively simple, and could be found with other publicly available models without bypassing any safety mechanisms.

Before Fable 5's release, the U.S. government, the U.K. AI Security Institute, external organizations, and internal teams had conducted thousands of hours of combined testing.

And the company has received no reports of a serious jailbreak leading to real-world harm.

Anthropic acknowledges that a fully unbreakable safety mechanism is difficult to achieve today. Its approach was defense in depth: keep each individual bypass narrow, make large-scale circumvention costly, and use monitoring to detect and shut it down.

The company argues that if this degree of limited circumventability is enough to fully suspend a generally available model, the same standard would apply to other companies' frontier models — making it effectively impossible to release new models at all.

What matters here is not rushing to declare either side correct on the basis of public information alone.

The government's detailed technical rationale has not been published. At the same time, the assessment that the technique was limited and comparable to what other models allow comes, at this point, mainly from Anthropic's side.

Therefore, at this stage we can conclude neither that "the government overreacted" nor that "Fable 5 had a serious flaw."

What we can confirm is
the fact that the government's and the model provider's risk assessments diverged, and that by the government's judgment, the model as a whole was suspended three days after release.

"Blocking access from outside the U.S." is not enough

A particularly important aspect of this directive is how it draws the line around who is covered.

This is not a simple geographic restriction.

If the condition were "suspend access from outside the United States," a degree of control — imperfect, but workable — would be possible via IP addresses, contracting entities, billing addresses, cloud regions, and so on.

But according to Anthropic's explanation, this directive extends to foreign nationals inside the United States.

In other words, what must be determined is not where the connection comes from, but who is connecting.

U.S. export controls include the concept of the "deemed export": disclosing controlled technology or source code to a foreign person inside the U.S. is treated as an export to that person's country of nationality.

How the ordinary deemed-export rules were specifically applied in this directive cannot be confirmed, since the directive itself has not been published.

But the very fact that foreign nationals inside the United States were included shows that
in export control, what can be at issue is not only geographic borders but the legal status of the person accessing the technology.

Ordinary cloud services do not necessarily have mechanisms to verify the nationality or residency status of every user.

For consumer services, what is known is mostly name, email address, phone number, payment details, and connection region. That information alone cannot reliably determine whether someone is a U.S. citizen, a permanent resident, or a foreign national on a temporary stay.

Enterprise use is even more complicated.

A single corporate contract covers employees of multiple nationalities. A single API key or service account may be shared by multiple teams and systems.

Even if a U.S. company holds the API contract, a product built on that API may be used by people overseas. Foreign subsidiaries, contractors, and maintenance staff may access the same environment.

From Anthropic's vantage point as the model provider, it is not always possible to know who is ultimately consuming the output.

Furthermore, the population to be controlled is not limited to users who send prompts directly to the model.

Staff who access the admin console, operators who read logs, support personnel handling inquiries, developers evaluating the model — where to draw the line on what counts as "access" also has to be worked out.

Reliably excluding only foreign nationals would require re-running identity verification, confirming legal status, redesigning permissions inside companies, tracking downstream API redistribution, and managing access including contractors.

That is not a change on the order of blocking an IP address.

Anthropic chose not to selectively cut off foreign nationals, but to suspend the service for all customers.

The company has not explained its technical and operational reasons in detail. But in a situation demanding assured compliance immediately upon receiving the directive, suspending everything was likely the more realistic choice than continuing to serve with an incomplete filter.

This does not mean that restricting availability to U.S. persons is impossible in principle.

With rigorous identity verification and intra-organizational access controls, some form of restricted offering would not be out of reach. Still,
taking an existing AI model that is consumed by individuals, companies, and cloud services worldwide and cleanly partitioning it, on short notice, by users' nationality and legal status appears deeply at odds with how these services are currently designed.

Export control has expanded to cover "access to the model"

U.S. AI export controls have so far centered mainly on high-performance semiconductors such as GPUs, semiconductor manufacturing equipment, and related technology.

Those are the computing resources used to build AI.

What happened here was a restriction not on computing resources, but on access to the capabilities of an already-trained model.

That is an important difference.

With GPUs, you can track the physical shipping destination, the owner, and the installation site.

An AI model offered as an API, by contrast, is served from one place to the entire world at once. Even if inference runs in a U.S. data center, the user might be in Japan, Europe, or Asia — or be a foreign national inside the United States.

Nor do users necessarily operate the model directly. Behind SaaS products, internal systems, developer tools, and business agents, a particular model may be invoked without the user ever knowing.

Even if the model is never physically exported, its capabilities cross borders over the network.

This directive made clear that an AI model itself can become a national-security-controlled item, in the same way as semiconductors and cryptography.

Technical safety alone cannot guarantee continued availability

Fable 5 was an attempt to make general availability possible by adding safeguards to a powerful model.

Anthropic built a mechanism that detects high-risk requests with classifiers and switches to a less capable model. For monitoring purposes, Fable 5 also made 30-day retention of customer data mandatory.

In other words, Anthropic had designed defense in depth encompassing not just technical safeguards but operational monitoring as well.

But there is no guarantee the government will judge that design sufficient.

Even if a company believes it can offer the model safely, external organizations have tested it, and users have signed contracts, the model stops if the government reaches a different risk assessment.

At this point, there is no longer a single party who decides what is safe.

The company that builds the model.

Third-party evaluation organizations.

Cloud providers.

Customer companies.

And the government.

Each holds different information and evaluates risk by different standards.

The question is not the simple binary of whether governments should have the power to stop AI models.

Anthropic itself has said that a system allowing the government to halt genuinely dangerous models is necessary.

What should be asked is by what standards that judgment is made.

How much capability makes a model subject to regulation?

Is a single confirmed, limited jailbreak enough to trigger suspension?

If other companies' models have the same capabilities, will the same standard be applied?

Can the model provider access the technical materials behind the decision?

Is there a process to appeal the decision and have a third party re-verify it?

Without clarity on these points, neither model providers nor the companies using them can know what conditions must be met to keep offering a model safely.

Safety regulation needs not just strong authority, but predictability and verifiability.

For Japanese companies, this is not someone else's problem

This directive targets two Anthropic models.

But the lesson companies should draw is not limited to any particular vendor.

Until now, AI model availability risk has mostly meant things like the following.

• API outages
• Rate limits
• Pricing changes
• Model deprecation
• Terms-of-service changes
• Shifts in performance or output behavior

Going forward, policy and regulatory risk joins that list.

A model that was available yesterday can suddenly become unavailable due to export controls, national-security determinations, nationality requirements, or orders issued to cloud providers.

As long as Japanese companies use AI models from U.S. companies, they cannot be fully independent of U.S. policy decisions.

That said, it is not as simple as saying everything is solved by switching to domestic models (and defining "domestic" is likely to be a difficult topic in its own right).

What matters is
treating the loss of a model not as an exceptional accident、a business-continuity scenario built into the design
.

1. Avoid tight coupling to a specific model

Avoid embedding each model's distinct API conventions, tool-calling formats, and prompt formats too deeply into your applications.

It is important to have a model-switching layer and a structure that allows migration to alternative models.
(Though as practitioners, we recognize this is easier said than done.)

2. Decide on degraded operation for outages

Decide in advance what happens when a high-performance model becomes unavailable: continue on a lower-tier model, hand the work back to humans, or suspend certain features.

Simply switching to an alternative model is not always enough. Switching to a model with different performance or safety characteristics can leave you unable to meet your quality bar.

3. Make your evaluation assets portable

So that you can compare models before and after a switch, maintain your own evaluation data grounded in real work, expected outputs, and failure cases.

Vendor benchmarks alone
cannot tell you whether a substitute will work for your business.

4. Know not just your counterparty, but the delivery path

The same model may be offered through multiple channels: Anthropic's direct API, AWS, Google Cloud, Microsoft's platforms, and so on.

In this case, it was reported that AWS was also required to withdraw access across all regions and all users.

Naturally, changing clouds does not necessarily let you sidestep regulation. You need to know which company controls the model, which country's legal regime applies, and along which paths a suspension decision propagates.

5. Plan for policy-driven suspension, not just SLAs

Ordinary SLAs cover uptime and time to recovery.

But a suspension by government order is different from an ordinary outage.
The model provider cannot decide the recovery date itself, and its obligation to provide alternatives may be limited.

When embedding AI in critical operations, you should also confirm how service termination, model withdrawal, and regulatory suspension are handled contractually.

Looking only at jailbreaks obscures the full picture of safety

What the government took issue with, per Anthropic's explanation, is a jailbreak: circumventing safety mechanisms to draw out capabilities that should be restricted.

That is a failure to stop what should be stopped — the safety mechanism's "miss."

But safety mechanisms have failures on the opposite side as well.

False positives that judge harmless requests to be dangerous.

Confabulations that describe attacks that never actually occurred.

Opacity that prevents users from later verifying what the safety mechanism actually detected.

And the audit problem that a model switch makes it harder to trace which model generated which output.

Even before this government directive, we had been investigating
a case in which a Claude Code session running on Fable 5 reported a prompt injection that did not exist
. (We plan to publish a separate article on it.)

That is a different phenomenon from the jailbreak said to concern the government.

One is the possibility that dangerous capabilities could be drawn out.

The other is a case in which, with no attack present, an explanation was generated claiming an attack had been detected and refused.

The two should not be conflated.

But both lead to the same question.

Can a safety mechanism really be evaluated only by what it stopped?

What did it miss?

What did it stop in error?

Did it correctly explain why it stopped what it stopped?

Can it be verified afterward against independent records?

Evaluating safety requires looking at all of these.

As for the case we experienced,
we will present the verification using raw logs, and the defenses we built from it, in detail in a separate article.

Closing thoughts
The "intelligence" you used yesterday can be taken away by policy

Fable 5 was an ambitious attempt to bring Mythos-class capability safely to general availability.

But however many technical safeguards were layered on, continued availability was never guaranteed.

If we frame this episode only as a standoff between the U.S. government and Anthropic, or a dispute over one jailbreak, we miss the essence.

What has come into view is an era in which AI models are strategic national-security assets, and the scope of their availability is set by policy.

And with it, the difficulty of precisely partitioning AI capability — delivered worldwide over the network — by user nationality.

Availability risk in AI adoption is not just servers going down.

Nor is it just model prices rising or API specifications changing.

The "intelligence" that was supporting your operations yesterday can, by a government's decision, become unavailable the next day。

Companies have entered the stage of designing AI systems with that possibility as a premise.

Choosing a high-performing model is, of course, important.

But from now on, the question is also whether your business can continue when that model becomes unavailable.

The design quality of AI adoption will be judged with that included.

An enterprise AI platform that does not depend on any single model

"Bestllam," provided by Qualiteg Inc., is an enterprise AI platform for integrating multiple generative AI models and AI agents into corporate work environments.

It supports more than 30 LLMs, including GPT, Claude, and Gemini, allowing model selection per task and simultaneous use of multiple models. Rather than tightly coupling operations to a single model, it aims to give you options based on use case, performance, cost, and availability.

It also offers integration with internal systems, dedicated isolated execution environments, and protection for personal and confidential information via LLM-Audit® — the features needed to take AI beyond proof-of-concept into sustained business use.

In addition to providing Bestllam, Qualiteg supports enterprise AI adoption on both the design and development fronts: model selection, multi-model architectures, degraded operation during outages, evaluation-data development, and integration with existing systems.

If you are rethinking dependence on a specific model, or considering an AI platform that can withstand changes in the model landscape, please contact Qualiteg.

See you next time.