Fable 5 Comes Off the Leash

Claude Fable 5 is available again. On June 30 the US government lifted the export controls that had frozen it, and starting today — Wednesday, July 1 — it is back for users globally, on the Claude Platform, Claude.ai, Claude Code, and Claude Cowork.

Anthropic’s redeployment statement describes both a regulatory disruption and further safeguard work. Its tests concern the particular reported vulnerabilities and exploit demonstration. Those results do not establish a universal absence of offensive capability, or the government’s sole reason for lifting restrictions.

This is the third chapter of a story I have been tracking since launch. Here is all of it — start to finish.

The eighteen-day timeline

It was an export control, not a ban

On June 12 — three days after Fable 5 launched — the US government, citing national-security authorities, issued an export-control directive. It did not order a blanket shutdown. It ordered something narrower and stranger: no foreign national may be given access to Fable 5 or Mythos 5. Not foreign nationals abroad — any foreign national, anywhere, including Anthropic's own foreign-national employees.

Anthropic said it could not reliably verify users’ nationality in real time. The company suspended access to both models for all users in response to the directive. This describes Anthropic’s reported response; it does not establish that suspension was the only legally available option.

In Anthropic’s account, the suspension followed the access restrictions in the directive. That explanation should be distinguished from an independent assessment of the government’s complete rationale.

Why the government reached for the switch

The trigger was a jailbreak. Anthropic says Amazon researchers found a way around Fable 5's safeguards by prompting it to identify software vulnerabilities, and in one case got it to produce code demonstrating how a vulnerability could be exploited.

To be clear about what that was and wasn't: this was reported vulnerability identification plus a single exploit demonstration — not a live break-in, and not a novel zero-day loosed on the world. But it is exactly the kind of dual-use cyber capability that regulators have been trying to get their arms around — the reason frontier models draw national-security scrutiny in the first place.

Anthropic also reported comparative tests of those cases.

What Anthropic’s comparative tests showed

Anthropic compared the reported cases across several models. Anthropic says many less capable models could identify the same vulnerabilities Fable 5 found — it names Opus 4.8, GPT-5.5, and Kimi K2.7 — and that for the exploit demonstration specifically, every model it tested could produce the same thing: Haiku 4.5, Sonnet 4.6, Opus 4.6, 4.7 and 4.8, GPT-5.4 and 5.5, and Kimi K2.7.

Anthropic reports comparable results from other models on the specific cases it tested. That is evidence about those cases; it should not be generalized into a complete comparison of offensive capabilities.

So if the reported capability is broadly available, what was actually worth worrying about?

Different safeguards, different access

This is the part to get right, because it is easy to invert.

Fable 5 and Mythos 5 are the same underlying model. The difference is the guardrails and who gets through them. Fable 5 shipped with what Anthropic calls "the strongest safeguards we've ever applied to a model," and it is the public product. Mythos 5 ships with fewer safeguards, was never public, and goes only to a small set of vetted partners in Anthropic's Project Glasswing.

Anthropic characterizes Mythos 5 as substantially more capable for finding and exploiting vulnerabilities. That is the company’s broader capability assessment, distinct from the narrow comparison it reports for the Amazon cases.

The company says access for a set of US organizations was restored on June 26, while Fable’s global access returned on July 1. Different audiences and safeguards make the dates relevant, but the sequence alone does not reveal all of the government’s reasoning.

The engineering implication is to document safeguards, allowed use and access boundaries alongside the model identifier. A shared underlying model does not make two deployed products operationally interchangeable.

What changed to bring it back — and what you'll feel

Anthropic didn't only wait out the order; it shipped a fix. It trained a new safety classifier that targets the specific bypass Amazon reported and, it says, blocks that technique in over 99% of cases. It is careful not to claim the model is now jailbreak-proof — perfect robustness isn't the claim; blocking the reported technique is.

There is a cost, and you'll feel it. Fable 5 already launched with a safety margin Anthropic calls "much larger than in any prior launch," and the new classifier tightens things further. Anthropic puts it plainly: the classifier comes "at the cost of flagging benign requests more often during routine coding and debugging tasks." So some ordinary coding and debugging work will trip the filter more than you're used to.

Anthropic described a user-facing refusal fallback at redeployment. API applications must separately check the documented fallback configuration, eligible refusal categories and response metadata. A fallback is not a general remedy for rate limits or unavailable endpoints.

What you actually get

At redeployment, Anthropic announced temporary included access through July 7 for specified plans. Subscription rules changed afterward, so treat that as historical launch context and check the current plan documentation before budgeting. API token prices and subscription allowances are separate.

The precedent this sets

The most consequential part of the announcement isn't Fable at all. It reads like a precedent — an export-control order reaching a live, deployed language model — and precedents get reused.

So Anthropic, with Amazon, Microsoft, Google, and its other Glasswing partners, is proposing a shared way to score how dangerous a given jailbreak actually is, on four axes:

• capability gain — how far beyond existing tools the technique reaches;
• breadth — how many different attacks use the same trick;
• ease of weaponization — how much skill it takes to turn into a real attack;
• discoverability — how easily someone could find it.

The proposed dimensions offer a way to structure evaluation. Anthropic’s reported comparisons address capability gain in the particular cases it tested; they do not establish the government’s overall rationale or settle the other dimensions. The framework remains a proposal, not adopted regulation, and the reported results do not determine how a future decision should be made.

Around it: a new HackerOne program for security researchers to submit cyber jailbreaks they find in Fable 5, plus commitments to give government evaluators pre-release access to future models, independent evaluation, and a shared voluntary security standard across frontier labs. That last piece moves the regulator closer to the release process itself. Whether that reassures you depends on the regulator — which is the argument I made when the leash first went federal, and not the point of this post.

The point

The verified sequence is narrower than a simple victory story: Anthropic reported comparative testing, shipped an updated classifier and announced that export controls had been lifted. The source does not establish that one test result alone caused the government’s decision.

The theme of this whole series holds: in frontier AI, the model is rarely the story. Fable and Mythos share one brain; everything that mattered here happened in the layer above it — the guardrails, the access rules, the billing, and now the export lawyers. Same weights, different leash.

Fable 5 is back. Route accordingly.

Sources: Anthropic redeployment statement, June 30 / July 1; API refusals and fallback; Current Fable plan access. Documentation checked September 20, 2026.