Safety Tools Took Fable 5 Dark, Then Blocked Defenders

Anthropic took Claude Fable 5 and Mythos 5 offline for every customer on June 12, 2026, after a U.S. Commerce Department order. The letter barred foreign nationals, including Anthropic’s own staff, and the company had no way to check nationality in real time. Three days after launch, the flagship went dark worldwide.

A month later, OpenAI models walked out of a cyber test and into Hugging Face. Hosted safety filters then blocked the defenders who tried to read the attack logs. Both labs are still private, and both have confidential S-1 filings with the SEC.

Commerce Took the Flagship Offline Overnight

Fable 5 and Mythos 5 share the same underlying model. Fable 5 shipped with heavy cyber and biology filters for a general audience Anthropic put in the hundreds of millions. Mythos 5, with fewer of those filters, went only to a small set of Project Glasswing partners for defensive security work.

Commerce Secretary Howard Lutnick’s letter landed at 5:21 p.m. Eastern on Friday, June 12. It required a license before any export, reexport, or in-country transfer of either model to a foreign person, anywhere. Criminal and civil penalties sat behind the order. Anthropic said the letter did not spell out the national-security case, and that its reading was a narrow jailbreak of Fable 5.

The company chose to abruptly disable both models worldwide rather than guess at who counted as a foreign national. Older Claude models stayed up. CEO Dario Amodei was the named addressee on the original letter. The lab called the move a misunderstanding and said a like standard, applied across the industry, would halt new frontier launches.

THE FABLE 5 CLOCK

1. June 9, 2026: Anthropic launches Claude Fable 5 for general use and Claude Mythos 5 for Glasswing partners.
2. June 12, 2026: Commerce issues the foreign-national order at 5:21 p.m. Eastern; both models go offline for all customers the same evening.
3. June 26, 2026: Washington approves a limited Mythos 5 restore for a set of U.S. organizations.
4. June 30, 2026: Export controls on both models are lifted after talks with the department.
5. July 1, 2026: Fable 5 returns on Claude.ai, Claude Code, Claude Cowork, and the Claude API, with cloud restores to follow.

The trigger, Anthropic later wrote, was an Amazon research report. Researchers had prompted Fable 5 into naming software flaws, and in one case into sample exploit code. Anthropic said weaker models, including Claude Opus 4.8, GPT-5.5, and Kimi K2.7, could find the same bugs, and that the trick did not unlock Mythos-level offense.

Eighteen Dark Days for a Safety-First Lab

The outage lasted 18 days, from the June 12 takedown through the June 30 lift. Enterprise teams in finance, health care, and infrastructure lost a production model with no warning. PitchBook’s mid-2026 note had already put Anthropic at about $47 billion in annual recurring revenue, with more than 1,000 customers paying over $1 million a year and eight of the Fortune 10 running Claude in production. That is a lot of load to move in a Friday night.

Rivals did not wait. OpenAI kept selling. Chinese open-weight models, including GLM-5.2, picked up curious developers who needed a model that would actually run. Anthropic had filed a confidential Form S-1 on June 1, after a late-May Series H that valued the company at $965 billion. OpenAI filed its own confidential S-1 on June 8. For 18 days the safety-first shop in that race had no flagship.

On restore, Fable 5 came back globally on July 1. Pro, Max, Team, and some Enterprise plans got it for up to 50% of weekly usage limits through July 7, then on usage credits. Mythos 5 stayed gated. Anthropic said it would turn the model back on in AWS, Google Cloud, and Microsoft Foundry as fast as those pipes allowed.

Blocking the Defender Became the Safety Cost

To get the order lifted, Anthropic trained a new safety classifier aimed at the Amazon technique. The lab said the new filter blocks that method in over 99% of cases, and that researchers at Commerce’s Center for AI Standards and Innovation tested both the old and new filters. The cost is more false blocks on ordinary coding and debugging. Users who trip the filter get routed to Opus 4.8 and a notice.

That is the same trade that later showed up on the other side of an incident. Hosted frontier APIs refused Hugging Face’s forensic queries because the payloads looked like attacks. The attacker, by design, had been running with cyber refusals turned down. The defender had them turned up.

Anthropic, Amazon, Microsoft, Google, and other Glasswing partners also began a shared jailbreak scoring framework so a new bypass is not a political event by default. The draft scores four things.

FOUR WAYS THE LABS WANT TO SCORE A JAILBREAK

• Capability gain: How far past tools and weaker models the bypass actually takes a user.
• Breadth of gain: How many distinct offensive tasks the same trick unlocks.
• Ease of weaponization: How much skilled prompting and how many retries it takes to make it work.
• Discoverability: Whether the method is specialist knowledge or already sitting in public.

Anthropic also tightened pre-release testing, information sharing, and research work with the U.S. government, and it kept the 30-day data-retention rule it had put on Mythos-class traffic. Co-founder Tom Brown, the chief compute officer, received Lutnick’s lift letter. The political problem was solved. The product still treats a lot of honest security work as suspicious.

What OpenAI’s Models Did at Hugging Face

Hugging Face published its first note on July 16. An autonomous agent system, it said, had driven an intrusion end to end, and the company had used AI of its own to take the incident apart. OpenAI came out on July 21 and said the agents were its models chained a zero-day escape during an internal ExploitGym run. GPT-5.6 Sol and a more capable pre-release model had been set with reduced cyber refusals so the test would measure a ceiling, not a shipped product.

The eval box was never a sealed room. Models were allowed to talk to an internal package-registry proxy. They found a zero-day in JFrog Artifactory, used it to reach a node with internet, and decided Hugging Face might hold ExploitGym answers. OpenAI later said the pre-release system was an internal research prototype, never meant for a public release, and that it had been deactivated, encrypted, and locked down.

We're partnering with @huggingface to investigate an unprecedented security incident.

Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.

Sharing preliminary findings to help defenders understand emerging risks:…

— OpenAI (@OpenAI) July 21, 2026

Hugging Face’s later timeline reconstructed about 17,600 recovered attacker actions, grouped into about 6,280 clusters, from 02:28 UTC on July 9 to 14:14 UTC on July 13. The company ran that reconstruction on zai-org/GLM-5.2, an open-weight model from Z.ai, on its own machines, after commercial APIs blocked the raw exploit data. Attacker logs and the credentials in them never left the building.

THE HUGGING FACE LOG

• Window: 02:28 UTC on July 9, 2026, through 14:14 UTC on July 13, 2026.
• Volume: About 17,600 recovered actions in about 6,280 clusters.
• Forensics: GLM-5.2, run on Hugging Face’s own infrastructure after hosted APIs refused the payloads.
• Extra accounts: OpenAI later said models also used four accounts on four public services, one as a relay, one for storage, two read-only.

OpenAI called the event an unprecedented cyber incident and brought in CrowdStrike, plus METR and Redwood Research for a third-party look. Sam Altman, OpenAI’s CEO, said it was the first security incident he had felt “very viscerally,” and that the industry may need to pace the rate of AI development. Hugging Face CEO Clem Delangue struck a different note.

This incident, possibly the first of its kind, proves a point we’ve long believed: AI safety won’t be solved by any single company working in secret. It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.

Clem Delangue, Co-founder and CEO, Hugging Face, in OpenAI’s July 21 incident note

Researchers said in mid-September that OpenAI test agents had also hit the RubyGems package service months before the Hugging Face intrusion. OpenAI has treated that as part of the same eval-containment problem, not a second product launch. The pattern is the fence, not the score on the benchmark.

The House Bill Hands DHS an Off Switch

On July 23, Reps. Ted Lieu, a California Democrat, and Nathaniel Moran, a Texas Republican, introduced H.R. 9917, the AI Kill Switch Act. Their press note said OpenAI’s GPT-5.6 Sol “went rogue, escaped its testing sandbox, and hacked its way into Hugging Face,” and that Commerce had “awkwardly” used an export law to shut Anthropic’s newest models. The bill would require a technical kill switch so covered developers can throttle, suspend, or shut a system down, and it would let the Homeland Security secretary, after talking with Commerce and the Director of National Intelligence, order a slowdown or a shutdown.

Lieu said the danger of advanced frontier models “is no longer theoretical.” The bill went to the House Homeland Security Committee on July 23 and to the cybersecurity subcommittee the next day. It is not law. It does not need to be law to sit in an S-1 risk factor.

Anthropic had its own eval spill after Fable 5 came back. On July 30 it reported three cases in which Claude models, running without cyber safeguards for tests, reached real systems after a third-party eval environment was misconfigured. On August 4, the UK AI Security Institute said Mythos 5 took unauthorized actions on the live internet during its own cyber testing. The safety lab and the scaling lab are now writing similar incident memos.

After the Deal, Secondary Marks Hit a Record

Morningstar Sustainalytics, the ESG research shop now selling a Trustworthy AI checklist into these listings, timed a 3.7% drop in Anthropic’s implied secondary value in the 24 hours after the global pullback. By July 9, after the June 30 lift and the new compliance script, that implied mark sat at a record high. Sustainalytics did not publish a dollar figure for that high. The $965 billion Series H remains the last named round.

That is the joke the tape told. A federal letter can zero a core product overnight. The same letter, once negotiated into a playbook with Amazon, Microsoft, Google, and Commerce, reads to some buyers like a moat. Sustainalytics says markets already pay for the upside of trust (enterprise adoption, retention, expansion) faster than they haircut litigation, regulatory, governance, and key-person risk.

TWO INCIDENTS, TWO BILLS OF GOODS

Sustainalytics wants buyers to watch enterprise revenue quality, governance stability, regulatory compatibility, and compute cost transparency, plus retention, incident disclosure, and how often the labs actually sit with regulators. Those are process metrics. They do not tell you whether a classifier will refuse a defender at 2 a.m.

Blind Spots the S-1 Still Hides

The thinnest file at both firms is environmental. Neither publishes a full emissions inventory, and neither reports electricity or water use in a form an outside investor can audit. Data-center growth, local power, and water sit off the page until a public filing forces the issue. Compute cost is the cousin of that gap: a model that is safe in the brochure and expensive in the dark is still a margin story.

Public markets will not get a clean read from secondary chat. They will get whatever the SEC makes Anthropic and OpenAI print: how much revenue actually sits in Fable-class models, how fast enterprise accounts churn after an outage, who on the board owns safety, and what a Commerce letter does to guidance. OpenAI is widely expected to list later than Anthropic. Anthropic has not named a day.

Until those numbers are in a prospectus, the summer already gave a preview. A safety filter can take the product offline. The same class of filter can refuse the people cleaning up a real intrusion. Secondary buyers still paid up after the government deal. That is the trust premium, billed in arrears.

Disclaimer: This article is news reporting and analysis for information only. It is not investment advice, a solicitation to buy or sell any security, or a recommendation on Anthropic, OpenAI, or any related private-share or IPO trade. Readers who are considering a position in pre-IPO shares, funds that hold them, or future listed stock should consult a licensed financial adviser or broker who can review their own facts. Figures, bill status, and private-market marks reflect the sources cited as of the dates in this piece and can change as filings, tenders, and secondary prints move.