Anthropic’s Fable 5 was the most powerful AI ever opened to the public. Six days later a government letter switched it off for the entire planet. The reason we are given is a jailbreak.
By Kristian Kabashi
On Tuesday the ninth of June, Anthropic released Claude Fable 5, the public face of Mythos, a model so good at finding and exploiting software vulnerabilities that the company had kept it locked away since April for being too dangerous to hand out. Fable was the tamed version, wrapped in the strongest safeguards any lab has shipped. They called it safe for general use.
On Friday the twelfth, at 5:21 in the evening Eastern time, a letter arrived from the US Commerce Department. By the end of the night Fable 5 and Mythos 5 were gone. Not slowed down, not rate-limited. Switched off, for every customer on Earth, including Americans, including Anthropic’s own employees who happen not to hold a US passport. The most powerful model the public had ever been given lasted about six days before a single piece of paper took it away from everyone at once.
Most of the coverage I have read since is arguing about one question, which is whether the government was right to do it. I think that is the small question. The big one is sitting underneath, and almost nobody is saying it out loud. So let me.
The off switch is real, and it is not yours
We have spent two years telling each other a story about AI. That it is unstoppable. That it is decentralised, in everyone’s pocket, impossible to contain, a force that governments can only chase and never catch. This week that story took a hard hit, and I do not think enough people noticed.
One letter reached into the cloud and revoked a deployed intelligence for the whole world in an afternoon. Think about how strange that is. The model was already out. Hundreds of millions of people had access. And it still went dark on command, because the access was never really ours. It sat on someone else’s servers, under someone else’s license, inside someone else’s jurisdiction. The thing we were told no one could control turned out to have a switch, and the switch turned out to be a Friday email.
A few details make it sharper. This appears to be the first time a leading lab has pulled a publicly deployed model because the federal government told it to. The order did not target a country or a company, it targeted every foreign national anywhere, which is why Anthropic said it had no real choice but to cut everyone off. The model was treated, in effect, like a weapon under export control, the same legal machinery used for missiles and centrifuges. And the government, by Anthropic’s account, acted on verbal evidence, with a letter that did not even spell out the specific concern. Whatever you think of the decision, that is a new kind of power being used for the first time, in real time, on a weekend.
The reason we are given
Here is the official version, as far as anyone can piece it together. An administration official told Axios that Commerce moved after another company claimed it had found a way to jailbreak Mythos and unlock its cybersecurity abilities. The government had reportedly tried to get Anthropic to delay the launch, did not succeed, and reached for export controls instead. The model stays locked, the official said, until the country’s defences are hardened, maybe a few weeks.
Anthropic disagrees, and not quietly. In its statement the company said the jailbreak it was shown was narrow, the kind that coaxes out a specific answer in a specific case rather than a master key that defeats all the safeguards. It said the demonstration mostly surfaced minor, already-known vulnerabilities, that the same tricks work on other public models including OpenAI’s GPT-5.5, and that the capability in question is the sort of thing security defenders use every day. Pulling a model used by hundreds of millions over a narrow flaw, they argued, would set a standard that halts every new model release across the whole industry. They called the whole thing a misunderstanding and said they were working to restore access.
It would be naive to read this without the politics. The Pentagon already blacklisted Anthropic in March as a supply chain risk after the company refused contract terms it did not like, and there has been open friction between Anthropic and parts of the current administration for months. Plenty of smart people looked at Friday’s order and saw less a safety measure than a punishment, with one former official close to the administration calling it cartoonish. And yet the other reading is also coherent. If you genuinely believe the United States has to stay ahead of China on frontier AI, then a model that can find and exploit security holes is exactly the sort of thing you might not want flowing to foreign nationals, and acting fast is the whole point. Both of these can be true at once, which is part of why this is such a mess.
The reason that matters
Now the part I keep coming back to, and I want to be upfront that this next bit is my read, not established fact.
The most novel thing about Fable 5 was not its cyber safeguard. It was a quieter feature. Built into the model was a set of classifiers watching for attempts to use it for distillation, the technique where you pump millions of questions into a strong model and use its answers to train a cheaper copy of it. When Fable thought it saw distillation, or frontier model development, it silently downgraded the user to a weaker model. Researchers noticed, complained loudly about being shadowbanned, and Anthropic walked back the silent part within two days while keeping the restriction itself. Ask yourself why a company would build an anti-distillation wall into its flagship in the first place.
Because it had already been robbed, or believed it had. Back in February, Anthropic accused three Chinese labs, DeepSeek, Moonshot and MiniMax, of running more than sixteen million exchanges through roughly twenty-four thousand fake accounts to distill Claude’s coding and reasoning into their own models. By April the White House was describing campaigns like this as industrial-scale theft. So the wall was not theoretical. It was a response to a specific adversary that had, allegedly, already climbed over the old one.
Which brings me to the hunch I cannot shake, and that I suspect a lot of people share. The story we are handed is a jailbreak that unlocks cyber tools. But the thing Fable was really built to stop was distillation by China, and the people most motivated and most capable of cracking Anthropic’s protections are exactly the labs that have already been accused of doing it at scale. I cannot prove the bypass that triggered Friday’s shutdown was a Chinese distillation attack. The reporting points at a cyber jailbreak, and that distinction matters, so I will not pretend otherwise. But whether or not China cracked it this week, China is the gravity bending this entire situation. It is the reason the walls exist, the reason the government is jumpy, the reason a six-day-old product gets treated like a strategic asset. And the dependency runs both ways, which almost nobody wants to admit. Chinese developers still buy grey-market Claude through resellers at a fraction of list price, while American firms quietly reach for China’s cheaper DeepSeek when the bill comes due. The border everyone is trying to draw is already full of holes.
We keep saying intelligence is being democratised
This is the contradiction I want people to sit with, because it is uncomfortable for those of us who are usually the optimists in the room.
We say AI puts a genius in every pocket, that knowledge is being handed to everyone, that the playing field is levelling. And a lot of that is real. But this week two things landed at the same moment. A model got powerful enough to genuinely matter, and that same model was proven to be confiscatable on a few hours’ notice. Democratised intelligence and nationalised intelligence are arriving together, and I am no longer sure which one wins. The more useful these systems become, the more they look like infrastructure a state will want its hand on, and the less they look like a tool that belongs to you.
There is a bitter little twist in here for the safety-minded crowd too, and I say this with sympathy because I take their concerns seriously. Many of them have argued for years that we need a brake on AI, some way for authority to stop a dangerous deployment. Well, this week they saw what that brake actually looks like in practice. Not a careful, transparent, evidence-based process agreed in advance, but a hand on a remote kill switch, pulled over a weekend, on verbal evidence, against the company that has arguably been the most vocal about safety in the first place. Anthropic itself pointed out the gap, saying it supports the government’s right to block unsafe releases but only through a process that is fair, clear and grounded in technical facts, which this was not. Be careful what you wish for. You might get it on a Friday night with no explanation attached.
And we are still in the opening minutes
Step all the way back and the scale of it is what gets me. The model under all of this, Mythos, is being handled like a munition because it can find and break software better than almost anything before it. That is a near-frontier model in the middle of 2026, and it is already being export-controlled like enriched uranium. Sit with that. Not a hypothetical future system. One that shipped this month.
We are not late in this story. We are early. If this is what the opening minutes look like, a model good enough to be classified as a weapon, governance written by letter on a Friday evening, a kill switch tested in public for the first time, then the years ahead are going to be far stranger than the debate we are currently having suggests. The capability is compounding by the month. The rules are being improvised in real time, and improvised rules made under pressure tend to be clumsy, political and slow to fix. As one cybersecurity researcher put it about Anthropic’s own framing, if you call your product a munition in every press release, “eventually a government takes you at your word.” That gap, between how fast the models move and how crudely we are governing them, is the actual risk. More than any single jailbreak.
So here is what I would take from this week, whatever shakes out about Fable in the next few days. Do not build your company or your habits on permanent access to any one model, because access is now a political variable and it can blink off without warning. Watch who holds the switch, because it is not you, and it probably never will be. And notice that the loud argument, the one about whether the government was right, is doing a quiet job of distracting us from the thing that actually changed. The off switch is real now. It works at planetary scale. And the conversation we should be having is not whether it was fair to use it this time, but who gets to touch it next.
That is worth talking about. Loudly, and before the next Friday.
Kristian Kabashi writes Blank Collar, a field guide for the people trying to think clearly while the ground moves. More at kristiankabashi.com.
Sources: Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5 · Axios, Trump admin blocks foreign access to Anthropic’s most powerful AI · Fortune, Anthropic disables Fable and Mythos after US export controls · CNBC, Anthropic disables access to Fable 5 and Mythos 5 · South China Morning Post, Claude Fable 5 curbs create new hurdles for China’s AI labs · The Next Web, Claude Fable 5 curbs target China, the backlash came from its own side
