Claude Fable 5 and Mythos 5 models were restored by Anthropic on July 1 after a three-week suspension imposed by the U.S. government over national security concerns related to cybersecurity capabilities. Anthropic implemented additional guardrails that route certain cybersecurity queries to the less capable Claude Opus 4.8, and the models are now available through the Claude API and other Anthropic platforms. The incident marks the first time a government intervention led to suspension of general access to an AI model, likely to influence how future models are reviewed and released by other AI companies.
Anthropic deployed Claude Fable 5 with new safety classifiers designed to detect and block dangerous cybersecurity uses, while releasing a framework to categorize jailbreak severity. The classifiers sort cybersecurity requests into four categories: prohibited use (ransomware, malware development, data exfiltration), high-risk dual use (penetration testing, exploit development), low-risk dual use (vulnerability identification that other models can already do), and benign use (secure coding, debugging). The framework aims to establish consistent terminology for discussing AI jailbreak risks across government, industry, and academia, with feedback welcomed at cyber-safeguards@anthropic.com and a HackerOne bug bounty program now active.
Anthropic restored access to Claude Fable 5 and Mythos 5 after the US government lifted export controls that had been imposed on June 12 following a jailbreak vulnerability discovered by Amazon researchers. The new safety classifier blocks the reported bypass technique in over 99% of cases, though it increases false positives during routine coding tasks. Fable 5 becomes available globally starting July 1, with Anthropic, Amazon, Microsoft, Google and others now developing a shared industry framework for assessing AI jailbreak severity to standardize future responses.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
