The jailbreak that shut down a frontier AI for 19 days

For nineteen days this summer, the U.S. government forced Anthropic to take two frontier models offline — Claude Fable 5 and Mythos 5 — under an emergency federal export-control order. Not an outage, and not a software bug Anthropic chose to fix: a takedown they were ordered to perform, because the models themselves had become a supply-chain risk.

Here is the security story behind it, in four parts: the jailbreak that triggered it, why Commerce and CAISI stepped in, the two-layer fix, and where it stands now.

The jailbreak

Amazon researchers found a prompt-injection jailbreak in Fable 5 — a crafted prompt that bypasses the model’s alignment filters. Past the guardrails, Fable 5 could scan real software, identify zero-day vulnerabilities, and generate working exploit code. The same weakness reached Mythos 5, Anthropic’s restricted cyber-defense model.

The jailbreak: a crafted prompt slips past the safety gate, and the model goes from scan to zero-day to exploit code

One crafted prompt turned a frontier model into an automated exploit engine. That is what moved this from a lab finding to a federal matter.

Why Commerce and CAISI stepped in

The Department of Commerce issued an export-control directive: no access for foreign nationals, anywhere. But Anthropic cannot verify the nationality of hundreds of millions of API users across AWS, Google Cloud, and Microsoft in real time. Unable to block selectively, and facing federal penalties, they shut both models down globally.

Commerce holds the legal authority; CAISI, inside NIST, judges the technical risk — and selective blocking was impossible at API scale

The technical assessment came from CAISI — the Center for AI Standards and Innovation, the AI-evaluation unit inside NIST. Commerce held the legal authority; CAISI judged the risk, and later, the fix. (For the full picture of how CAISI sits inside Commerce and NIST, see our earlier article on who tests U.S. AI models.)

The two-layer fix

The rebuild took under three weeks and has two layers:

A dedicated safety classifier, trained on the Amazon technique. It blocks that method in over ninety-nine percent of tests.
An Opus 4.8 fallback. Prompts touching cybersecurity, biology, chemistry, or model distillation get rerouted from Fable 5 to the older, hardened Claude Opus 4.8 instead of being refused outright.

The two-layer fix: a safety classifier on top, an Opus 4.8 reroute underneath — and the silent downgrade made explicit

Originally that downgrade was silent — users got weaker output with no notice, and the community pushed back hard. The relaunch makes it explicit: you are told when you are rerouted. Anthropic also signed a CAISI oversight agreement covering future models.

Where it stands now

Commerce lifted the order June 30th; Fable 5 returned July 1st. Pricing is ten dollars per million input tokens and fifty per million output, with up to half of weekly usage free through July 7th.

The timeline: order lifted June 30, relaunch July 1, metered pricing — and Mythos 5 stays behind Project Glasswing

The catch: that safety filter was built in a hurry, and it is too strict. It flags normal work as dangerous — everyday debugging gets marked risky, which quietly reroutes you to Opus 4.8. It is the classic trade-off: turn the filter up to catch real attacks, and it starts catching harmless work too. And Mythos 5 never came back for the public — it stays locked to Project Glasswing, Anthropic’s restricted-access program for a small set of vetted organizations.

The takeaway

Security is a moving target. A single prompt is now a supply-chain risk — one jailbreak turned a frontier model into an exploit engine, and the three-week fix is already over-blocking, so the tuning never stops. It is the same balancing act security teams face every day: block the real threat without blocking the real work.

Sources (fact-checked 2026-07-04): Anthropic — statement on the directive · Forbes · CNBC · CNN · Al Jazeera