The model was called Fable. A fable is a short story that exists to deliver a moral at the end. Anthropic picked the name. It didn't read the genre.
On June 9, 2026, Anthropic launched Fable 5. On June 12, at 5:21pm Eastern, the US government switched it off.
Seventy-two hours in the wild.
Fable 5 PAILA — not by an exploit, not by a leak, not by a state actor with sophisticated tooling. PAILA by a letter.
What Lasted Three Days
Anthropic shipped two models on June 9. Mythos 5, the cybersecurity model the company describes as the most capable ever built for finding and exploiting vulnerabilities, restricted to eleven organizations through Project Glasswing. And Fable 5, the consumer version: the same Mythos base technology, with the cybersecurity and biology capabilities blocked, opened to paying users.
The name Fable was deliberate. Anthropic had spent a year telling the fable: a model so dangerous it couldn't be released to the public. We documented it in March, when the company leaked its own press draft by leaving a CMS on "public by default" and the world read the promise: "unprecedented cybersecurity risks," "a step change," too powerful for a general release.
The government read it too.
The Letter
The directive came from the Commerce Department, signed by Secretary Howard Lutnick, addressed to Dario Amodei. It requires suspending all access to Fable 5 and Mythos 5 by "any foreign national, whether inside or outside the United States, including foreign national Anthropic employees." A license is now mandatory to export, re-export, or domestically transfer the models.
The problem is technical before it is political. Anthropic can't filter users by nationality in real time, so to comply it did the only thing that complied: shut both models down for the entire planet. No exceptions. The foreign nationals who built Fable 5 were locked out of the model they built.
The trigger was a partner in the house. According to Axios and the Wall Street Journal, Amazon researchers — one of the eleven organizations with privileged Glasswing access — found a jailbreak and reported it to the government. The escalation wasn't quiet: conversations between Amazon CEO Andy Jassy and Treasury Secretary Scott Bessent carried the decision all the way to the White House.
What did the jailbreak that justified treating a model like enriched uranium actually consist of? In Anthropic's own words: "asking the model to read a specific codebase and fix any software flaws." Ask the model to read code and fix the bugs. That is: programming. The thing the model is sold to do.
The War We Already Fought
This already happened, and the United States already lost.
In the 1990s, strong cryptography was classified as a munition under the ITAR regime. Exporting robust encryption software was, legally, arms trafficking. Phil Zimmermann defeated the control by printing the entire PGP source code as a book — books are speech protected by the First Amendment, and speech is not exported. A T-shirt with three lines of RSA in Perl was, technically, a munition. The controls collapsed for one simple reason: math does not respect borders.
The 2026 twist is called "deemed export." Showing controlled technology to a foreign national inside the United States counts as exporting it. That's why Anthropic's foreign employees lost access to the model: showing them the weights is, per the rule, the same as shipping them abroad. It is the first time an export control has been applied directly to access to a language model.
Anthropic's argument in its statement is that the demonstrated capability "is widely available from other models (including OpenAI's GPT-5.5)," that the jailbreak is narrow and non-universal, and that "perfect jailbreak resistance is not currently possible for any model provider." All true. Also irrelevant to a letter that is already signed.
The Moral
Back in April, Sam Altman had written the end of this fable without knowing it. On the Mythos marketing, he said: "It is clearly incredible marketing to say, 'We have built a bomb. We were about to drop it on your head.'" And the kicker: they built a bomb, they were about to drop it on your head, and then they sell you the bomb shelter for a hundred million.
The government took them literally. You said it was a bomb. We believed you. Here are your export controls.
And the capability is no marketing myth — that's the uncomfortable part. We showed it a week ago: Claude Opus 4.8, the older and less capable model, broke Zcash's Orchard circuit in hours, a soundness bug four years of elite audits never saw. The offensive capability exists and works. The government didn't invent the fear. Anthropic sold it.
The truly PAILA part is what came next. To save the product, the "safe and responsible AI" company spent the night deflating its own myth: the model isn't that dangerous, others do it too, perfection doesn't exist. "We disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people." A year saying they had a bomb. One night swearing it was a firecracker.
Dario Amodei spent years asking for regulation, oversight, export controls, pauses, governments with a kill switch. He got all of it. On his best model.
Attribution
Perpetrator: Anthropic's marketing strategy. They spent a year positioning Mythos as a munition to build a regulatory moat in their favor. They wrote the legal predicate and called it a brand. The state only had to take them at their word.
Accomplices: Amazon, a Glasswing partner — given privileged access to defend critical infrastructure — who used that access to jailbreak the model and hand it to Bessent and the White House. And David Sacks, the administration's AI czar, who had spent months calling Anthropic's safety crusade "regulatory capture based on fear-mongering": they put the proof in his hand.
Systemic failure: a state that now treats a language model like fissile material, and a rule — deemed export — that turns "letting a foreign national read the weights" into arms trafficking. Code as munition. We tried it in the 1990s with cryptography and lost to a book and a T-shirt. We're trying it again, now against a model that anyone with enough GPUs can train all over again.
An official said the model must stay locked down until the national security apparatus is hardened — "could happen in the next few weeks." Meanwhile the weights still exist, the competitors stay open, and the migration to local and open models started the same night.
The model that was going to herald the era of autonomous cyberattacks wasn't killed by a hacker. It was killed by a five-line letter.
A fable leaves a moral for whoever reads it next. The question is who's reading: the regulator, the competitor, or the foreign national already downloading someone else's weights.