Version 26

What

Why it matters

Open questions

• Has Fable 5's temporary access cap (through July 7) been lifted on schedule, and what restrictions remain on coding and debugging tasks given the classifier's fallback behavior [15][2]?

• Does the Pentagon's June 21 supply-chain designation remain in place — it was issued separately from the Commerce controls, and the June 30 lift letter addressed the BIS licensing requirements, not the DoD procurement designation [9][21]?

• Does Legion LegalTech's federal lawsuit proceed on constitutional harm grounds now that access is restored, or does the lift moot the case [17][18]?

• Will the proposed four-dimension jailbreak severity framework gain adoption from Glasswing partners (Amazon, Microsoft, Google), and does Aaron Levie's comment about GPT-5.6 being 'presumably next' suggest other frontier models will face similar government scrutiny [14][22][16]?

Narrative

Timeline

• 2026-04-22: Alibaba and Alibaba Qwen begin a model-cloning campaign against Claude, generating 28.8 million exchanges via approximately 25,000 fraudulent accounts through June 5. [24]
• 2026-06-12: Amazon researchers demonstrate a jailbreak on Fable 5 — later characterized by Zvi as a standard 'fix this code' debugging request on engineered code with planted fake CVEs; Jassy personally briefs senior Trump administration officials. [3][4][2]
• 2026-06-12: Commerce Department issues export control directive for all foreign nationals; Lutnick tells Amodei 'That's the point' when informed both models would have to go offline. [23][1][5]
• 2026-06-13: Anthropic disables Fable 5 and Mythos 5 globally after determining nationality-based restriction was not achievable on short notice. [1]
• 2026-06-16: Moussouris assesses the triggering behavior as 'the model working as intended' for cyberdefense; Luta Security publishes a formal argument that the controls harm US cyber defense. [6][27]
• 2026-06-17: Lutnick sends a formal BIS letter to Amodei requiring an export license before international deployment. [7][5]
• 2026-06-20: Trump states he no longer views Anthropic as a national security threat, with no formal policy change announced. [8]
• 2026-06-21: Pentagon labels Anthropic a 'supply chain risk,' adding a DoD procurement designation; OpenAI secures a Pentagon contract within hours. [9][10][26]
• 2026-06-24: Legion LegalTech files the first federal lawsuit challenging the directive; Zvi reports NSA lost its own Mythos access as collateral consequence. [17][32][30]
• 2026-06-25: Anthropic publicly discloses the Alibaba model-cloning campaign and calls for punishment. [24]
• 2026-06-26: Trump orders military contractors and federal agencies to cease business with Anthropic. [25]
• 2026-06-27: Lutnick authorizes Mythos 5 for more than 100 approved institutions via the Glasswing cybersecurity-research program. [11][12]
• 2026-06-30: Commerce Department formally lifts export controls on both models; Lutnick sends a letter confirming the lift, crediting Anthropic's 'close coordination with the US government.' [13][21][39]
• 2026-06-30: Anthropic publishes 'Redeploying Fable 5,' disclosing the jailbreak was replicable by Claude Opus 4.8, GPT-5.5, and Kimi K2.7; announces a >99% classifier fix; proposes a four-dimension jailbreak severity framework; and commits to pre-release government model access. [14]
• 2026-07-01: Fable 5 returns globally with a temporary access cap through July 7; Glasswing confirmed as the ongoing channel for Mythos 5 cybersecurity access. [20][15]
• 2026-07-02: SemiAnalysis calls Fable 5's restoration the first frontier model taken offline and brought back by government policy, predicting the pattern will recur; The Neuron frames government AI interventions as a new operational risk category requiring contingency planning. [37][38]
• 2026-07-03: Zvi argues the triggering scenario was standard debugging code, the classifier fix now causes debugging tasks to fall back to lesser models, and the episode was handled ad hoc by officials who 'do not know how any of this works.' [2]

Perspectives

Tensions

• Anthropic and Moussouris both assess the triggering behavior as standard defensive work on engineered fake code; Zvi adds it was specifically a 'fix this code' debugging request — yet the government never publicly addressed any counter-assessment, even when lifting the controls. [6][5][14][21][2]
• Anthropic's classifier fix satisfies the government's requirement and blocks the bypass in >99% of cases, but Zvi argues it now causes legitimate debugging tasks to fall back to lesser models — a concrete operational cost the ad hoc process never weighed. [14][2]
• Trump publicly stated he no longer views Anthropic as a national security threat, yet the administration subsequently ordered agencies and contractors to stop using Anthropic; the June 30 lift partially closes that gap without any reconciling explanation. [8][25][26][21]
• Zvi argued the directive was technically impossible to satisfy as stated; Anthropic's resolution came through a classifier fix combined with demonstrating capability parity with less capable models — a different path than the government's original framing required. [29][14][19][2]
• The Commerce lift and the Pentagon supply-chain designation were issued by separate agencies; the June 30 letter addressed the BIS export licensing controls but whether it also rescinds the DoD procurement designation remains unconfirmed. [9][21][10]