Version 28

What

Why it matters

Open questions

• Has the Fable 5 temporary access cap, set to expire July 7, been lifted on schedule, and are any restrictions on coding and debugging tasks still in effect [17][5]?

• Does the Pentagon's June 21 supply-chain designation remain in place — the June 30 Commerce lift addressed BIS export licensing, not the DoD procurement designation [8][19]?

• Does Legion LegalTech's federal lawsuit (1:26-cv-02225 D.D.C.) proceed on constitutional harm grounds now that access is restored, or does the lift moot the case [12][13]?

• Will the CJS jailbreak-severity framework gain adoption from Glasswing partners (Amazon, Microsoft, Google), and what threshold scores would distinguish a classification-worthy security event from routine model behavior [18][15]?

Narrative

Timeline

• 2026-04-22: Alibaba and Alibaba Qwen begin a model-cloning campaign against Claude, generating 28.8 million exchanges via approximately 25,000 fraudulent accounts through June 5. [22]
• 2026-06-12: Amazon researchers demonstrate a jailbreak on Fable 5 using engineered code with planted fake CVEs; Jassy personally briefs senior Trump administration officials. [2][3][5]
• 2026-06-12: Commerce Department issues export control directive for all foreign nationals; Lutnick tells Amodei 'That's the point' when informed both models would have to go offline. [20][1][21]
• 2026-06-13: Anthropic disables Fable 5 and Mythos 5 globally after determining nationality-based restriction was not achievable on short notice. [1]
• 2026-06-16: Moussouris assesses the triggering behavior as 'the model working as intended' for cyberdefense; Luta Security publishes a formal argument that the controls harm US cyber defense. [4][26]
• 2026-06-17: Lutnick sends a formal BIS letter to Amodei requiring an export license before international deployment. [6][21]
• 2026-06-20: Trump states he no longer views Anthropic as a national security threat, with no formal policy change announced. [7]
• 2026-06-21: Pentagon labels Anthropic a 'supply chain risk,' adding a DoD procurement designation; OpenAI secures a Pentagon contract within hours. [8][9][24]
• 2026-06-24: Legion LegalTech files federal lawsuit (1:26-cv-02225 D.D.C.) challenging the directive; Zvi reports NSA lost its own Mythos access as collateral consequence. [12][32][29][13]
• 2026-06-25: Anthropic publicly discloses the Alibaba model-cloning campaign and calls for punishment. [22]
• 2026-06-27: Lutnick authorizes Mythos 5 for more than 100 approved institutions via the Glasswing cybersecurity-research program. [10][11]
• 2026-06-30: Commerce Department formally lifts export controls on both models; Lutnick's letter credits Anthropic's 'close coordination with the US government.' [14][19][40]
• 2026-06-30: Anthropic publishes 'Redeploying Fable 5,' disclosing the jailbreak was replicable by Claude Opus 4.8, GPT-5.5, and Kimi K2.7; announces a >99% classifier fix; proposes a four-dimension jailbreak severity framework; commits to pre-release government model access. [15]
• 2026-07-01: Fable 5 returns globally with a temporary access cap through July 7; Glasswing confirmed as the ongoing channel for Mythos 5 cybersecurity access. [16][17]
• 2026-07-02: Anthropic publishes detailed cybersecurity classifier post: names the proposed framework CJS, specifies a 0–10 logarithmic scoring scale mapping to five severity levels, defines four cybersecurity use tiers, acknowledges an intentional safety margin blocking some benign uses, and launches a HackerOne bug-bounty program. [18]
• 2026-07-02: SemiAnalysis calls Fable 5's restoration the first frontier model taken offline and brought back by government policy, predicting the pattern will recur; The Neuron frames government AI interventions as a new operational risk category. [38][39]
• 2026-07-03: Zvi argues the triggering scenario was standard debugging code, the classifier fix now causes debugging tasks to fall back to lesser models, and the episode was handled ad hoc by officials who 'do not know how any of this works.' [5]

Perspectives

Tensions

• Anthropic and Moussouris both assess the triggering behavior as standard defensive work on engineered fake code; Zvi characterizes it more specifically as a routine 'fix this code' debugging request — yet the government never publicly addressed any counter-assessment, even when lifting the controls. [4][21][15][19][5]
• Anthropic's July 2 post frames its safety margin — which blocks some benign uses — as a deliberate design choice to reduce classifier leakage; Zvi argues the same effect (legitimate debugging tasks falling back to lesser models) is an operational cost the ad hoc government process never weighed. [18][5]
• Trump publicly stated he no longer views Anthropic as a national security threat, yet the administration subsequently ordered agencies and contractors to stop using Anthropic; the June 30 Commerce lift partially closes that gap without any reconciling explanation. [7][23][24][19]
• The Commerce lift and the Pentagon supply-chain designation were issued by separate agencies; the June 30 letter addressed BIS export licensing controls but whether it also rescinds the DoD procurement designation remains unconfirmed. [8][19][9]
• Zvi argued the directive was technically impossible to satisfy as stated; Anthropic's resolution came through a classifier fix combined with demonstrating capability parity with less capable models — a different path than the government's original framing required. [28][15][30][5]