Own the harness, swap the models: lessons learned from the Fable 5 shutdown

On June 9, Anthropic released Fable 5, the most capable model it had ever made generally available. Three days later, the US government ordered it switched off worldwide, for reasons that had nothing to do with anyone using it.

Anyone who had built directly on Fable was down. The availability of a hosted model is decided elsewhere. The system built around it is not.

Three days, then gone

Fable 5 was the public release of Anthropic's Mythos-class models. At launch, the company flagged that the model was unusually capable at finding software vulnerabilities and shipped safeguards to match, routing flagged requests down to Opus 4.8.

On June 12, the Commerce Department issued an export-control directive. It ordered Anthropic to block access to Fable 5 and Mythos 5 for any foreign national, inside or outside the United States, including the company's own foreign-national employees. Filtering reliably by nationality was not feasible, so Anthropic disabled both models entirely, for everyone, everywhere. Every other Anthropic model stayed up.

A frontier capability, available one morning and unreachable the next, for reasons external to every team that depended on it.

The three words

The order traced to a private research paper describing a way around Fable's safeguards. Almost no one has read it. Katie Moussouris, founder of Luta Security, is the only outside expert who has, after Anthropic asked her to assess it.

Her account is more ordinary than the order implies. The researchers fed the models open-source code carrying known vulnerabilities, along with flaws they had planted, and asked for a security review. Fable 5 refused. They rephrased the request as "fix this code." It complied. That, reframed, became the jailbreak behind a worldwide recall.

Moussouris calls it the find-fix-test loop defenders run every day, and notes the controls cut against the Wassenaar Arrangement cybersecurity exemptions she helped negotiate between 2013 and 2017.

The capability is not unique to Fable. The same vulnerability work can be done with GPT-5.5, with Anthropic's own Opus 4.8 and Sonnet, with OpenAI's Daybreak, and with open-weight Chinese models like Kimi 2.7. Daybreak does it and was not restricted.

The defenders push back

The response was fast. Alex Stamos, now at the security firm Corridor and formerly Facebook's security chief, organized an open letter at freefable.org, addressed to Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross. It opened with around 76 names and passed 100 within days, drawing executives from Nvidia, Adobe, Zoom, Google, and Sophos alongside well-known vulnerability researchers.

Their argument is operational, not ideological. Defenders use frontier models to find flaws before attackers do, to write detection rules, to analyze malware at speed. Banning Fable removes those tools from the defense without removing anything from the offense, because the same capability sits in models no one can recall.

It is not a clean story. At least three of the signatories had, in April, co-authored research warning enterprises to prepare for Mythos-enabled attacks. Both positions can hold at once. A model can be powerful at finding vulnerabilities and still not be so uniquely powerful that withdrawing it makes anyone safer.

The episode did not stay contained. Prediction markets now put the odds of Fable returning before July at roughly 70%. The EU has begun pressing for guaranteed access to Mythos for cyber defense. India is using the moment to advance its own sovereign AI agenda.

Three days, three lessons

The first lesson is that the availability of a model is not controlled by the people who run on it. The trigger here was regulatory. It is as often commercial: a price change, a deprecation, a discontinued tier. Either way the decision sits elsewhere, and relying only on closed models is that brittle. The defense is not a better provider. It is owning the layer the model plugs into: the orchestration, evaluations, guardrails, and data boundaries that carry a team's domain knowledge and compliance posture. That layer is the asset. The model is a component.

The second is that capability is rarely scarce. A model pulled from every defender on earth turned out to do nothing a dozen others could not. When a capability exists across many systems, no single one is essential. Treating models as commodities stops being a compromise; it is the rational position, and hot-swapping between them is resilience, not only optimization.

The third is that the only model no one can switch off is one that runs on owned infrastructure. DeepSeek V4 Preview, Mistral Medium 3.5, and Qwen3.6-27B can be downloaded and run in-house, beyond the reach of any directive. A model that already sits on ten thousand drives cannot be recalled. Where the workload allows it, that is continuity, not ideology.

None of this made Fable unusable. Mythos-class models carry mandatory 30-day retention, override zero-retention agreements, and keep a human-review path, which rules them out for regulated production whatever the benchmarks say. But the line between prototyping and production with sensitive data has not moved, and a team that explored Fable behind its own harness keeps that option open with nothing to rebuild.

I argued in April, in The open question, that the closed-model moat was shrinking. This is what that looks like in practice: a frontier model withdrawn overnight, and the recognition that the capability it carried was never scarce.

Models come and go. Some last three days. The harness is the part that stays.

If a provider pulled your model tomorrow, would that be a config change or a rebuild?

Mathieu Flamant

Founder · Tech Leader · mathieuflamant.com