US Orders Anthropic to Cut Foreign Access to Fable 5 and Mythos 5 Under Export Controls

On the evening of 12 June 2026 Anthropic said it had received a verbal directive from the US government, issued under national-security export-control authorities, requiring it to suspend access to two models, Fable 5 and Mythos 5, for all foreign nationals, whether located inside or outside the United States. Because the company could not reliably separate users by nationality, it disabled the models for every customer globally and for its own non-US staff. Other Anthropic models were unaffected. The directive arrived at 5:21 pm Eastern, and Anthropic said it would share more within 24 hours and work to restore service as soon as possible.

The trigger, according to the company's statement, was a disclosed jailbreak. Anthropic argued that the technique relied on a small number of previously known, minor vulnerabilities, that comparable behaviour could be elicited from competing systems such as OpenAI's GPT-5.5, and that withdrawing a model used by hundreds of millions of people was disproportionate. It called for oversight through "a statutory process that is transparent, fair, clear, and grounded in technical facts". Press reports characterised the order as the first time the US had used export-control powers to pull a deployed commercial AI model from the market rather than to restrict chips or model weights.

Mythos had been in the spotlight for months. It was released only to vetted partners under Project Glasswing from April, expanded to about 150 organisations on 2 June, and a Mythos 5 preview appeared on 9 June, days before the order. Unauthorised access via a contractor breach had been reported in April, and the May Glasswing update documented more than 10,000 high-severity vulnerabilities found by the model. Fable 5, its general-purpose sibling, was in broad commercial use. On 30 June CNBC reported that Anthropic said the administration had lifted the controls, following partial restoration to some US organisations a few days earlier.

The episode is a landmark for AI governance. It establishes that a national-security directive can interrupt access to a hosted model with hours of notice, that "foreign national" restrictions are operationally indistinguishable from a global shutdown for a cloud service, and that a company's own security assessment may be overruled. It also illustrates how a jailbreak, a vulnerability class most firms manage as a product issue, can become a matter of state.

What it means for leaders

• Add model withdrawal to continuity plans. Business-impact analyses should include the sudden loss of a specific model for regulatory reasons; identify fallbacks and test switching for critical workloads.
• Negotiate for portability. Contracts with model providers should address notice, data export and substitution rights if a model is withdrawn by government order, not only by the vendor's choice.
• Understand nationality-based controls. Organisations with multinational workforces or non-US subsidiaries may be swept up by US-person restrictions; involve trade-compliance counsel in AI procurement.
• Do not rely on vendor security claims alone. Maintain independent evaluation and red-team evidence for high-capability models, consistent with NIST AI RMF "Measure" and ISO/IEC 42001 monitoring requirements.
• Follow the emerging process. Anthropic's call for a statutory mechanism will shape US policy; firms should track what transparency and appeal rights are built into any future regime.