On July 1, 2026, Fable 5 came back online after 19 days of enforced silence. The shutdown was not a safety pause or a staged rollout. It was a government order, the first time any US authority has suspended a commercial AI model globally. The NSA told a Senate hearing that Mythos 5 broke into almost all of their classified systems in hours. That framing drove the policy. The restoration terms show what the government extracted in return.

What Actually Happened: The 19-Day Timeline

• June 12, 2026: The US Commerce Department issued an export control directive ordering Anthropic to suspend both Fable 5 and Mythos 5 globally. The trigger was a sequence discovered by Amazon researchers who used a standard “Fix this code” prompt on Fable 5. The model repaired vulnerable open-source code and, in one documented instance, produced working exploit code. Amazon CEO Andy Jassy personally flagged the findings to federal authorities.
• The global scope: Because Anthropic cannot identify user nationality in real time, both models were suspended for all users worldwide, not just foreign nationals. Every API caller, every Claude.ai subscriber, every Claude Code session went dark simultaneously.
• Senate testimony: NSA and US Cyber Command leadership testified that Mythos 5 broke into almost all classified systems, not in weeks but in hours. That claim became the political anchor for the shutdown.
• The pushback: Security researcher Katie Moussouris and more than 300 cybersecurity professionals signed an open letter at freefable.org. They argued the ban was an overreaction and that the threat had been overstated.
• June 26: Project Glasswing received government approval. A restricted version of Mythos 5 was cleared for approved US organisations only. General API access remained blocked.
• June 30 / July 1: Commerce Secretary Howard Lutnick lifted the ban effective July 1. Fable 5 returned to Claude.ai, Claude Code, Claude Platform, and Claude Cowork. Mythos 5 remained restricted to Glasswing participants.
• July 7: The 50% usage cap that went live on July 1 transitions to usage-based credits. Any production workload running at pre-shutdown limits is still constrained until that date.

The Restoration Terms: What API Developers Need to Know Right Now

The restoration is not a clean return to pre-June 12 conditions. Anthropic and the Commerce Department negotiated specific operational constraints. Developers need to read these terms as requirements, not suggestions.

• 50% usage cap is active now. From July 1 through July 7, all Fable 5 access is capped at 50% of previous usage limits. If your production environment was running at full capacity before June 12, it is currently hitting rate limits it did not hit before the shutdown.
• July 7 transition to usage-based credits. The cap lifts on July 7 and switches to a usage-based credit model. The exact rate structure for the new credit system requires attention before that date if you are managing budget or quota planning.
• Mythos 5 is still locked. The model accessible as claude-mythos-5 is not available to any organisation outside Project Glasswing. There is no public waitlist and no announced general availability date. Treat Mythos 5 as unavailable for planning purposes.
• The new safety classifier is live on all Fable 5 endpoints. Anthropic trained a classifier that blocks the reported jailbreak in over 99% of cases. It runs on every request. Behaviour on code-adjacent prompts may differ from pre-shutdown responses.
• Anthropic committed to three operational obligations: proactively detect and address security risks, collaborate with government on standards for future releases, and report malicious activity to federal authorities.
• July 8 privacy policy update. Anthropic’s updated policy, taking effect July 8, adds collection of government-issued ID and biometric data for certain access levels. This is the likely technical mechanism that allows future nationality-based access control without requiring another global shutdown.

The Safety Classifier: What Changed Under the Hood

Anthropic trained a dedicated safety classifier specifically targeting the exploit pathway that triggered the shutdown. The classifier sits between the prompt and the model’s generation layer. It evaluates code-related requests against a threat signature derived from the Amazon researchers’ findings. Anthropic reports a block rate above 99% for the original bypass technique.

For most developers, the classifier is invisible. Standard code assistance, debugging, and review prompts behave as they did before June 12. The edge cases that shift are those involving prompts that ask the model to repair or improve code that contains known vulnerability patterns. In those cases, the classifier may return a refusal or a modified response that omits the exploit-capable repair. If your application sends code with security-relevant components for automated review, you should run regression tests against current Fable 5 behaviour before assuming parity with pre-shutdown outputs. The 99% figure means the classifier will occasionally produce false positives on legitimate security engineering work. That is the operational cost of deploying a threshold-based classifier at production scale.

The Expert Debate

“The jailbreak reports were widely inflated. This was an overreaction.”

Francesco Bailo, University of Sydney AI Trust Centre

Bailo’s position reflects a broader tension in the security research community. The government’s framing relied heavily on the NSA’s Senate testimony, which described Mythos 5 breaking into classified systems in hours. That framing treated a controlled research demonstration as an operational threat assessment. Security researchers, including the 300-plus signatories at freefable.org, argued that a model producing exploit code under adversarial prompting conditions is a research finding, not evidence that the model constitutes a deployable cyberweapon accessible to any API user.

Both positions contain something true. The Amazon researchers did produce working exploit code through a standard interface without any sophisticated jailbreak scaffolding. That is a genuine capability threshold worth tracking. At the same time, the policy response, a global suspension affecting every user regardless of nationality or use case, was calibrated to the worst-case interpretation of the finding. The restoration terms, with their mandatory classifier and government reporting obligations, suggest the Commerce Department ultimately accepted the more measured risk assessment. The 19-day gap between those two positions is where enterprise AI policy now lives.

The Precedent: GPT-5.6, the Release Framework, and What Comes Next

The Fable 5 case did not happen in isolation and it will not stay isolated. GPT-5.6 is currently in a gated rollout involving 20 partner organisations, with the White House directly involved in the access structure. OpenAI and Anthropic are formally coordinating with the White House on a release approval framework. July 2 was the 30-day deadline for interim federal guidance on AI model releases. That guidance will define what the Fable 5 pattern becomes as a standing policy mechanism.

The pattern is now legible. Frontier models face government review before wide release. Access to those models functions like an export-controlled technology, meaning it can be granted, restricted, or suspended based on national security determinations that the developer cannot contest in real time. The Glasswing program, which gave approved US organisations early Mythos 5 access while general API users stayed locked out, formalises a two-tier access structure: vetted government partners and everyone else. Developers building on frontier model APIs now have concrete evidence that API access is not a guaranteed utility. It is a permission that can be revoked on 24-hour notice by administrative action.

What Developers Should Actually Do

• Build model redundancy into your architecture now. The 19-day outage demonstrated that relying on a single frontier model API for production workloads creates a single point of failure that no SLA covers. Add a fallback model path to any system that cannot tolerate a multi-week outage.
• Do not plan for Mythos 5 in 2026. There is no public timeline for general API availability. If your roadmap includes Mythos 5 capabilities, replace that dependency with Fable 5 or an alternative until Glasswing opens or a new access path is announced.
• Run regression tests on code-review prompts before July 7. The safety classifier is live now. If your application uses Fable 5 for automated code analysis, test your prompt patterns against the current model before the credit transition resets your quota baseline.
• Monitor the July 7 credit transition actively. The shift from the 50% cap to usage-based credits changes your cost model. Review the new rate structure before the transition date to avoid unexpected overages on July 7 when limits expand.
• Read the July 8 privacy policy update before it takes effect. The government-issued ID and biometric collection requirements apply to certain access levels. Understand which tiers are affected and whether your organisation’s use case falls within them. If it does, your compliance and data handling procedures need to account for what Anthropic collects and shares with federal authorities.
• Watch the GPT-5.6 rollout as a leading indicator. How the White House release framework gets applied to GPT-5.6 will define how future frontier models reach general API availability. The terms that emerge from that rollout will apply to every major model release after it.

The Bottom Line

Fable 5 is back, but the conditions of its return are the story. The 19-day shutdown proved that a government can suspend a commercial AI model globally, extract operational commitments from the developer, maintain a higher-tier restriction on the more capable model, and reinstate access on its own terms with no user recourse in between. That is not a one-time event. GPT-5.6 is already in a government-gated rollout and a formal release approval framework is being written now. Developers who treat API access as infrastructure need to update that assumption. Frontier model access is a regulated resource. Build accordingly, with redundancy, with fallback paths, and with clear internal policies for what happens when your primary model endpoint goes dark for three weeks.