The Commerce Department pulled the models on June 12 after Amazon researchers flagged a way to trick them into producing working software exploits; the standard that lifted the controls — an automated safety filter built by Anthropic and reviewed
For 18 days, the United States quietly tested whether it could pull a commercial frontier AI model offline from the global market. On June 12, the Commerce Department ordered Anthropic to restrict access to two of its newest models, Fable 5 and Mythos 5, for any foreign national, including the company's own employees. Anthropic responded the only way it could under the rule: it pulled both models for everyone. On Tuesday, export restrictions ended, and Fable 5 returns worldwide on Wednesday through Claude.ai, Claude Code, Claude Cowork, and the Claude developer platform. Anthropic confirmed the reinstatement. Mythos 5 stays limited to US-approved organisations under the Glasswing programme, which restricts access to vetted US users while broader availability remains under discussion.
The trigger was a report from Amazon researchers that the models could be coerced into surfacing software vulnerabilities and producing working exploit code. The Commerce Department's Center for AI Standards and Innovation, the federal office set up to evaluate frontier-model hazards, treated the finding as a national-security-grade concern and invoked export controls normally reserved for advanced chips, encryption, and dual-use industrial equipment. The rule required that any user be verified as a US person before touching the model. Anthropic has not built that gate, and pulled the models globally rather than try to retrofit one.
That is the regulatory precedent worth naming. Until now, US export controls on AI have mostly meant chip-level restrictions on the foreign supply of training silicon. The Fable 5 episode is the first credible test of export controls aimed at the model itself as a controlled artefact, and it worked end to end: a researcher report, a regulator finding, a vendor compliance action, an 18-day global blackout, and a controlled exit. Commerce Secretary Howard Lutnick confirmed the export restrictions ended on Tuesday. The Center for AI Standards and Innovation signed off only after reviewing Anthropic's fix alongside the model's existing guardrails.
The fix is a jailbreak-specific safety classifier. Anthropic says the new classifier blocks the Amazon-documented bypass in more than 99% of attempts, a figure widely cited in industry coverage but ultimately the company's own measurement rather than an independent benchmark. The technical lineage runs through Anthropic's earlier Constitutional Classifiers work on defending against universal jailbreaks; the Fable 5 classifier is a narrower, vulnerability-focused descendant. It is now the gating condition for the model shipping to anyone, anywhere. Pro, Max, Team, and enterprise subscribers regain access at the same time.
Three limitations of that fix are worth holding onto.
First, the trigger was a report, not a confirmed exploit in the wild. The Commerce Department acted on the Amazon researchers' findings, not on evidence that adversaries had already used the bypass. The same mechanism could, in principle, be invoked against a model whose only offence is that a careful red team found a hole.
Second, the reinstatement rests on vendor self-attestation reviewed by a still-new federal office. The Center for AI Standards and Innovation has limited published track record and limited bench depth relative to the scope of what it is being asked to evaluate. A 99% block rate measured by the company that built the classifier is the standard the regulator accepted.
Third, the fix is not symmetric. Mythos 5 remains limited to US-approved organisations under Glasswing, and broader access is still under discussion. Anthropic itself has argued that other widely available models can produce similar vulnerability outputs, which complicates any reading of Mythos 5 as uniquely dangerous.
The next test will not look like this one. Anthropic, Amazon, Microsoft, and Google are working on a shared jailbreak-severity rubric and a HackerOne-style bounty programme, which would shift the trigger for regulator action from a single researcher's report to a tiered industry signal. Until that machinery exists, the precedent is simple: a single Amazon researcher's jailbreak report was enough to make a frontier model disappear from the global market for 18 days, and a vendor-built classifier reviewed by a federal office was enough to bring it back.