US Lifts Export Controls on Anthropic’s Fable 5 Cybersecurity AI Model After Three-Week Shutdown
In a significant development for the cybersecurity landscape, Anthropic has restored global access to its Fable 5 model, concluding a three-week suspension initiated by U.S. government export controls. These restrictions barred foreign nationals from utilizing the advanced AI tool, which is designed for cybersecurity applications. The decision to lift the controls follows negotiations between Anthropic and government officials, marking a pivotal moment in the regulation of AI technologies.
Context of the Shutdown
The export controls were implemented amid rising concerns about the implications of frontier AI models on cybersecurity. The Five Eyes intelligence alliance—comprising the U.S., U.K., Canada, Australia, and New Zealand—has issued warnings to business leaders regarding the transformative potential of these models. They emphasized that the timeline for significant changes in cybersecurity capabilities is measured in months, not years.
When the restrictions were enforced, Anthropic stated that it had to disable access for all customers to comply with the new regulations. In a recent update, the company confirmed that the controls had been lifted after reaching agreements with the government.
Implications for AI Regulation
This incident represents the first known instance where export control authorities were used to restrict access to AI software, rather than traditional hardware or chips. The reversal of these controls could set a precedent for how frontier AI models are regulated in the U.S. moving forward.
Additionally, export controls on Anthropic’s more advanced cybersecurity model, Mythos 5, were also lifted as of June 30. However, access to this model remains limited to vetted U.S. organizations through Project Glasswing, Anthropic’s controlled-access program for critical infrastructure defenders. The company is actively negotiating for broader domestic and international access through this initiative.
Technical Concerns and Responses
The initial shutdown was reportedly triggered by a “jailbreak” technique highlighted in an Amazon research report. This technique was further elaborated upon by Katie Moussouris, founder of Luta Security, who was engaged by Anthropic to assess the findings. Moussouris explained that researchers had fed Fable 5 open-source code containing known vulnerabilities and deliberately introduced flaws, subsequently asking the model to rectify the code. The output was then compiled into scripts that tested patches.
Moussouris clarified that this process was not a guardrail bypass but rather a critical function of AI in defensive security—executing the find, fix, and test loop that cybersecurity professionals rely on daily. She concluded that removing such capabilities would diminish the model’s effectiveness for legitimate security tasks.
Anthropic’s own testing confirmed that similar techniques were effective against other models, including OpenAI’s GPT-5.5 and the Chinese model Kimi K2.7, neither of which faced similar export restrictions. The company asserted that the technique did not reveal any unique capabilities inherent to its frontier models.
New Safeguards and Industry Collaboration
In response to the negotiations that restored access to Fable, Anthropic developed a new safety classifier designed to block the jailbreak technique in over 99% of cases. This updated safeguard was tested and endorsed by researchers from the Commerce Department’s Center for AI Standards and Innovation.
Beyond the classifier, Anthropic has committed to several initiatives aimed at enhancing security. These include expanded pre-release access for government evaluators to assess frontier models, rapid disclosure of significant jailbreaks, and participation in a shared voluntary security standard among frontier model providers. The company has also initiated a HackerOne bug bounty program specifically for cyber jailbreak submissions.
Collaborating with its Glasswing partners—Amazon, Microsoft, and Google—Anthropic is drafting an industry framework to evaluate jailbreak severity based on four criteria: capability gain over existing tools, breadth of tasks affected, ease of weaponization, and discoverability.
Industry Response and Broader Concerns
The export controls prompted a significant response from the cybersecurity community. Over 100 professionals signed an open letter organized by former Facebook security chief Alex Stamos, addressed to Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross. The letter warned that the export controls could cause more harm than good, particularly given the rapid advancements of adversarial capabilities.
The letter highlighted the proximity of Chinese open-weight models to leading American models, stressing the dangers of restricting access to top-tier capabilities for defenders while adversaries continue to advance. The signatories included executives from prominent companies such as Nvidia, Adobe, Zoom, Google, and Sophos. They echoed Anthropic’s concerns that applying similar standards to other models could effectively halt new deployments across the industry.
Political Context and Future Outlook
The directive to impose export controls occurred against a backdrop of tensions between Anthropic and the Trump administration. In February, Defense Secretary Pete Hegseth labeled Anthropic a “supply chain risk,” a designation typically reserved for companies like Huawei, following failed contract negotiations regarding military applications of its AI technology.
Anthropic co-founder Tom Brown took over negotiations with the administration from CEO Dario Amodei, who had become a target due to his public stances on AI safety and political affiliations. Reports indicate that Lutnick’s letter lifting the ban was addressed to Brown rather than Amodei, highlighting the complexities of the situation.
As the cybersecurity landscape evolves, the implications of these developments will be closely monitored by industry stakeholders and regulators alike.
Source: therecord.media
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
