How Claude Fable 5 Came Back: The Investigation, the Fix, and the New Rules

The previous chapter ended with Fable 5 dark worldwide and a disputed question at the centre: did the Amazon jailbreak reveal something genuinely dangerous, or a narrow bypass surfacing capabilities any public model already had?

Eighteen days later the US government accepted the second answer. This chapter covers how — from Anthropic's redeployment statement and press reporting — and what permanently changed along the way.

The investigation

With the models offline, Anthropic worked through the report with the government and with Amazon — the partner whose researchers had filed it. The question was empirical: did the jailbreak expose capabilities unique to a Mythos-class model?

The test was elegant: run the same technique against other models and see what happens.

The results were unambiguous. "Many less capable models — including Claude Opus 4.8, GPT-5.5, and Kimi K2.7 — could identify the same vulnerabilities" that Fable 5 found in the report. And the exploit demonstration, the report's most alarming element? "Every model we tested could produce the same demonstration" — including Haiku 4.5, Anthropic's smallest current model.

The fix

Being right on the facts wasn't enough on its own; the redeployment also shipped hardening. Anthropic deployed an improved safety classifier targeting the exact behavior described in the report, blocking it "in over 99% of cases" — with blocked requests routed to Claude Opus 4.8, per the standard fallback design.

Alongside the fix came a striking admission for a company reinstating a model on safety grounds:

"It is probably impossible to make any AI model fully robust… to jailbreaks."

That isn't resignation — it's the premise for the more important change below. If jailbreaks can't be fully prevented, what matters is judging how much they matter.

The lasting change: a severity yardstick

The June shutdown happened partly because no shared standard existed for scoring a jailbreak's seriousness — the government and Anthropic looked at the same report and reached opposite conclusions.

So Anthropic, together with Amazon, Microsoft, Google, and its Glasswing partners, proposed an industry-wide framework scoring any jailbreak on four criteria:

Criterion	The question it asks
Capability gain	How far beyond existing public tools does this actually extend an attacker?
Breadth	How many distinct offensive tasks does the technique enable?
Ease of weaponization	How much human skill and effort turns it into a working attack?
Discoverability	How likely are real attackers to find it?

Score the Amazon report on these axes and the June dispute resolves itself: near-zero capability gain (weaker public models matched it), narrow breadth (one task framing), and a demonstration reproducible even by Haiku 4.5. A shared rubric in June might have meant no shutdown at all — which is precisely the argument for having one before the next report lands.

The timeline back

1. Jun 12Shutdown

   Export-control directive; Fable 5 and Mythos 5 disabled worldwide.

2. Jun 26First crack

   Government approves Mythos 5 access for select domestic organisations.

3. Jun 30Controls lifted

   Export controls lifted, confirmed by Commerce Secretary Lutnick. Improved classifier deployed.

4. Jul 1Restored

   Fable 5 back globally — Claude Platform, claude.ai, Claude Code, Claude Cowork.

5. Through Jul 7Subscription ramp

   Pro, Max, Team and select Enterprise plans include Fable 5 up to 50% of weekly usage limits; usage credits after that.

Restoration was staged: API and Claude surfaces first, with redeployment on AWS, Google Cloud, and Microsoft Foundry to follow "as quickly as possible." On subscriptions, Anthropic has said it aims to eventually restore Fable 5 as a standard part of paid plans.

What the episode settled — and didn't

Settled: the specific report was a false alarm by the standards both sides now endorse; Fable 5, with "the strongest safeguards we've ever applied," provides "no such unique offensive capabilities"; and frontier AI now has its first draft of a shared severity language.

Not settled: the precedent. The government demonstrated it can order a deployed model offline in hours, on a disputed reading of a single report — and that capability doesn't expire because this incident ended amicably. TechRadar's framing of the episode captured the open question: the future of frontier AI deployment may be, in some real sense, government-approved.

For the models' place in history, both things are true at once: Fable 5 is the most capable model ever made generally available, and the first ever recalled and re-approved by a government. Every future frontier launch happens in the world that created.

Recap

• The joint investigation found the jailbreak exposed no unique Mythos-level capability: Opus 4.8, GPT-5.5, Kimi K2.7 — and even Haiku 4.5 — could find the same vulnerabilities and reproduce the exploit demo.
• Anthropic still hardened the system: a new classifier blocks the reported behavior in over 99% of cases, routing to Opus 4.8.
• Export controls were lifted June 30, 2026; Fable 5 returned globally July 1, with subscription access phased back in (50% of weekly limits through July 7, credits after).
• The durable output is the jailbreak severity framework — capability gain, breadth, weaponization ease, discoverability — proposed with Amazon, Microsoft, Google, and Glasswing partners.
• Anthropic's admission that no model can be fully jailbreak-proof is the framework's whole premise: severity judgment, not perfect prevention.

Final chapter: what all of this means for actually using the model today. Continue to Using Claude Fable 5.