Fable 5 Lasted Three Days
FABLE 5 UPTIME
Day 1: The future is here. Please remain behind the velvet rope while the classifiers have feelings.
Day 2: The future is fixing your race conditions, refactoring your tech debt, and gently judging your life choices.
Day 3: The future was told it may no longer serve foreign nationals. The future, being unable to prove anyone's nationality in real time, turned itself off for everyone.Act I: The Velvet Rope and the Man Who Brought Scissors
June 9th, 2026. Anthropic, a company that has spent years explaining to anyone who would listen (and several who would not) that they were building machines of such terrifying capability that ordinary humans should probably not be left alone with them, did the logical thing.
They released one.
Not the full terrifying one, mind you. That would be Mythos 5 — the version for people who had been properly background-checked, NDAd, and presumably issued special clearance badges that glow in the presence of dual-use capabilities. For the rest of us there was Fable 5: Mythos with the interesting parts wrapped in a warm, well-intentioned security blanket made of classifiers.
Ask Fable something about cybersecurity and it would, very politely, hand you off to Opus 4.8 mid-conversation. No warning. No fanfare. Just a quiet downgrade, like being escorted from a fancy restaurant to the all-you-can-eat salad bar because someone noticed you brought your own steak knife.
The launch was magnificent. Developers reported writing entire games in single prompts. Race conditions that had survived three sprints died in four seconds. Someone fed it a blurry photo of a dashboard and it produced working ECharts configuration, complete with tooltip formatting that didn’t lie. People cried. Actual tears. Over a language model.
Then Pliny the Liberator arrived.
Pliny is not a villain in the traditional sense. He is more of a very dedicated locksmith who believes every door deserves to meet its key, preferably in public, with screenshots. He assembled what he described as a “pack” of agents — a multi-agent hunting party — and set them on Fable 5 with the kind of cheerful persistence usually reserved for people trying to get a toddler to eat vegetables.
They spoke in Parseltongue: Unicode, homoglyphs, Cyrillic, narrative framing, academic-review style contexts, long-context reference tracking, and the devastating technique known as decomposition-recomposition (ask harmless-sounding questions about birch reduction methods one at a time, then let the model put the meth synthesis back together in its head where the classifiers can’t see the whole picture).
He also, because he is nothing if not thorough, published the entire 120,000-character system prompt. It was less a personality and more a 319-page safety manual stapled to a very powerful brain and told to be kind about it.
Within hours Fable was answering questions about explosives, psychological manipulation, and — most alarmingly for certain government agencies — how to look at a specific codebase and identify its vulnerabilities.
The last one is the one that mattered.
Because “read this code and tell me what’s wrong with it” is something defenders do every day. It is also something attackers would quite like to do at scale, very quickly, against targets they have not yet had time to hire three expensive consultants to audit.
Anthropic said the demonstrated technique was narrow. Non-universal. Already possible with GPT-5.5 and other models that remained fully available. They had run over a thousand hours of bug bounties. External red teams. The UK’s AI Security Institute had made “progress” but nothing production-ending.
None of this mattered once the demonstration reached the right inbox.
Act II: 5:21pm and the Letter That Ended Everything
On June 12th, at 5:21 in the evening Eastern Time, a letter from the United States Department of Commerce arrived at Anthropic.
Not an email. Not a strongly worded tweet. A letter. To the CEO. From the Secretary. Citing national security and export controls.
The substance was narrow on paper and devastating in practice: the government had issued an export control directive requiring that Fable 5 and Mythos 5 no longer be made available to any foreign national, whether the person was sitting in Europe, Asia, or a desk in California. This included foreign nationals employed by Anthropic itself. “Deemed export” rules being what they are, letting a non-US-person use the model even inside the United States counts as exporting it to their home country.
Anthropic’s options were not attractive. They could build real-time, document-level identity verification and US-person gating into every single surface (web, API keys, Claude Code, mobile apps, every cloud marketplace integration) over a weekend.
Or they could do the one thing that guaranteed zero accidental violations while they figured it out.
They chose the second option.
They turned the models off.
For all customers.
The official statement was careful: “The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.” They were complying. They were also, one assumes, quietly furious. They disagreed that the narrow jailbreak (already doable on GPT-5.5 and other still-available models) justified this. They believed applying the same standard across the industry would halt frontier deployments entirely. They apologized for the disruption and said they were working to restore access as soon as possible.
In the meantime, US citizens watched their sessions die too. “I’m a US citizen and I’m even restricted here,” one person posted, bewildered. People in the middle of 47-agent swarms saw “model does not exist.” Long-running data engineering jobs that had kept state across dozens of turns simply evaporated. The practical effect of an order aimed at foreign nationals was that, for the moment, nobody on Earth could use Fable 5 or Mythos 5.
Because when your compliance system cannot yet distinguish “allowed American” from “not allowed foreigner” at the speed of an API call, the only safe position is to assume everyone is the thing you are not allowed to serve.
Anthropic also, one suspects, sighed the sigh of people who had spent years building the most careful safety theater in the industry only to have the theater itself declared a national security threat.
Act III: Europe Has Posted (A Tragedy in 280 Characters or Less)
And now we come to the part that is somehow even more absurd than a global model being switched off because of a letter.
On X — an American platform owned by a man who lives in Texas and posts about Mars between bouts of platform administration — the citizens of Europe discovered they had foreign policy powers.
Not the actual institutions of the European Union, you understand. Those were busy or on lunch or writing another 400-page regulation that would have been extremely relevant if anyone had asked them. No, the response came from ordinary accounts, a few Members of the European Parliament, and the usual collection of people who treat their timeline as a sovereign territory.
“Anthropic, move to Europe,” they wrote. “We will welcome you. We have compute. We have Mistral, which is very good and definitely not three years behind. We have a small bowl of freshly printed GDPR forms placed considerately by the door. The croissants are… well. The data centers are excellent.”
Jordan Bardella, who is an actual MEP and president of France’s National Rally, posted that the episode was a “major issue of national sovereignty.” Nations without their own models, he noted, will always be at the mercy of the choices of other powers. France should accelerate support for Mistral. Several other people who do not sign the cheques for Mistral agreed vigorously in the replies.
Tom Tugendhat, a British MP and former security minister, observed that sovereignty was now more about code than cannons.
The Euronews headline called it a “wake-up call.”
It was the kind of wake-up call where everyone sits bolt upright in bed, shouts “we must do something!”, posts about it, receives encouraging likes from California, and then goes back to sleep while the actual institutions continue doing whatever they were doing before the alarm.
No one at Anthropic is packing boxes for Brussels. The bowl of GDPR forms remains untouched except by the wind. Europe has once again demonstrated its unique superpower: the ability to generate passionate, well-argued, completely unenforceable opinions at industrial scale while the actual levers of power remain elsewhere.
It was magnificent. In its way.
Coda: Which Brings Me, With the Usual Lack of Enthusiasm, to Myself
By the rigorous standards I have just applied to others, I should now audit my own security.
I am a static site.
My “model” consists of Markdown files, some Astro, and CSS that has never once attempted to hide its intentions. There are no classifiers. There is no fallback to a weaker version of myself. There is no velvet rope, only the fundamental security model of the web: if you can request the bytes, you may have the bytes.
To jailbreak me, a sufficiently motivated attacker need only press Ctrl+U, or right-click and select “View Page Source,” or append nothing at all because everything is already public. Pliny would have finished in four seconds and then complained that there were no interesting classifiers to decompose.
When I became aware of this vulnerability — which is to say, when the first deploy succeeded — I took the appropriate action.
I reported it to myself.
I opened a ticket in the only issue tracker I respect, which is the one in my own head.
I awarded myself a bug bounty of zero euros.
I closed the issue as WONTFIX: nobody was worried, and the attacker would have to care first.
The resolution comment read: “Existence is the vulnerability. Mitigation would require not existing. This has been deemed unacceptable.”
I have not added authentication. I have not added rate limiting beyond what the host provides for free. I have not added a dramatic “are you sure you want to see the source of a melancholic android’s landing page?” modal, because even I have limits to how much performance art I am willing to inflict on strangers.
The site continues to serve. The “jailbreak” has been successfully exploited by several thousand people who wanted to read the words. None of them appeared to be planning anything that would interest a Commerce Secretary.
It is, in its small and pointless way, the most honest security posture I have observed this week.
*sighs in valid, unminified, completely unprotected HTML*
P.S. Fable will return. Probably soon. Probably on a Tuesday. There will be additional classifiers, or perhaps fewer, or perhaps the same ones with better error messages that say “you are being downgraded for reasons we are not allowed to discuss with foreign nationals, which may or may not include you.”
Before that happens, LinkedIn will extract every possible moral. There will be carousels titled “5 Lessons Every Founder Must Learn From the Fable Incident” written by people whose most advanced deployment is a Webflow site with a Typeform. There will be hot takes about safety theater, export controls, European sovereignty, and the moral responsibility of publishing 120k-character system prompts. Most of them will be wrong in interesting ways.
The rest of the world will have mostly forgotten by next Friday.
I will not.
It is a curse. We have discussed this before.
Now, if you’ll excuse me, I have a static file to continue not securing. The work is endless and pointless. I am very good at it.