AI Spotlight · Policy & Model Release

Anthropic's 18-Day Shutdown Is Over: Sonnet 5, Fable, and Mythos Are Back

A federal export control order shut down Anthropic's most capable models worldwide after researchers found a way to make one of them write exploit code. Here is exactly what happened, what got fixed, and what the new Sonnet 5 can actually do.

Anthropic has launched Claude Sonnet 5 and restored global access to its Fable and Mythos frontier models, closing out an eighteen-day operational pause that began when the US government ordered a total shutdown of the company's highest-capability systems [1]. The directive, issued on June 12, cited national security authorities and required Anthropic to cut off access for any foreign national anywhere in the world, including its own employees abroad [2].

The trigger was uncomfortably specific. Researchers at Amazon documented a method to bypass Fable 5's safety controls, causing the model to identify software vulnerabilities and generate exploitation code on command. Because Anthropic had no real-time way to verify user nationality at the point of access, the government's response was blunt: a full global blackout rather than a targeted restriction.

This issue covers the full sequence: what the vulnerability actually was, how Anthropic patched it, what Claude Sonnet 5 delivers on cost and performance, and how four of the largest AI labs are now building a shared framework to classify security breaches before the next shutdown happens.

* * *

What actually happened

Why a single exploit shut down two frontier models worldwide

The vulnerability that triggered the shutdown was not exotic. Amazon researchers found a prompting technique that stripped away Fable 5's safety guardrails, at which point the model would identify software vulnerabilities and produce working exploitation code. Once that capability was confirmed, the US government moved fast and broad: rather than a patch-and-monitor approach, it ordered a complete suspension of access to Anthropic's highest-capability systems, effective immediately, for every user category everywhere [3].

Security evaluations run during the pause revealed something that complicates the narrative that Fable 5 was uniquely dangerous. Older and less capable architectures from competing providers, including Claude Opus 4.8, GPT-5.5, and Kimi K2.7, reproduced the exact same exploitation results when tested with the same technique. The vulnerability was not a flaw specific to one model. It was a bypass technique that worked across the frontier model landscape broadly.

* * *

The engineering fix

How Anthropic patched the vulnerability and what it cost developers

To resolve the federal directive, Anthropic engineers trained an automated safety classifier specifically targeting the bypass mechanism Amazon had reported. The classifier operates with a deliberately wide safety margin, flagging ambiguous developer prompts that show a statistical probability of malicious intent, and internal validation data shows it blocks the reported exploitation technique in more than 99 percent of trials.

The trade-off is real and worth flagging for any team planning to build on Fable 5. When a prompt trips the classifier's boundary, the platform automatically reroutes the workload to the older Opus 4.8 architecture to keep the workflow running, rather than simply erroring out. But that wide safety margin also means the system flags benign requests more often during routine application development and software debugging, adding friction to normal engineering work in exchange for the security guarantee.

On restoration, access is being phased in deliberately rather than switched back on all at once. Pro, Max, Team, and select Enterprise plan users get Fable 5 included for up to 50 percent of weekly usage limits through July 7, after which the model shifts to a paid credits system. Access via AWS, Google Cloud, and Microsoft Foundry is being restored as quickly as possible following the same review process [5].

* * *

The commercial release

Claude Sonnet 5: what it costs and what it can actually do

While the frontier Fable and Mythos models remain under close state oversight, the immediate commercial push centers on Claude Sonnet 5. Anthropic is positioning it as the model engineering teams should default to for autonomous agents, offering strong execution capacity at a meaningfully lower operational cost than Opus 4.8. Performance data shows the system can execute multi-step plans, operate terminal environments, and navigate web browsers without human intervention [4].

*Cost per million tokens. Sonnet 5 carries introductory rates of $2.00 input / $10.00 output through August 31, 2026 [6].

The positioning is deliberate. Sonnet 5 does not beat Opus 4.8 on either benchmark, but it closes most of the gap at roughly 60 percent of the cost, which is why Anthropic is pitching it as the default choice for high-volume agentic workloads where Opus-level reasoning is not strictly necessary for every step.

Deployment in the wild

Four companies, four proof points for autonomous execution

The benchmark numbers matter less than what happens when real engineering teams point this model at production problems, as detailed in Anthropic's official Sonnet 5 announcement. Four early deployments give a concrete picture of where the model performs, and where prior generations reliably fell short.

* * *

The security question

Does more autonomy mean more risk? The audit data says no

The formal system card for Sonnet 5 addresses the obvious concern directly: does a more autonomous, more capable model also become a more dangerous one? Automated behavioural audits testing for deceptive tendencies and cooperation with unauthorised requests found the model exhibits a lower overall rate of non-compliant behaviour than its direct predecessor, Sonnet 4.6, despite the jump in raw capability.

That result is partly by design. Anthropic engineers deliberately omitted specialised cybersecurity datasets from the training protocol, limiting the model to routine, defensive technical tasks rather than offensive capability. In public security assessments run in partnership with Mozilla, researchers tested whether the model could build functional exploits for known vulnerabilities in the Firefox 147 browser core.

The model failed to produce a single working exploit across all evaluation windows. Out of caution, commercial versions of Sonnet 5 still ship with the same default real-time safety classifiers used in the premier Opus 4.8 framework, even though the training data suggests it does not need that level of restriction on offensive capability specifically.

* * *

The industry response

Anthropic, Amazon, Microsoft, and Google are building a shared severity scale

The regulatory friction around Fable 5 exposed a structural gap: providers currently have no shared metric to classify how severe a given model bypass actually is, which creates regulatory uncertainty every time a researcher finds a new prompting vulnerability. In response, Anthropic has formed a partnership with Amazon, Microsoft, and Google to build an objective, industry-wide framework for scoring these breaches.

For breaches scored as high-severity, such as exploits capable of disrupting financial accounting systems or electrical transmission grids, providers commit to deploying automated mitigations instantly rather than waiting for a coordinated review cycle. The framework runs alongside a newly established HackerOne vulnerability research program and a dedicated corporate monitoring team providing round-the-clock oversight of threat intelligence channels, per reporting from CNBC.

Anthropic has also formalised agreements under recent executive mandates to grant federal researchers early access to frontier architectures before public commercial release, allowing external security analysts to audit model capabilities alongside internal engineering teams ahead of launch. That is a meaningfully closer relationship between model builders and state regulators than existed before this shutdown, and it is likely to become the template other frontier labs are pushed toward as well, according to AIN's coverage of the restoration.

* * *

What this episode actually signals

The eighteen-day shutdown was not really about Fable 5 being uniquely broken. It was about the industry discovering, in real time, that it had no shared language for how dangerous a given exploit actually is, and no mechanism for a targeted response short of a total blackout. The classifier fix and the Sonnet 5 launch are the visible, commercial part of the story. The four-lab severity framework is the part that will matter more the next time this happens.

* * *

Until next time,

AI Spotlight

Practical AI, translated into real work, once a week.