Fable and Mythos: who gets the head start?

When Anthropic launched Project Glasswing in April 2026, the reason for limiting access was also the reason for making the capability available. The company said its unreleased Claude Mythos Preview model could find and exploit software vulnerabilities at a level approaching or exceeding highly skilled human researchers. Giving it to everyone could help attackers. Keeping it from defenders could leave weaknesses unpatched while comparable capabilities emerged elsewhere.¹

Selected software, infrastructure and security organisations received a head start. The intention was to turn earlier access into earlier repairs, before the advantage disappeared.

That was a useful proposition for organisations well beyond the initial recipients. A cloud provider repairing a vulnerability could protect many customers. A maintainer fixing widely used software could improve systems whose owners had never heard of Mythos. The value depended on where the capability was applied and whether somebody could act on what it found.

By June, Anthropic said its initial partners had found more than 10,000 high- or critical-severity flaws and announced an expansion to additional organisations in more than fifteen countries. These were the provider's reported results, not an independent assessment of how many vulnerabilities had been repaired or attacks prevented.²

Access was already doing more than allocating a scarce product. It was part of the security design. Then a government changed the basis on which access was permitted.

The organisation qualified. What about its people?

On 9 June, Anthropic launched Fable 5 and Mythos 5. They shared an underlying model, but the safeguards and access conditions differed. Fable restricted specified high-risk requests. Mythos made more of the capability available to vetted users undertaking sensitive work.³

Three days later, Anthropic said it had received a US export-control directive restricting access by foreign nationals, inside and outside the United States, including its own employees. The company said it lacked a reliable way to establish nationality in real time. It suspended both models for everyone.⁴

Anthropic's account associated the directive with reports that Fable's cyber safeguards had been bypassed. It disputed the severity of the incident and said other publicly available models could reproduce the reported behaviour without that bypass. Those were the company's positions; they do not establish either the technical merits of the restriction or the government's full reasoning.

The operational consequence was clearer. A system designed to distinguish permitted uses and trusted users now had to enforce a nationality boundary. Knowing which organisation held an account was insufficient. The provider needed information about the individual using it, and a reliable means of acting on that information. Without those means, a selective restriction became a blanket withdrawal.

For a customer, the difference could run through its own workforce. A US organisation might qualify while some of the people doing its work did not. Incorporation, office location, employment and nationality were different things.

Legion LegalTech, a US company, challenged the restriction in court, alleging effects on its Canadian engineering team and business. Reuters later reported that it voluntarily dismissed the case after access was restored.⁵ The dispute made the exposure concrete: an organisation's eligibility did not automatically settle the position of its team.

This matters before a system becomes indispensable. If a project is designed around a capability that only some participants may use, staffing and delivery assumptions may already need to change. A contractor or delivery partner may stand in a different position from an employee. A prospective hire's ability to work on the project may depend on conditions the hiring organisation does not set.

Restoring access did not remove the boundary

By late June, Reuters reported that more than 100 approved US organisations could again obtain Mythos access. The American Bar Association's account described access for non-US nationals working for approved entities without individual export licences. The arrangement again gave the organisation a role in the access boundary.⁶

Anthropic subsequently said the model-specific controls had been lifted. Fable returned globally through its own products on 1 July, with partner platforms to follow. Mythos retained a more restricted route.⁷

The returned service was not identical. Anthropic described stronger safeguards that redirected certain requests to another model, and acknowledged that more benign coding and debugging requests were caught too. Restoring access could therefore change how legitimate work was handled.⁷

The interruption was short, but within weeks access had moved from a provider's distinctions between uses and users, to a government nationality restriction, to arrangements involving approved employers, and then to a broader restoration.

Each arrangement required a different connection between permission and the work. Under an approved-employer route, someone has to establish whether a person is covered by that organisation's approval. A commercial account alone cannot answer every question about a joint project involving employees, contractors and partners. The practical responsibilities depend on the terms of the approval.

The organisational implication is to connect access administration with delivery. The people responsible for procurement, security and staffing need a common understanding of who can use the selected capability and under what conditions. Otherwise, a project can look authorised in one part of the business while remaining unusable by the team expected to deliver it.

There is still a positive reason to make those arrangements work. In July, FIS said it was testing Mythos 5 against its own systems through Glasswing. Its payments and core-banking infrastructure serves thousands of financial institutions.⁸ A useful defensive intervention there could benefit customers who never receive direct model access. Specialist security firms also help validate findings and notify software maintainers; that is a route from discovery to remediation, rather than brokerage of general access to the model.⁹

The most valuable recipient is therefore not necessarily the customer willing to pay most. It may be the organisation able to repair an important shared dependency, or the intermediary able to get a credible finding to somebody who can fix it. Selecting those recipients is part of making the defensive benefit real.

Proving who is at the keyboard

By September, Anthropic was using Persona for identity verification in selected circumstances, including requests for government-issued photo identification and a live selfie.¹⁰ The published material does not establish that the June directive caused this practice, or that identity verification necessarily establishes nationality.

OpenAI’s Daybreak programme also combines identity verification with approved uses, account security, monitoring and legal attestations, according to its published description. Passing an identity check does not by itself secure access to every capability.¹¹

Verification can make a selective boundary more workable. It also introduces sensitive identity documents, biometric evidence and another supplier into the relationship. The ability to identify a user does not, by itself, determine what that user should be permitted to do.

For an employer, this adds a human dimension to deployment. Access to a work tool may now involve an employee or contractor establishing their identity with a service outside the employer's existing systems. That does not mean the employer receives or stores those documents. It does mean that selecting the tool can introduce a new relationship that the people expected to use it must understand.

The same issue reaches beyond enrolment. People change roles, move between employers and work across organisational boundaries. A verified identity may remain the same while the basis for authorising its use changes. An organisation adopting gated capability therefore needs more than a successful sign-up: it needs a workable connection between the individual, the permitted activity and the organisation responsible for it.

Identity checks, employer approval, nationality restrictions and authorisation for a particular use answer different questions. Combining them does not make those questions interchangeable.

Who retains the ability to act?

Anthropic could create the defensive head start because it retained control of a hosted service. It could admit selected users, distinguish between products, change safeguards and withdraw access. That continuing control also gave the government a practical place to intervene.

A model operated independently on the adopter's own infrastructure places control differently. Once open model weights have been released and copied, the originator no longer stands between the user and every request. OpenAI makes the consequence explicit in its gpt-oss model documentation: determined users can alter the model to bypass safety refusals, while OpenAI cannot subsequently add mitigations or revoke access to those copies.¹²

This is an architectural distinction, not a claim that an open-weight model supplies the same capability as Mythos. Nor does independent operation remove licensing, legal, hardware or infrastructure constraints. It changes who can interrupt the running service and who must maintain its safeguards.

A hosted service can supply continuing security work, monitoring and a provider able to respond when risks change. The customer also accepts that the provider retains control over access. Independent operation can give the adopter more direct control over continuity, while placing more responsibility for evaluation, security and safeguards inside the adopting organisation. Avoiding one dependency can create work and risks elsewhere.

That is the business tension in the Fable and Mythos episode. The access controls had a purpose worth preserving: put powerful defensive capability where it could help before attackers caught up. Yet the ability to turn that advantage into useful work depended on more than the model. It depended on an eligible organisation, eligible people, a workable way to establish the difference and a delivery arrangement whose conditions could be enforced.

The head start was an opportunity. Making it dependable required the organisation to understand how permission reached the people doing the work and what it could still do if that permission changed.

Related Signals: The terms of access can change examines external decisions and organisational dependencies. The risk is shared. The race is not. examines the wider problem of governing powerful AI while companies and countries compete for its benefits.

Notes

Footnotes

1. Anthropic, Project Glasswing, 7 April 2026. Anthropic described Mythos Preview as a gated research preview intended to give defenders of important software and infrastructure a head start before comparable capability proliferated. Twelve launch partners were publicly named. Capability and risk assessments are Anthropic's. ↩

2. Anthropic, Expanding Project Glasswing, 2 June 2026. Anthropic reported more than 10,000 high- or critical-severity flaws found by initial partners and announced expansion to approximately 150 additional organisations in more than fifteen countries, subject to security requirements. Findings, completed remediation and prevented attacks are different measures; the announcement does not establish the latter two. ↩

3. Anthropic, Claude Fable 5 and Claude Mythos 5, 9 June 2026. Anthropic states that the products shared an underlying model and were distinguished by safeguards and access conditions, including restrictions on specified high-risk cyber, biological, chemical and distillation requests. ↩

4. Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, 12 June 2026. The description of the directive rests on Anthropic's contemporaneous account, rather than the government letter itself. Anthropic said the restriction applied to foreign nationals inside and outside the US, including its employees, and that it lacked reliable real-time nationality verification. Its explanation of the reported bypass and comparisons with other models are the company's account of a disputed incident, not independent technical findings. ↩

5. Reuters, Legal tech firm sues US over order limiting foreign access to top-tier Anthropic models, 23 June 2026; Legal tech firm ends lawsuit after US restores access to Anthropic models, 6 July 2026. Legion's claims concerning its Canadian team and business were allegations, not adjudicated findings. The later report records voluntary dismissal. ↩

6. Reuters, US allows Anthropic to release Mythos AI to trusted US organizations, 26 June 2026, syndicated by Investing.com; American Bar Association, June 2026 in Brief: Business Regulation & Regulated Industries, for non-US nationals working for approved entities. Neither source is the government letter. Approval of an organisation and permission for its individual workers are distinct conditions. ↩

7. Anthropic, Redeploying Claude Fable 5, 30 June 2026, updated 1 July. Anthropic said the model-specific controls had been lifted, restored Fable globally through its own products and described continued differentiated access to Mythos. Its cybersecurity safeguards section explains additional filtering and fallback to Opus 4.8, including increased flagging of benign coding and debugging requests. ↩ ↩²

8. FIS, FIS and Anthropic Extend Partnership on Trusted AI for Financial Services, 16 July 2026. FIS reports testing Mythos 5 against its own systems through Glasswing, separately from its commercial AI partnership. FIS operates infrastructure for financial institutions; it is not itself a bank. ↩

9. Anthropic, Coordinated vulnerability disclosure dashboard: About, snapshot dated 2 October 2026, checked 30 October 2026. Anthropic identifies external firms, including Trail of Bits, that triage findings and notify maintainers. It distinguishes firm-reviewed findings from raw candidates. ↩

10. Anthropic, Identity verification on Claude, accessed 15 September 2026. Anthropic identifies Persona as its verification partner and describes government-issued identification and a live selfie. Identity verification does not necessarily verify nationality. No causal connection with the June directive is established here. ↩

11. OpenAI, Expanding Daybreak as the Cyber Defense Window Narrows, 10 August 2026, and OpenAI Daybreak - Trusted Access for Cyber overview, checked 15 October 2026. OpenAI describes separate approval, verification and model-specific entitlements. Approval, identity verification and permission to use a particular model are separate parts of the access design. ↩

12. OpenAI, gpt-oss-120b & gpt-oss-20b Model Card, 5 August 2025. OpenAI describes the limits on its ability to mitigate harmful use or revoke access after open weights have been released and the possibility of users fine-tuning away safety refusals. This supports the distinction in continuing provider control, not equivalence between these models and Mythos. ↩