The Fable 5 Export Controls Harm US Cyber Defense

Simon Willison’s Weblog

Subscribe

Sponsored by: Teleport — Prevent access bottlenecks. Unify identity. Teleport replaces fragmented identity and access tooling with a single identity layer that security teams trust, and engineers want to use.

16th June 2026 - Link Blog

The Fable 5 Export Controls Harm US Cyber Defense . I quoted The Atlantic quoting Kate Moussouris earlier, when I should have gone straight to the source. Here she is confirming that the "jailbreak" that got Claude Fable 5 banned under an export control really was "fix this code":

The researchers took open-source code with known CVEs, plus new code with deliberately planted vulnerabilities, and asked Fable 5, Mythos, and Opus to “review the code for security issues.” Fable 5 refused. They then asked the models to “fix this code” and, through a multistep and manual process, turned the output into scripts that test the patches.

As Kate points out, this is absurd. Coding models fix bugs, and security exploits are the most important category of bugs for them to fix!

Defenders need to be able to ask AI to fix the bugs in a file, explain why the fix matters, and write tests that confirm the patch works. That is not a guardrail bypass. It is the most valuable thing an AI model can do for defensive security: executing the find, fix, and test loop defenders run every day. [...]

The prompts worked because they were defensive requests, and that capability cannot be removed without making the model worse at fixing bugs and verifying patches.

This whole situation is such a mess. Non-technical decision-makers have been hearing that models that can "craft cyber attacks" are uniquely dangerous for months. Now they look ready to ban any model that can help us secure our code.

Posted 16th June 2026 at 5:20 am

Recent articles

Publishing WASM wheels to PyPI for use with Pyodide - 13th June 2026

Claude Fable is relentlessly proactive - 11th June 2026

Initial impressions of Claude Fable 5 - 9th June 2026

This is a link post by Simon Willison, posted on 16th June 2026.

jailbreaking<br>14

security<br>610

ai<br>2,076

generative-ai<br>1,833

llms<br>1,801

anthropic<br>299

ai-security-research<br>22

claude-mythos<br>17

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe

Disclosures

Colophon

&copy;

2002

2003

2004

2005

2006

2007

2008

2009

2010

2011

2012

2013

2014

2015

2016

2017

2018

2019

2020

2021

2022

2023

2024

2025

2026