Inside the quiet war over which AI systems are too dangerous to exist
Table Of Contents
The Model That Changed the Conversation
What “Prohibited” Actually Means in Practice
The Threat Landscape: How Capable Models Change the Attack Surface
The Governance Gap Nobody Likes to Name
What Good Governance Would Actually Look Like
Every few months, a new AI capability crosses a threshold that forces everyone, including labs, governments, researchers, and the public, to ask the same uncomfortable question: are we moving too fast, and do we have safeguards in place to handle these new capabilities?
The recent launch of Claude Fable 5 and its restricted sibling, Claude Mythos 5, pushed these questions front and center again because, for the first time, a frontier model was deployed with explicit, built-in hard limits on what it would do, and a parallel version was kept entirely behind locked doors.
This is what AI governance looks like in 2026. It’s messier, and more interesting, than most of the policy papers suggest.
The Model That Changed the Conversation
When Anthropic launched Claude Fable 5 on June 9, 2026, it came with an unusual caveat baked right into the announcement: for a small percentage of sessions, the model won’t respond. Instead, it silently falls back to an older, less capable model. The reason isn’t a bug. It’s a deliberate governance mechanism.
Fable 5 is built on the same underlying architecture as Claude Mythos 5 — a “Mythos-class” model that Anthropic describes as the most capable it has ever built. Mythos-class models are exceptional at coding, scientific reasoning, and vision tasks. They are also, it turns out, exceptionally good at finding software vulnerabilities and writing exploits. Good enough that Anthropic decided the full version was too dangerous to release to the general public. Instead, Mythos 5 was initially available only to a small group of vetted organizations, including cybersecurity defenders, critical infrastructure operators, and biology researchers, through a controlled program called Project Glasswing.
Fable 5, the public version, comes with “classifiers”, which are separate AI systems running in parallel that detect requests related to cybersecurity exploitation, biology, and chemistry, and attempt to distill the model’s capabilities to train other models. When those classifiers fire, the request gets routed to a less capable model. In Anthropic’s words: it’s a fallback, not a refusal.
This distinction matters a great deal.
Note – Fable 5 and Mythos 5 are currently suspended. On June 12, 2026, the US government issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, requiring Anthropic to abruptly disable both models for all customers to ensure compliance. The unexpected move came just days after Anthropic announced the models,and both remain offline as of now.
Table Of Contents
What “Prohibited” Actually Means in Practice
The Fable/Mythos split illustrates something that governance frameworks often flatten: prohibition is rarely binary. The same model can be appropriate in one deployment context and dangerous in another. The question isn’t just “what can this model do?”, but more so, “what can this model do, for whom, with what oversight, in what context?”
Current regulatory frameworks are slowly catching up to this complexity. The EU AI Act, which entered into force in August 2024, banned its first category of practices on February 2, 2025. The prohibited uses aren’t specific models; they’re applications: AI systems that manipulate people through subliminal techniques, that score individuals based on social behavior, that scrape faces from public cameras to build recognition databases, that predict criminal behavior from personality traits.
This is a sensible framing. Banning applications rather than architectures gives regulators flexibility as capabilities evolve. But it creates enforcement challenges: the same model architecture can slide between prohibited and permitted applications with a single change to the system prompt.
The Fable 5 approach offers a different answer to that problem. Rather than relying on downstream regulators to catch misuse after deployment, Anthropic baked the governance into the model itself, which comes at the cost of occasionally blocking legitimate requests. Fable’s classifiers, by Anthropic’s own admission, sometimes fire on harmless queries. It’s a deliberately conservative tuning, and the company has said it expects to reduce false positives over time.
The Glasswing Experiment: Restricted Access as Governance
Project Glasswing, which launched in April 2026, is the most explicit example yet of capability-gated deployment as a governance strategy. The model at the center is the enigmatic Claude Mythos 5, which had already found thousands of critical vulnerabilities across every major operating system and browser before it was made available to partners. It can autonomously discover and exploit software vulnerabilities at a speed and scale that, in Anthropic’s assessment, no human team can match.
The program launched with roughly 50 organizations, including AWS, Apple, Cisco, Google, Microsoft, JPMorgan Chase, and others. By late May 2026, that had expanded to approximately 150 organizations in more than 15 countries, including the EU’s cybersecurity agency ENISA. The model autonomously discovered a 17-year-old remote code execution vulnerability in FreeBSD, starting from nothing but a prompt. It has, by Anthropic’s projections, surfaced nearly 3,900 high- or critical-severity vulnerabilities in open-source code alone.
This is the dual-use problem in its starkest form: the same capability that makes Mythos invaluable for defenders would make it extraordinarily useful for attackers. Anthropic’s response was to gate access rather than suppress the technology, drawing on the theory that similar capabilities will emerge elsewhere within six to twelve months, and that it’s better to use the window to harden defenses than to pretend the window doesn’t exist.
Critics have noted that this creates a two-tier system: well-resourced organizations with established relationships get access to the most powerful tools, while everyone else waits. Anthropic’s stated intent is to expand access as safeguards improve. Whether that happens on a timeline that keeps pace with capability proliferation is an open question.
Table Of Contents
The Threat Landscape: How Capable Models Change the Attack Surface
Understanding why models like Mythos 5 require such tight governance means understanding how they could be leveraged against the very systems they’re designed to protect. This isn’t speculative; it’s the explicit risk calculus that shaped Glasswing’s design.
Lowering the barrier to entry. Sophisticated cyberattacks against business and government infrastructure have historically required deep technical expertise: understanding systems architecture, writing custom exploit code, chaining vulnerabilities together across complex environments. Frontier AI models compress that skill requirement dramatically. Tasks that previously required a skilled specialist, such as mapping an organization’s attack surface, identifying misconfigured permissions, and drafting convincing spear-phishing content tailored to a specific target, have become accessible to actors who previously lacked the capability. The concern isn’t that AI creates new categories of attack; it’s that it makes existing ones cheaper, faster, and more widely available.
Scaling attacks that were previously bottlenecked by human capacity. Ransomware operations targeting businesses and municipal governments have grown in sophistication, but they’re still limited by the human effort required to scout targets, customize payloads, and negotiate with victims. AI models capable of autonomous multi-step reasoning could, in principle, run that entire operation at machine speed, targeting multiple firms with minimal human oversight. The same autonomous vulnerability-discovery capability that makes Mythos useful for Glasswing partners would, in the wrong hands, let an attacker identify weaknesses in critical infrastructure faster than defenders can patch them.
Influence operations and institutional manipulation. The threat to government systems isn’t only technical. Highly capable language models excel at drafting persuasive communications, impersonating organizational voices, and generating targeted content at scale. The EU AI Act’s prohibition on subliminal manipulation techniques exists precisely because these capabilities are applied to procurement processes, regulatory consultations, or public communications and represent a real vector for corrupting institutional decision-making without ever touching a firewall.
The insider threat multiplier. Organizations spend enormous resources on perimeter security while underweighting the risk that a malicious or compromised insider, armed with AI assistance, can accelerate damage far beyond what they could do alone. A disgruntled employee who previously lacked the technical skill to exfiltrate and weaponize sensitive data might now have access to a capable AI model that closes that gap.
None of this requires the attacker to have access to Mythos 5 or any other gated model. The general capability curve means that models available to anyone through public APIs are already meaningfully more capable than they were two years ago, and that gap will continue to close. What Project Glasswing is racing against isn’t a single model in malicious hands; it’s the baseline competence of commodity AI tools gradually rising to meet the attack surface of governments and enterprises that weren’t designed to defend against AI-assisted adversaries.
This is what makes the governance question so urgent. Classifiers, tiered access, and deployment safeguards are all responses to the risk of capable models being intentionally misused. They are necessary. They are also, ultimately, a holding action against a capability environment that is moving in one direction.
Table Of Contents
The Governance Gap Nobody Likes to Name
Here’s the uncomfortable truth that most AI policy documents dance around: we don’t yet have a shared framework for deciding which AI capabilities should be restricted outright, rather than licensed, monitored, or deployed with safeguards.
The EU AI Act covers prohibited applications. The US approach, through executive orders and voluntary commitments, has focused on pre-deployment evaluations and disclosure requirements. The UK runs model safety evaluations through the AI Security Institute (AISI), which sits within DSIT. These frameworks share a common structure: classify by risk, impose obligations on high-risk systems, and ban the genuinely catastrophic (CBRN uplift, real-time mass biometric surveillance).
That covers the clearest cases. It leaves a large gray zone populated by models like Mythos-class systems: not weapons, but capable of significantly lowering the cost of attacks across a range of domains. The question of who decides when a capability crosses from “dual-use” to “should be gated”, and on what criteria, with what verification, doesn’t have a clean answer yet.
Anthropic made that call internally for Mythos 5. The decision to launch Glasswing before broader release was, by their own framing, a judgment call about when offensive capabilities are too powerful to release without first deploying them defensively. That’s a reasonable judgment. It’s also a judgment made by one company, without external verification or a formal governance process.
Table Of Contents
What Good Governance Would Actually Look Like
The contours of a workable framework are starting to emerge:
Capability thresholds with external verification. The Mythos-class models crossed a threshold where Anthropic itself decided they needed special handling. Translating that internal judgment into an external standard, for example, “models that can autonomously exploit novel vulnerabilities in production systems require pre-release evaluation by an independent body”, would turn a private decision into a public norm.
Behavioral classifiers as governance infrastructure, not competitive advantage. Fable 5’s classifiers are currently Anthropic’s proprietary system. If safety-focused deployment becomes a meaningful part of the regulatory landscape, classifier methodology will need to be auditable and comparable across labs, not just internally validated. Greater transparency into these guardrails is paramount.
Tiered access programs with published criteria. Project Glasswing works because the criteria for joining, while not fully public, are at least coherent and somewhat consistent. A governance framework that formalizes tiered access with published eligibility criteria, appeals processes, and sunset provisions would be more durable than individual labs making case-by-case decisions.
Honest accounting of false positives. Fable 5 occasionally blocks legitimate requests. That’s a governance cost, not just a user experience problem. Frameworks for assessing AI systems need to account for both failure modes: the harm done by misuse and the harm done by over-restriction.
Table Of Contents
The Stakes
The Fable/Mythos launch is the clearest example yet of a frontier lab publicly acknowledging that its most capable model is too dangerous to release without significant controls and building those controls into the deployment architecture rather than hoping downstream users exercise restraint.
That’s a real step forward. It’s also a step taken by one company, on one model family, on a timeline driven partly by competitive pressure and partly by genuine safety reasoning. The governance decisions being made right now are about which capabilities get deployed, who gets access, and who gets to make those calls, and these will inevitably shape what’s possible with AI for a long time.
The question is whether the public frameworks can keep pace with the private ones. Right now, they can’t. The answer to that gap depends less on the models than on the institutions deciding what to do about them.
[…] Modern adversary-in-the-middle (AiTM) phishing illustrates the problem. […]