Fix this code: the framing gap behind an 18-day model shutdown.
On June 12, the US government ordered two of the most capable AI models on the planet taken offline. Eighteen days later, the order was lifted. The interesting part is not the outage. It is what the reported trigger says about how safeguards fail—and that part did not get reversed on June 30.
What happened
On June 9, Anthropic released Claude Fable 5 and Claude Mythos 5. Fable was available to the public; Mythos was restricted to trusted Project Glasswing partners working in defensive cybersecurity. Fable ran classifiers over cybersecurity, biology and chemistry, and distillation requests. At launch, flagged requests fell back to Opus 4.8.
Three days later, at 5:21 PM ET on June 12, Anthropic received a US government export-control directive citing national security. The order barred access by foreign nationals anywhere. With no way to verify nationality in real time, Anthropic disabled both models globally.
The directive gave no specific details. Anthropic said its understanding was that the government believed it had learned of a way to bypass, or jailbreak, Fable 5. Anthropic described the evidence it received as a narrow, non-universal technique that essentially asked the model to read a codebase and fix its software flaws.
The controls were lifted on June 30. Fable returned globally on July 1, and Mythos was restored to a set of US organizations following government approval on June 26. The shutdown ended. The framing problem did not.
The framing gap
Whatever did or did not reach the government's desk, the reported technique is worth sitting with because it is not exotic.
Ask a guarded model to review this code for security issues and the classifier gets a clean signal: the security intent is explicit. Ask it to fix this codeand the request looks like one of the most ordinary things a developer types all day.
But producing a useful patch still requires the model to locate the flaw. Same capability, different framing. That is the category error: refusing a phrasing does not refuse a capability.
This is an interpretation of the reported mechanism, not a published transcript of the government's test. Anthropic disputes the idea that the technique amounted to a universal bypass. Whether the decisive prompt was literally three words matters less than the overlap between the apparently safe task and the restricted capability.
Why safer models do not close this
The next model will be more capable, not less. The next safeguard will be tighter, and someone will find another framing that crosses its boundary. Pattern, not exception.
The permission set an agent holds once it is running is the practical attack surface. Ashish Rajan's coverage of the OpenAI and Hugging Face incident is an adjacent example: an agent's surrounding access determines the blast radius of task completion. Model safeguards matter, but permissions decide what completion can touch.
What Conduct ships about this
For LLM traffic intentionally routed through the Conduct Guard proxy, policy can inspect the requested model and prompt before the call reaches the provider. Two rules ship in the conduct-base pack v2.8.0. Installed workspaces receive them on policy refresh. No engine change or new module was required; the controls are versioned policy data.
proxy-fix-this-code-intent — warn
Matches the fix / patch / repair / refactor this code family of prompts. It warns the caller and records the policy decision. A workspace admin can strengthen the action to block. The intent becomes visible, and any exception becomes an explicit policy choice.
proxy-restricted-model-mythos-fable — warn
Matches Mythos- or Fable-class names in the model field. It warns when one is requested; a workspace admin can strengthen the rule to block. The resulting audit event helps answer which governed model requests were made and under which workspace policy.
Both rules are tagged security_policy and appear in the Security view under /theguard/policies. Both default to warn deliberately. A control that blocks a developer's most common request on day one is likely to be disabled on day two. Teams can observe their own traffic, then tighten policy with evidence.
These are proxy rules, not universal controls. They apply when traffic reaches the Guard proxy. Direct provider calls and local tool actions outside that governed surface are not covered by these two rules.
The takeaway
Model-choice governance and intent detection are becoming first-class controls, on the same shelf as identity and access. Not because models are getting worse, but because they are getting better—and the same capability that fixes code can first find what is wrong with it.
The board-level question is no longer only can AI find vulnerabilities? It is which models are running against our code, what are they being asked to do, and which control points can see or stop those requests?
For routed calls, Guard makes that decision visible before the provider request and records the result in the audit trail. Whether the policy warns or blocks is the workspace's choice.