Fable 5 is back. On July 1 Anthropic redeployed the model globally, with Mythos 5 restored to its Project Glasswing partners, after Commerce lifted the export ban. Fable had launched on June 9 and got suspended days later when the controls hit, following a reported bypass that let it generate exploit code. The thing that got it turned back on is worth looking at closely, because it is the same idea security teams have been failing with for twenty years.
Here is the sequence. Amazon showed that Fable's safeguards could be bypassed with a particular way of framing a prompt, which got the model to produce exploit code it was supposed to refuse. Anthropic's fix was to train a new safety classifier that targets and blocks that framing. By their own numbers it catches the technique in more than 99% of cases, and NIST's Center for AI Standards and Innovation tested it and called the safeguards extraordinarily strong. CAISI signing off on a specific fix as the condition for restoring access is new. A government body approving one patch before an AI model could ship again has not happened before.
Notice what the fix actually is. It is a filter that reads the incoming prompt and decides whether the words look like an attack. That is a blocklist. A learned, probabilistic blocklist sitting in front of the model, but a blocklist.
Blocking bad input by recognizing bad input is the oldest mitigation in application security, and it has the longest track record of failure.
SQL injection is the cleanest example. The first defense anyone tried was a denylist of dangerous characters and keywords. Strip the single quotes, block the word UNION, escape the semicolons. It never held. Attackers moved to comment insertion, case variation, hex and Unicode encoding, double encoding, and string concatenation inside the database itself. Every filter got bypassed because the input space is infinite and the number of ways to say the same malicious thing is unbounded. SQL injection did not get solved by a better blocklist. It got solved by parameterized queries, which separate the code from the data so the user's input can never be parsed as a command in the first place. Structure, not filtering.
Web application firewalls tell the same story. A WAF is a signature engine looking for known-bad patterns in HTTP requests. For twenty years attackers have walked around them with the same tricks: URL encoding, chunked transfer encoding, HTTP parameter pollution, padding the payload past the inspection buffer, splitting the attack across fields the WAF parses differently than the app does. A WAF raises the cost of an attack. It has never been the thing that actually stops one, and anyone who has run one in blocking mode knows the other half of the problem. Turn the sensitivity up to catch more attacks and you start blocking legitimate traffic. Turn it down to stop blocking legitimate traffic and you miss attacks. That tradeoff is not a tuning bug. It is the nature of matching against a list of bad patterns.
Cross site scripting, command injection, path traversal. Same arc every time. Input blocklists lose, and the durable fix is always structural: output encoding, prepared statements, allowlists of known-good values, separating the trusted channel from the untrusted one.
So why is Anthropic shipping a blocklist in 2026, when the entire history of the field says blocklists fail?
Because for a language model there is no parameterized-query equivalent, and right now there is no clean way to build one. Prepared statements work because a database has two separate channels, one for code and one for data, and the engine never confuses them. A language model has exactly one channel. The instructions and the data arrive as the same stream of natural language, and the model's whole job is to interpret that stream flexibly. You cannot tell it to treat the system's intent as code and the user's words as inert data, because it has no architectural place to put that boundary. The instruction and the injection are made of the same material.
That is the trap. The one defense with a structural fix, injection into a system with separable channels, is exactly the one a language model cannot use. So you are left filtering the input, which is the defense we already know does not hold.
And the attack surface here is worse than SQL ever was. A SQL injection attacker works within SQL grammar. A jailbreak attacker has all of human language, plus roleplay, plus translation into other languages, plus base64 and every other encoding, plus novel framings nobody has seen yet. There is a research paper with the blunt title, "Jailbreaking Large Language Models in Infinitely Many Ways." That is not marketing. The set of semantically equivalent ways to ask a model for something forbidden is effectively infinite, and a classifier can only be trained on the ones discovered so far.
The most honest line in the announcement is the part about false positives. Anthropic said the new classifier "comes at the cost of flagging benign requests more often during routine coding and debugging tasks." That is the WAF tradeoff, stated plainly. They widened the safety margin to catch the Amazon technique, and the price is that ordinary coding and debugging now trips the filter more often.
Here is the part that gives the whole thing away. When the classifier blocks a request, you get notified and the work falls back to Opus 4.8, the older model. And by Anthropic's own testing, Fable had no unique cyber edge over Opus 4.8 on the capability in question. So the control blocks your coding request on the new model and hands it to a model they say is just as capable at the cyber task anyway. The friction lands on everyday coding. The capability it was supposed to contain is still sitting there in the fallback. That is the export-ban logic all over again, now inside a single vendor's model lineup: the defender doing legitimate work eats the cost, and the thing you were worried about did not actually go anywhere.
The false-positive rate is supposed to get refined over the coming weeks. For now you live with it. Time will tell whether the tuning pulls those false positives back down, or whether a chunk of routine coding just keeps getting handed off to Opus. And the return itself is more hedged than the headline: for most paid plans Fable counts as half usage through July 7 and then moves to pay-per-use credits, enterprise gets nothing included unless credits are on, and cloud access on AWS, Google, and Microsoft is rolling out "as quickly as possible" rather than now.
None of this means the classifier is worthless. A 99% block rate on a known technique is real, and raising the cost of an attack has value even when it does not eliminate it. Constitutional classifiers are a genuinely more sophisticated blocklist than a regex looking for the word UNION. But the shape of the thing is the same, and the shape is what history judges. Anthropic, Amazon, Microsoft, Google, and the Glasswing partners are now building a shared framework that rates each jailbreak on how easy it is to discover and how much extra capability it grants, and Anthropic stood up a HackerOne program to take cyber bug reports. That is a sensible way to run it. It is also an admission that new bypasses are expected, need to be triaged as they arrive, and are not going to stop coming.
We spent two decades learning that you cannot filter your way out of an injection problem, and that the wins came from changing the structure so the attack could not be expressed. AI has handed us an injection problem with no structural fix available and an infinite input grammar, and the industry's answer, reasonably, because there is no better one yet, is a blocklist. It will get bypassed. Then it will get retrained. That is the loop we are in now, and the honest version of the story is that nobody has a way out of it yet.
Jason
---
Sources: Anthropic, "Redeploying Claude Fable 5," Jul 1, 2026; Cybersecurity Dive, "Anthropic reactivates Fable, Mythos after securing government approval," Jul 1, 2026; Anthropic Research, "Constitutional Classifiers: Defending against universal jailbreaks," Jan 2025; "Jailbreaking Large Language Models in Infinitely Many Ways," arXiv:2501.10800.