Anthropic Models Defended, FBI Disrupts Phishing, 1Password Acquires Apono

Axios first reported on June 12 that the Commerce Department had ordered Anthropic to suspend all access to Fable 5 and Mythos 5 for any foreign national, including Anthropic's own overseas employees, citing national security authorities. The order followed Amazon researchers prompting Fable 5 to identify software vulnerabilities and, in one case, produce exploit code. BankInfoSecurity reports that subsequent testing undercut the rationale: less capable models, including Anthropic's own Opus 4.8 and GPT-5.5, could reproduce the same results, indicating the technique was not unique to Mythos. More than 100 security-industry figures, including former Facebook security chief Alex Stamos and bug-bounty advocate Katie Moussouris, wrote to Commerce Secretary Howard Lutnick and the National Cyber Director arguing the directive stripped defenders of their most capable tools without a corresponding security gain. BankInfoSecurity reports the Commerce Department lifted the restriction after 18 days: Fable 5 is restored across Anthropic's Claude Platform, Claude.ai, Claude Code and Claude Cowork, Mythos 5 is restored for a vetted set of US organizations, and no export license is now required for either model, including for foreign nationals.

Techzine reports that an international operation involving the FBI, Google and security firm Black Lotus Labs took down Outsider Enterprise, a turnkey phishing-as-a-service platform that supplied fraudsters with domains, phishing pages, campaign management tools, and templates impersonating trusted brands over text message. Google's figures, cited by Techzine, put the network at thousands of fraudulent websites and more than a million malicious URLs, tied to an estimated $1.9 billion in losses and 3.8 million stolen credit card records. The takedown is part of the FBI's broader Operation Riptide targeting cybercrime infrastructure; authorities seized administrative servers, a Shopify storefront, and roughly $100,000 in USDT, and redirected thousands of phishing domains to an FBI splash page. Google has also filed a civil suit against the operators.

1Password acquires Apono for AI-agent access governance: Techzine and SecurityWeek report 1Password acquired Tel Aviv-based Apono in a deal reported at $250-300 million. Apono's just-in-time access platform enforces Zero Standing Privilege, time-boxing access (for example, a 20-minute database session) and requiring natural-language justification for agent access requests, with anomalous actions triggering automatic revocation or administrator review. 1Password is folding Apono into its Unified Access product and launching Credential Broker in closed beta, which surfaces credentials to an agent or user only at the exact moment of need.

The Anthropic reversal is the more consequential signal: export-control-style restrictions on frontier models can now be imposed and rescinded within weeks based on follow-up technical testing, which means teams depending on a specific frontier model for security-sensitive workloads should build in a fallback plan rather than assume continuity. Separately, the Apono deal and the phishing takedown both point the same direction operationally: as AI lowers the cost of both attacking (AI-generated phishing at scale) and defending (agent-aware, ephemeral access control), identity and credential governance - not just model capability - is becoming a primary lever for managing AI-era risk.

Whether Commerce issues written criteria for future model-access orders given the reversal; adoption of ephemeral, just-in-time credential tools like Apono's and 1Password's Credential Broker among teams running AI agents; and whether Outsider Enterprise's operators face charges following the FBI's evidence-gathering from the platform's seized customer-communication channels.