Mythos Allegedly Breaches Almost All NSA Classified Systems

The Economist first reported the claim, citing Senator Mark Warner (vice chair, Senate Intelligence Committee), who said NSA and US Cyber Command director Gen. Joshua Rudd told him that Anthropic's Mythos "broke into almost all of our classified systems, not in weeks, but in hours" during an authorized red-team exercise on June 11. The Economist journalist who wrote that line, Shashank Joshi, said on X about a week later that the claim was being widely misread: he had accurately quoted Warner, but "it would be a mistake to read that literally... It surely depends on using Mythos alongside other tools under very particular conditions... it was a mistake not to have added caveats." Other reporting indicates the test ran against a replica of NSA systems, alongside other tools and with engineers present, consistent with a controlled evaluation rather than an unsupervised intrusion into live production networks. Independent forensic confirmation of the full scope was not available, and multiple security researchers publicly challenged the literal framing, noting that the most sensitive classified networks are typically air-gapped, which is difficult to reconcile with an autonomous "break-in... in hours" as literally described; BitGo CEO Mike Belshe was among those who publicly called the viral version of the claim false.

On June 12 at 5:21pm ET, Anthropic received a Commerce Department export-control directive ordering it to cut off all foreign nationals, including its own non-citizen employees, from its Fable 5 and Mythos 5 models. Because it had no reliable way to verify user nationality in real time, Anthropic suspended both models for all users worldwide; access to other Claude models, including Opus 4.8, was unaffected. Per Anthropic's own account, the government's stated trigger was a report, originating with Amazon researchers, describing a technique for bypassing Fable 5's safeguards by asking the model to review a codebase and fix flaws it found. Anthropic said the same prompting pattern elicited comparable output from multiple other models it tested, including OpenAI's GPT-5.5 and several smaller Claude models, and argued that applying this standard industry-wide "would essentially halt all new model deployments for all frontier model providers." The directive also cut off Five Eyes government partners, including the UK's AI Security Institute, without advance warning, according to multiple outlets.

The Commerce Department lifted the export controls in stages: Mythos 5 access was restored for a set of US organizations on June 26, broader controls were lifted on June 30, and Fable 5 returned to global users on July 1 (subject to weekly usage-limit terms), per Anthropic's own account. Anthropic said it had trained an improved safety classifier that blocks the specific reported technique in more than 99 percent of cases, and it is now working with Amazon, Microsoft, and Google to draft a shared industry framework for scoring the severity of AI jailbreaks, an attempt to replace the kind of ad hoc, single-incident judgment call that triggered this directive.

For AI-safety evaluators, this sequence shows that red-team results are only as reliable as the chain that reports them: a real, authorized test produced a headline that its own author disavowed within days, yet the claim still moved a national government to act within hours of surfacing. For security teams evaluating frontier models, it reinforces a recurring pattern: models that can meaningfully assist in finding software vulnerabilities need graded, transparent severity frameworks rather than binary "safe or dangerous" characterizations, since the underlying capability, finding known classes of bugs, is shared across major model providers rather than unique to one lab. For policy-watchers, the durable takeaway is structural: a government can now order a single AI model disabled worldwide within hours of a contested claim, and can reverse that order within weeks once technical review catches up. Accounts differ on the specifics, whether the observed behavior reflected a genuine autonomous intrusion or known-vulnerability discovery under supervised, replica conditions, and that underlying capability question should be treated as contested pending independent forensic disclosure.