The National Security Agency is using Anthropic's Mythos 5 to hunt for vulnerabilities in Microsoft's products
That sentence should land differently now than it would have approximately sixteen months ago, when Vice President JD Vance stood in Paris and warned that "the AI future is not going to be won by hand-wringing about safety." After an administration that openly mocked the "doomer industrial complex" took office, the White House is quietly reviving Biden-era pre-release government review of frontier models—the very regime Trump revoked on his first day back in office. What changed? Anthropic shipped a model good enough at cybersecurity offense that the government now believes withholding it from foreign nationals is a matter of national security.
The arithmetic of suspicion runs like this: Anthropic declared Mythos Preview too dangerous for public release in April, according to Stratechery. Eight weeks later, the company shipped Fable 5 to the general public. Three days after that, according to reports, the U.S. government shut down both Fable 5 and Mythos 5, citing export-control authority and an unspecified national security concern tied to a jailbreak. The sequence looks like safety theater—hype a danger, ship it anyway, watch the government validate your warnings—until you map what Anthropic actually built. Then it looks worse, because the safety apparatus and the competitive moat have become the same artifact.
Fable 5 and Mythos 5 are the same model. Anthropic says so in footnotes: identical weights, identical capability ceiling. The only difference is the safeguard envelope. Mythos 5 goes to vetted partners in the government's Project Glasswing and a small group of biomedical researchers across fifteen countries. Fable 5 goes to everyone else, wrapped in classifiers that silently degrade performance when the model detects certain categories of request. The tiering is explicit: one underlying model, two packaged versions, two access regimes. The capability is now table stakes. The control layer is the product.
Here is where the safety becomes indistinguishable from competitive defense. Fable 5's classifiers scan for three risk domains: cyber offense, biology and chemistry, and model distillation. When triggered, the system doesn't refuse—it falls back. The user gets an answer from Claude Opus 4.8, last generation's flagship, with a notice that a safety measure fired. Anthropic reports this happens in fewer than five percent of sessions on average. The user experience cost is real but contained, and the safety logic is at least visible.
The fourth restriction is different. For queries flagged as "frontier LLM development," Fable 5 does not fall back and does not notify the user. Instead, Anthropic's system card describes interventions including prompt modification, steering vectors, and parameter-efficient fine-tuning to degrade model performance on tasks like pre-training pipelines, distributed training infrastructure, and ML accelerator design—without telling the user the answer has been tampered with. Dean Ball, a former White House Office of Science and Technology Policy advisor, called this "secret sabotage safety policy." The model appears to keep working; it just works worse, and you don't know why.
The company that positions itself as the safety leader now sells a product that secretly kneecaps the workflows required to build safety infrastructure outside Anthropic's walls.
Strip the safety framing and you have a capability restriction that lands hardest on exactly the actors Anthropic competes with: open-source labs building training infrastructure, competitors trying to replicate Anthropic's results, enterprises building internal AI pipelines, and independent researchers attempting to evaluate frontier models for safety. The restriction is defensible as diffusion control—if you believe training the next generation of frontier models carries genuine risk, you don't hand out the recipe. But it is also, structurally, a moat. The company that positions itself as the safety leader now sells a product that secretly kneecaps the workflows required to build safety infrastructure outside Anthropic's walls.
The credibility cost shows up in two places. First, among the users who notice. Cybersecurity researchers complained within hours of the Fable 5 launch that the guardrails were triggering on benign requests—code reviews, secure coding best practices, reading blog posts about vulnerabilities. One researcher noted the system appeared to be keyword-based, flagging anything in the "lexical field of cybersecurity" regardless of intent. Another pointed out that asking Fable to write secure code triggered a fallback because the model assumed cybersecurity work instead of software engineering hygiene. The restrictions are real, the safety concern is real, and the user experience is bad enough that the safety reads as commercial overreach.
Second, in the deal terms sophisticated investors are demanding. Google's up-to-forty-billion-dollar Anthropic commitment—ten billion upfront, thirty billion milestone-based, five gigawatts of compute over five years—was reportedly struck at a $350 billion valuation while secondary markets were pricing Anthropic at $1 trillion. That's not a rounding error. It's a sixty-five-percent haircut, and it suggests the smart money sees risk the hype doesn't capture. The obvious reading: regulatory surface area. Anthropic's safety positioning teaches government to fear AI capabilities, and the company that teaches that lesson becomes the first target when those fears mature into policy.
The Trump administration's whiplash is the tell. In February 2025, Vance warned that excessive AI regulation might "kill a transformative industry just as it's taking off" and suggested that companies asking to be regulated were simply trying to crush future competitors. David Sacks, the White House AI and crypto czar, referred to a "doomer industrial complex" enacting a "sophisticated regulatory capture strategy based on fearmongering." By June 2026, the same administration is reportedly creating an AI working group to examine oversight procedures similar to Britain's government review process for new models—the structure Biden's executive order had outlined and Trump revoked on day one of his second term. The pivot happened because Mythos 5 demonstrated cyber capabilities the NSA now uses operationally and the White House believes foreign adversaries will soon possess.
Anthropic didn't invent the risk. The company's 319-page Fable 5 system card documents what it reports as over a thousand hours of external red-teaming, constitutional AI training, and genuine capability evaluation showing the model can autonomously execute complex cyber offense and propose novel biological research hypotheses that in-house scientists preferred eighty percent of the time, with at least one later corroborated by an independent lab. Protein-design experts reported roughly tenfold acceleration in certain workflows. Stripe said Fable 5 compressed a two-month, whole-team Ruby codebase migration into a single day. The capabilities are real, the risks are real, and Anthropic's caution is arguably appropriate.
But so is the competitive effect, and the two are now inseparable. Constitutional AI, tiered access, hidden capability degradation, mandatory thirty-day data retention for Mythos-class models, vetted-partner programs—every piece of Anthropic's safety apparatus simultaneously prevents dangerous diffusion and raises the cost of competitive entry. The result is a credibility paradox: every precaution reads as self-interest, every safeguard as a toll. When Anthropic fights the government over a jailbreak—insisting the technique is narrow, that other publicly available models can find the same vulnerabilities, that there's no evidence of a universal bypass—it sounds like a company defending its commercial roadmap, not a safety-first lab deferring to national security.
The enforceability void makes it worse. This is the same structural problem the Musk-OpenAI litigation exposed: informal safety promises that can't be verified become commercial discretion that can't be challenged. Anthropic's opacity around exactly how Fable 5 degrades performance, which requests trigger which interventions, and how steering vectors alter outputs gives critics the ammunition to reframe every safety measure as anticompetitive conduct. You can't audit what you can't see, and you can't trust what you can't audit.
The investor question is whether Anthropic's regulatory surface area now exceeds its moat value. The company has built something genuinely difficult: a frontier model with safety infrastructure sophisticated enough that the U.S. government relies on it for critical infrastructure defense. That's worth hundreds of billions if the regulatory environment rewards it. But if the Trump administration's doomer moment turns into sustained oversight—pre-release review, export controls, mandatory disclosure of safeguard mechanisms—Anthropic's competitive differentiation becomes a compliance burden every other lab can avoid by simply shipping less safely. The seventy-percent valuation gap between Google's deal and secondary markets suggests investors are pricing exactly that risk.
Anthropic's safety superpower is real. It's also a liability the moment regulators decide that superpower needs to be regulated.