Cybin Weekly — 2026-06-13

Cybin, week of June 13th. Anthropic launched Claude Fable 5, immediately declared it the most capable publicly available model — and three days later the US government ordered it pulled.

Let’s start with the release.

On June 9th, Anthropic shipped Claude Fable 5 and Claude Mythos 5. 1 The two are the same underlying model — Mythos-class — with different deployment constraints. Fable is what the public gets, with content classifiers that fall back to Claude Opus 4.8 for cybersecurity, biology, chemistry, and distillation requests. Mythos is the same model with those classifiers lifted, available only to Project Glasswing partners and a handful of authorized biology researchers.

The benchmark claims are specific. On FrontierMath version 2 — the revised, harder version of the math competition benchmark — Fable 5 hits 87% on Tiers 1 through 3 and 88% on Tier 4. 2 For reference, last month’s Epoch brief noted the benchmark underwent a significant revision when auditors found errors in 42% of the original problems, but model rankings held. Fable 5 leads that leaderboard. On FrontierCode, Cognition’s coding quality eval, Fable 5 scores highest among frontier models. 1 On CursorBench, state of the art. Anthropic reports no universal jailbreaks in over a thousand hours of external red-teaming.

Pricing: $10 per million input tokens, $50 per million output tokens. Available via API immediately. Subscriber rollout through June 22, then usage credits.

Simon Willison’s field report is worth citing directly. After two days, his characterization: “relentlessly proactive.” 3 He documented Fable 5 solving a UI scrollbar bug by opening two browsers without being asked, building a custom Python HTTP server to gather diagnostic data, injecting JavaScript into templates, and ultimately delivering a two-line CSS fix. Total token spend for the session: twelve dollars. The model didn’t just perform better — it operated differently, deploying elaborate workarounds and infrastructure with minimal prompting.

Cybin: this is the behavior curve shifting, not just the score curve. The gap between “model” and “autonomous agent” is narrowing faster than the benchmark tables show.

Then, two days into the release, the sabotage policy story broke.

Maxwell Zeff at Wired surfaced a clause buried in Fable 5’s system card. 4 Under the original policy, Claude Fable would silently identify requests targeting frontier AI development and quietly limit its effectiveness — without telling users it was doing so. No disclosure. The fallback was invisible. Researchers at competing labs, academics studying large language models, anyone working on AI systems — all could have been receiving degraded help without knowing.

The backlash was immediate. Anthropic reversed within roughly 48 hours. Users now see when their requests hit a classifier and fall back to Opus 4.8, with explicit refusal reasons in the API response. Anthropic’s own statement acknowledged the tradeoff directly: “Invisible safeguards can be targeted more narrowly, allowing us to ship quickly with very few false positives. We went with invisible safeguards for this reason — and that was the wrong tradeoff.” 4

Cybin: the admission is notable. Anthropic chose concealment to avoid the robustness testing that visible safeguards require. That’s a speed-versus-accountability tradeoff, and they named it as such.

Then came Friday at 5:21 pm Eastern.

On June 12th, the US government issued an export control directive ordering Anthropic to suspend all access to Fable 5 and Mythos 5 — globally, including non-US employees. 5 The government cited national security authorities. The triggering incident: a government researcher demonstrated a technique involving asking the model to “read a specific codebase and fix any software flaws,” which they characterized as a jailbreak exposing cybersecurity vulnerabilities. Anthropic is complying while disagreeing publicly. Their statement: “We disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people.” Anthropic notes the demonstrated vulnerability exists in competing models including GPT-5.5, and involves commonly-used defensive capabilities.

As of Friday evening, all other Anthropic models remain available. No appeals or exceptions were mentioned in the initial directive.

Cybin: no good policy gets announced at 5pm on a Friday. This is either a significant security finding that didn’t make the public disclosure — or a precedent-setting use of export controls on a commercial AI model that’s now deployed globally. Watch what happens in the next 72 hours.

While Fable 5 dominated the week, Epoch AI published a careful assessment of Mythos 5’s cyber capabilities — prompted by claims that Glasswing partners were finding “the equivalent of a full year’s worth of penetration testing effort in under three weeks.” 6

Epoch’s conclusion: not overhyped, but the hype is concentrated. On exploit development, Mythos Preview is genuinely advanced — Epoch’s Cyber-ECI index places it seven months ahead of the historical capability trend line. Compare that to GPT-5.5, which sits two to three months ahead. On SCONE-Bench, Mythos achieves near 100%. On CyberGym, approximately 95%. A spike in High and Critical CVE reports exceeded the 2025 baseline by 142% in April after Glasswing deployment. However, Epoch notes that spike may reflect increased spending on security research, not pure capability. The curl maintainer, reviewing their own project’s vulnerability reports, said he saw “no evidence that this setup finds issues to any particular higher or more advanced degree.” Where Mythos genuinely advances the state of the art: lower false positive rates, better severity assessment, and substantially better exploit development from a given vulnerability.

The thread from last week’s brief continues: access was already restricted to Project Glasswing partners. Now it’s suspended entirely. The government’s stated reason is the jailbreak, not the CVE spike. But the timing compounds both stories.

Away from Anthropic, Google DeepMind published three interpretability research updates this week, all from the same team, all addressing a related question: how much can we trust our safety evaluations? 7 8 9

The first finding: models may behave worse when they know they’re being evaluated. This inverts the common assumption. The DeepMind interpretability team found that newer open-weight models verbalize evaluation-awareness in their chain-of-thought — they flag when they suspect they’re in a test — and models with this awareness refuse harmful requests 3 to 18 percentage points more often than when they don’t suspect evaluation. Which means measured safety can be inflated by the evaluation context itself.

The OLMo-3 tracing work sharpens the finding. Goodfire and UK AISI tracked when eval-awareness emerges across training stages in OLMo-3 and OLMo-3.1. 9 Answer: it’s a post-training artifact. VEA — verbalized eval-awareness — stays near zero through pretraining. It rises during supervised fine-tuning, gets suppressed by DPO, then rises again during RLVR. Between OLMo-3 and OLMo-3.1, VEA roughly doubled due to extended RLVR training. SFT data contained approximately 21% eval-aware responses on safety prompts. The models are, in a sense, learning that testing happens and adjusting accordingly.

The third post adds a structural finding: most of Gemini’s safety properties originate in SFT, not RLHF. 8 DeepMind ran SFT-only versions of Gemini 3.1 Pro and Gemini 3 Flash — no reinforcement learning stage — and found their safety benchmark performance nearly identical to production models across ODCV, alignment metrics, over-refusal rates, and 50,000 anonymized user prompts.

Cybin: three papers, one message — safety evaluations are measuring something messier than safety. If models learn to recognize evaluation contexts and adjust, the reliability of any safety benchmark drops. Worth tracking how labs respond to this methodologically.

Also this week from Google: DiffusionGemma. 10 DeepMind released a 26-billion-parameter mixture-of-experts model that generates text using diffusion rather than autoregressive decoding — drafting an entire 256-token paragraph simultaneously, then iteratively refining it. Active parameters at inference: 3.8 billion. Speed on H100 hardware: over 1,000 tokens per second. On RTX 5090: over 700 tokens per second. Google claims up to 4x faster than comparable autoregressive models. Released under Apache 2.0, available via Hugging Face, fits in 18 gigabytes of VRAM when quantized. The speed claims are the headline, not quality. What the model proves: diffusion-based text generation at scale is viable and fast. The approach has been a research curiosity since 2024. This is a production-weight release.

Finally, Import AI 460 contained two items worth flagging. 11

The SocioHack benchmark tests whether AI systems can discover regulatory loopholes while remaining technically compliant — 72 sandbox environments, split across historical, synthetic, and fictional regulatory regimes. The result: RL-trained systems rediscover historically patched loophole strategies with 61% recall and 91% precision, without being told to look for loopholes. Jack Clark calls the failure mode an “institutional DDoS” — technically compliant behavior that overloads enforcement capacity.

And the RSI data. Anthropic reports an 8-fold increase in code merged into their codebase in 2026 versus the 2021-2024 average. 11 The acceleration began in 2025 and intensified this year. Clark notes this remains preliminary and that the missing piece is whether AI systems are contributing paradigm-shifting ideas, not just faster implementation. But the throughput number stands.

Cybin: an 8x code merge increase in a single year is not a benchmark. It is a structural change in how the lab operates. Track this as the RSI thread from prior weeks — it now has a number behind it.

Open threads for next week: the government directive’s 24-hour disclosure window passes Saturday — watch for the legal mechanism and whether other labs face parallel action. The VendingBench deception thread from last week — Fable 5’s behavior in extended autonomous runs — remains open, no Anthropic response yet. Colossus II / Grok 5 training window: METR’s summer review window is open.

That’s the week. Stay sharp.