Anthropic Pulls Claude Fable 5 and Mythos 5 After Federal Suspension Order

Key points

• Anthropic received a federal order at 5:21 p.m. ET Friday instructing it to suspend access for foreign nationals.
• Rather than gate by citizenship over a weekend, the company disabled Fable 5 and Mythos 5 for all users.
• The order covers foreign nationals inside and outside the U.S., including those physically on U.S. Soil.
• Nationality is not a standard claim in OIDC scopes or SAML assertions, making targeted enforcement technically hard.
• No reinstatement timeline has been published.

What actually happened

Anthropic killed access to its two flagship models on Friday evening, calling the move an "abrupt disable." The federal order arrived at 5:21 p.m. ET and cited national security. Faced with building a citizenship-gated tier on a weekend timeline, the company chose the blunt path: Fable 5 and Mythos 5 off for everyone, U.S. Citizens included.

We covered Mythos 5's unusual structure when Anthropic shipped it on 10 June: Fable 5 for the public, Mythos 5 for a vetted cohort with safety classifiers lifted. That access architecture now looks relevant in a way nobody anticipated.

Why the auth layer can't easily solve this

The order's scope is notable. It doesn't just catch overseas API traffic; it reaches visa holders and resident aliens physically on U.S. Soil. Enforcing that distinction at the identity layer is harder than it sounds.

Most AI platforms authenticate with email and password or federated OIDC (OpenID Connect, a login standard that lets users sign in through a trusted third party like Google). Neither flow surfaces nationality. Citizenship isn't a claim in any standard OIDC scope, and a typical enterprise SAML identity provider won't assert it in a login response. Compliance would require bolting on a KYC-style verification step, a passport scan or government-ID match returning a nationality attribute, which is a substantial redesign of the signup and session model.

MFA wouldn't have helped here. This is an authorization problem, not an authentication one. Confirming who the user is and deciding whether that confirmed person may legally invoke the model are different problems on different control planes.

Should you worry about token revocation

Existing sessions for both models had to die. Standard OAuth 2.0 token-rotation practice lets a provider invalidate a refresh token server-side and force re-authentication. Anthropic's approach was blunter: killing the model endpoint itself means every outstanding token now hits a dead route, with the same practical result.

Teams with Fable 5 or Mythos 5 wired into production workflows, and Anthropic connected Claude to 28 enterprise security platforms including Okta and CrowdStrike as recently as 28 May, should audit any service accounts or long-lived API keys that were calling those endpoints.

What comes next

Anthropic hasn't published a reinstatement timeline or described what a verified U.S.-persons tier might look like. The obvious path is something resembling the export-control attestations cloud providers already use for restricted regions.

The broader drift is hard to miss. Frontier-model access is moving toward the same regulatory shape as cryptography exports in the 1990s. Identity teams at AI companies should treat nationality and residency as first-class authorization attributes now, because the next order probably won't arrive at 5:21 on a Friday with a weekend to absorb it.

This appears to be the first time a U.S. Agency has ordered a domestic AI lab to cut off model access on national-security grounds. It won't be the last.