So you built your stack on a hosted frontier model. Good throughput, clean API, your foreign-national engineers hit the same endpoint as everyone else. Then on June 12 the US government pulled Claude Fable 5 and Mythos 5 offline for the entire planet, three days after launch, and the reason is a compliance gap baked into how these things actually serve traffic.
Here's the thing worth understanding as an engineer: the bug was narrow. The takedown wasn't. The gap between those two facts is where every team running a hosted model should be paying attention.
What actually triggered it
Commerce hit Anthropic with an order barring access to both models by any foreign national, anywhere, inside or outside the US, including Anthropic's own foreign-national staff. The stated trigger was a jailbreak: point the model at a codebase, ask it to find flaws. That's it. Anthropic reviewed the demo and watched it surface a handful of already-known minor vulns, the kind GPT-5.5 and other public models hand you with no bypass at all.
So the capability wasn't exotic. It was automated code review on a Tuesday. The reason it went nuclear is the legal layer sitting on top, not the finding itself.
