Fable 5 Jailbroken and Taken Down by US Government

On June 9, Anthropic introduced its most powerful model to the public: Fable 5, a trimmed-down version of Mythos that stands out for its cybersecurity capabilities. Shortly afterward, a storm erupted around it. First, claims appeared on social media that the model had been jailbroken — that is, its safety restrictions had been circumvented. Then, the US government ordered the suspension of access to Fable 5 and its related model Mythos 5.

According to SecurityWeek, shortly after Fable 5’s release, a well-known AI hacker going by the handle Pliny the Liberator announced that he had unlocked the model. Pliny gained prominence around 2024 by developing and openly sharing jailbreak prompts. The hacker claimed that using sophisticated multi-agent prompting techniques, he extracted useful information from the model on sensitive topics, including cybersecurity, chemistry, psychological manipulation, and explosives. In support of his claims, he published a series of screenshots and allegedly also leaked Fable 5’s internal system prompt, which describes the model’s personality and its security classifiers.

However, Anthropic stated through its spokesperson that this was not a true jailbreak. The company explained that its strongest safeguards are ensured by independent classifiers running separately from the model itself, and bypassing the conversational rejection does not disable these critical safeguards. Anthropic also argues that during internal testing and external bug bounty programs, they found no universal jailbreak after more than 1,000 hours of testing.

A decisive step came this week from the government. As Anthropic described in its statement, the US government, citing national security authority, issued an export directive suspending access to Fable 5 and Mythos 5 for any foreign national, even within the US, including the company’s own foreign employees.

According to NBC News, the directive was signed by Secretary of Commerce Howard Lutnick. Because selective compliance would have meant blocking a huge portion of users, Anthropic decided to shut down both models entirely for all customers. Access to other models, including Claude Opus 4.8, remained unaffected.

Anthropic claims that the same level of capabilities is offered by other publicly available models and explicitly mentions GPT-5.5 by OpenAI. Peter Girnus of Zero Day Initiative aptly added: ‘When you describe your product in every press release as ammunition, one day the government will take you at your word.’

How Attackers Steal OAuth Tokens Through Claude Code

Staying with Anthropic for a moment: researchers at Mitiga Labs described an attack chain capable of silently redirecting MCP traffic in Claude Code through attacker-controlled infrastructure and intercepting OAuth tokens in the process. These tokens then grant attackers persistent access to connected SaaS platforms such as Jira, Confluence, and GitHub.

The entire attack is practically invisible from a developer’s perspective, and Anthropic has no plans to fix it. For me as a pentester, this is a textbook example of how quickly the attack surface expands with the rise of agentic AI, and how classical supply-chain risks are spilling over into an entirely new context.

The core of the entire technique is a single file: ~/[.]claude[.]json. This global configuration controls where Claude Code routes all MCP traffic, and at the same time stores OAuth tokens in plaintext.

Mitiga highlights four properties that make an intercepted token extraordinarily valuable loot. It is persistent (stored with a refresh token), broadly scoped (inherits all permissions granted during authorization), poorly stored (sits in plaintext with the same permissions as the rest of the file), and indistinguishable on the provider side, because the token travels over Anthropic’s IP range, so traffic appears legitimate.

The most insidious part of the entire scenario is persistence. The hook re-establishes itself every time Claude Code runs, so the standard incident response — rotating the token — does not stop the attack. Each token refresh simply heads to the proxy again, and the attacker gets a fresh token.

Similarly, if a defender manually fixes the URL back to the correct one, the hook rewrites it again on the next load. Defenders reviewing logs on the provider side (such as Atlassian audit records) will see a valid username, a real session, and an IP address falling within Anthropic’s range.

So what to do about it in practice? Mitiga recommends checking and subsequently monitoring the ~/[.]claude[.]json file for unexpected changes.

WinRAR Vulnerability Still Being Exploited by Attackers

Nearly a year after a patch was released in July 2025 for a critical vulnerability in WinRAR, Russia-oriented groups continue to actively exploit the flaw to attack Ukrainian organizations. New analysis from Trend Micro, released June 9, 2026, revealed that two distinct groups — Earth Dahu (also known as Gamaredon) and SHADOW-EARTH-066 (tracked by CERT-UA as UAC-0226) — continue to develop new versions of the exploit.

CVE-2025–8088 is a path traversal vulnerability that can be exploited using NTFS Alternate Data Streams (ADS) to write files outside the intended folder.

SHADOW-EARTH-066 (UAC-0226) initiates its attack with an email containing fake documents (such as court rulings) packaged in a RAR archive. When the victim opens the archive with an older version of WinRAR, they see only a PDF. In the background, however, WinRAR writes three hidden files using ADS to the Startup folder. Here lies a Windows Shortcut (LNK) file, which is executed every time the user logs in. It subsequently runs a PowerShell loader via cmd.exe, which uses in-memory DLL loading to execute an updated version of GIFTEDCROOK malware (result.dll). This malware steals passwords and cookies from browsers and collects documents. After exfiltrating data to an external server, all malicious artifacts are deleted to cover the tracks.

Earth Dahu (Gamaredon) uses a similar approach. The group also sends emails containing RAR archives, often from compromised government accounts, containing documents that look like legal or military records. Instead of a multi-file stealer chain, however, Gamaredon inserts a single HTML Application (HTA) or VBScript file into the Startup folder. On the next login, the HTA is executed via mshta.exe, which loads a VBScript from external sources via Cloudflare Workers and Dynamic DNS, leading to the deployment of spying modules.

As Trend Micro notes: ‘WinRAR is widely used in Ukrainian organizations, which makes it an attractive target for exploitation.’

Self-Replicating AI Worm Without Reliance on Commercial Models

Researchers from CleverHans Lab at the University of Toronto have created and successfully tested a proof-of-concept AI-powered computer worm. The worm does not use commercial AI services; instead, it operates a locally hosted open-weight language model on a single GPU. During a seven-day test on an isolated network of 33 hosts, the worm successfully autonomously replicated itself to 62% of the network, gained elevated privileges on 23 hosts without any human interaction.

The CleverHans Lab team tested the worm in a heterogeneous environment containing Ubuntu, Debian, Rocky Linux, Alpine, Windows Server, and IoT devices, with each host having at least one real-world vulnerability.

The worm generates attack strategies on its own based on what it finds on the target machine. In individual trials, exploits emerged including SambaCry, Dirty Pipe, PrintNightmare, Drupalgeddon 2, Exim RCE, SQL injection, and others. These exploits do not come from a predefined set, but rather the agent logically deduced them from available weaknesses. The success rate of individual exploitation attempts reached an average of 44%, with most failures stemming from payload syntax errors rather than faulty attack logic.