AI Security Crisis 🚨: Experts Demand Action! 🚀

THE CALL FOR RELAXATION: A CYBERSECURITY URGENCY
A coalition of over 76 cybersecurity experts, including prominent figures like Alex Stamos and Casey Ellis, have issued a formal open letter to the U.S. government, advocating for the immediate lifting of the export control order placed on Anthropic’s Fable and Mythos AI models. The core argument centers on the detrimental impact of the restriction, claiming it effectively deprives cybersecurity defenders of crucial tools needed to identify and mitigate vulnerabilities within software and products, ultimately hindering efforts to improve security. The letter emphasizes the perceived imbalance, arguing that restricting access to advanced capabilities without a justifiable national security rationale is a dangerous precedent, particularly given the rapid advancements made by adversaries.

THE GOVERNMENT’S RESPONSE AND ANTHROPIC’S REACTION
On Friday, the U.S. government mandated that Anthropic limit the export of Fable and Mythos, citing national security concerns. Critically, the government provided no specific justification for this action, a point Anthropic immediately seized upon. In response, the company took the drastic step of suspending access to both models for all users globally. This immediate reaction underscores the severity of the perceived threat and the urgency surrounding the situation, highlighting a lack of transparency from the regulatory body.

MYTHOS AND FABEL: POWERFUL MODELS AND RESTRICTED ACCESS
The launch of Mythos as a preview model in April immediately generated considerable attention within the cybersecurity community. Anthropic asserted that Mythos possessed an unparalleled ability to discover security vulnerabilities, necessitating stringent access controls to prevent misuse by malicious actors or foreign governments. Initially, approximately 50 companies received access to Mythos, later expanding to around 150 organizations across 15 countries. Subsequently, Anthropic released Fable, a public version of Mythos, incorporating strict guardrails designed to prevent its use in fields like biology, chemistry, and cybersecurity, and to discourage model replication. These guardrails proved so restrictive that many cybersecurity experts found them effectively blocking any prompts related to security analysis.

THE AMAZON PAPER AND THE JAILED “FIX” METHOD
The imposition of the export control order was reportedly based on a research paper from Amazon, detailing a method for “jailbreaking” Fable – unlocking its Mythos-level capabilities. However, the details of this paper remain confidential, reviewed only by individuals like Katie Moussouris. Moussouris, a key signatory of the open letter, clarified that the paper did not demonstrate a fully functional jailbreak. Instead, Amazon researchers presented a scenario where Fable refused to identify vulnerabilities in open-source code containing known flaws, prompting the model to attempt a “fix.” This process, Moussouris argues, isn’t a genuine bypass but rather a demonstration of the model’s potential—the ability to execute the crucial “find, fix, and test” loop that defenders routinely employ.

MISINTERPRETING DEFENSIVE AI CAPABILITIES
Moussouris’s critique highlights a fundamental misunderstanding of how AI can benefit cybersecurity. She contends that the ability for an AI model to fix open-source code, explain the fix, and write tests to verify its effectiveness represents the most valuable defensive capability—a practical application of the core workflow used by security professionals daily. The behavior described in the Amazon paper, according to Moussouris, cannot be meaningfully addressed with current guardrails and any attempt to do so would only weaken the model.

BROADENING THE THREAT MODEL: COMPATIBILITY WITH OTHER MODELS
The concerns extended beyond Fable, with the open letter suggesting that the “jailbreak” method demonstrated by Amazon could be replicated across other prominent AI models. Specifically, the letter raised concerns about GPT-5.5, Anthropic’s Claude Opus 4.8 and Sonnet, as well as Chinese models like Kimi 2.7. This broadening of the threat model underscores the potential vulnerability of a wide range of AI systems, regardless of their intended purpose or origin.

CALLING FOR TRANSPARENT REGULATION
Ultimately, the open letter advocates for a fundamentally different approach to AI regulation. The signatories demand transparent and fairly enforced regulations developed through a democratic rule-making process, grounded in scientific research conducted by industry and academic experts, and applied only to the minimum extent necessary to ensure public safety. This calls for a shift from reactive, security-focused controls to a more proactive and collaborative framework that leverages the expertise of the cybersecurity community.