One AI Got Banned for This Jailbreak — GPT-5.6 Shipped With a Worse One
On 12 June the US government forced Anthropic to switch off its most capable model worldwide — every customer, no notice — over a jailbreak. Eighteen days later OpenAI shipped GPT-5.6, a British government lab found universal jailbreaks giving it autonomous cyber exploit ability, and nothing happened. Same failure, two outcomes.
The Promise
- The same model that finds a vulnerability for an attacker finds it for a defender, and security teams are already using these tools to audit their own code. These are the most capable cyber tools ever handed to a defender.
- The UK AI Security Institute's findings were published in OpenAI's own safety report. The disclosure happened, in public, with a government lab's name attached — that is more transparency than the previous generation of security tooling ever offered.
- The mechanism is knowable and therefore governable. Safety is a second layer trained on top of capability, so 'where does the safety live' is a question any board can ask and any vendor can answer.
The Risk
- The UK AI Security Institute described universal jailbreaks in GPT-5.6 that gave the model autonomous cyber exploit ability — not just spotting a vulnerability, but writing the exploit and running the attack start to finish. That is a more severe gap than the flaw that got Fable 5 pulled.
- Enforcement is discretionary. The Bureau of Industry and Security ordered Anthropic to disable Fable 5 and Mythos 5 after Amazon researchers found a way past the guardrails; eighteen days later a worse finding against a different company produced nothing.
- Safety is a coat of paint over the capability, not a removal of it. A jailbreak is what happens when you scrape the paint, and the capability was always in there.
- Model safety today is the old perimeter model — the guardrail is the wall. Cybersecurity already ran that experiment and the perimeter failed.
The timeline is the story
12 June 2026. The Commerce Department’s Bureau of Industry and Security orders Anthropic to disable Fable 5 and its underlying model, Mythos 5. Worldwide. Every customer. No notice.
The trigger, as reported by Fortune: researchers at Amazon had found a way past Fable’s guardrails. The government treated it as a national security export problem and pulled the plug.
9 July. OpenAI launches GPT-5.6. In the safety report it published, the UK AI Security Institute — a government body — described finding universal jailbreaks in the model. The Institute said those jailbreaks gave the model autonomous cyber exploit ability. Not just spotting a vulnerability. Writing the exploit and running the attack, start to finish.
Same failure. One company shut down by the government. The other, business as usual.
Where the safety actually lives
To see why the government’s response makes no sense yet, you need one idea about how these models are built.
A frontier model learns its capabilities first. The safety comes after, as a second layer trained on top. It is a coat of paint over the capability, not a removal of it.
A jailbreak is what happens when you scrape the paint.
There is a real promise underneath that. The same model that finds a vulnerability for an attacker finds it for a defender, and security teams are already using these tools to audit their own code.
But for a long time cybersecurity was built on the perimeter — a hard shell around the network — and it failed. Model safety today is the old perimeter model, with the guardrail as the wall. Behind it sits a capable, tireless operator available at near-zero price, at machine speed, to anyone who can scrape the paint.
The double standard is the signal
Fable 5 got shut down. GPT-5.6 shipped anyway. If you sit on a board, read that as the real finding: the enforcement is discretionary.
I’ve seen this shape before. The rule arrives for the first company through the door.
Three questions
One. Ask where the safety lives — in the guardrail, or in the capability.
Two. Assume breach.
Three. Stop treating government restriction as a safety rating.
These models are the most capable cyber tools ever handed to a defender, and the most capable ever handed to an attacker. The safety layer is real and it is thin. Build your own governance, because the one arriving from outside will arrive late.
Ask what happens when the guardrail fails. Sooner or later, it will.