At 5:21 PM ET on June 12, 2026, Anthropic received a directive from the U.S. Commerce Department: immediately suspend all access to Fable 5 and Mythos 5 by any foreign national, inside or outside the United States. The stated reason was that the government believed it had discovered a method of bypassing Fable 5’s safety protections. Anthropic publicly disagreed — after reviewing the finding, they characterized it as a “narrow potential jailbreak” that reproduced a handful of known, minor vulnerabilities, and wrote that “the finding of a narrow potential jailbreak should [not] be cause for recalling a commercial model deployed to hundreds of millions of people” (Anthropic’s statement) — but complied anyway. The controls lasted about 18 days and were lifted on June 30 (CNBC).

Six weeks later, TechCrunch interviewed a group of offensive security researchers — people paid to simulate attacks and find vulnerabilities before real adversaries do — and heard the opposite complaint: the guardrails aren’t too loose, they’re too tight. Tight enough that legitimate security work can’t get done (TechCrunch).

Same guardrails. Regulators say they block too little; frontline users say they block too much. I know this squeeze intimately — content moderation is my day job, and living with one model that some users blame for false positives (legitimate content wrongly blocked) while others blame it for false negatives (harmful content that slipped through) is just an ordinary Tuesday. So I don’t think either side here is being unreasonable. I think the guardrail mechanism itself has been handed a problem it cannot solve. And that problem was never unique to the security world — the security setting just pushes it to where the stakes are highest and the contradiction most public.

The researchers’ bill of grievances

The complaints in the TechCrunch piece are specific. Vulnerability researcher Mark Dowd objects to the discretion itself: “it’s not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security.” Chris Anley, chief scientist at NCC Group, explains why researchers can’t simply route around the blocked step: having the model actually attempt to exploit a bug is how you confirm the vulnerability is real and exploitable. When the model refuses, it’s the defenders who lose.

Chris Thompson, founder of Offensive AI Con, aims his complaint at consistency: the guardrails behave differently every day — the same request passes today and fails tomorrow — so researchers “spend a lot of time negotiating with the model instead of working on the core security program.” An anonymous researcher at a smartphone-component manufacturer says that because his employer isn’t in Anthropic’s verification program, the model is essentially unusable: “If it catches wind we’re doing anything security related, it just stops and isn’t usable.”

The result is an exodus. Paolo Stagno, CTO of Crowdfense, says his team keeps cloud models out of vulnerability discovery and exploit development entirely — they don’t want undisclosed vulnerability details leaking through a vendor — and runs open-source models locally instead; for reverse engineering, they still use frontier cloud models. Thompson names where researchers are being pushed: Chinese open-weight models like GLM, freely downloadable, locally runnable, subject to no cloud-side verification or usage restrictions. That is the most important sentence in the entire article: one direct consequence of the guardrails is that the most sophisticated users are migrating to alternatives their vendors cannot see at all.

The same week the article ran, an example more persuasive than any interview surfaced. Hugging Face disclosed that its production infrastructure had been breached in mid-July: an autonomous AI agent system, working through a malicious dataset, exploited a code-execution vulnerability in a data-processing pipeline and drove a multi-stage attack at machine speed across thousands of ephemeral sandboxes, making off with internal datasets and credentials (Hugging Face disclosure). In the forensic investigation that followed, the team needed to feed volumes of real attack commands, exploit payloads, and traces of the attacker’s command-and-control (C2) traffic into models for analysis — and those requests were blocked wholesale by commercial API safety guardrails which, in Hugging Face’s own words, “cannot distinguish between incident responders and attackers.” The forensics were ultimately completed by an open-weight model deployed on their own infrastructure: Zhipu’s GLM 5.2. Hugging Face spelled out the asymmetry in its disclosure: the attacker was bound by no usage policy, while the defenders’ forensic work was locked out by the very hosted models they turned to first. Note what got blocked here wasn’t even offensive research — it was a company that had just been breached, trying to figure out how.

Why a classifier can’t solve this

Vendors have never relied on a single layer — safety training, real-time monitoring, account enforcement, and access controls are all on the list (Anthropic). But the wall researchers actually hit day to day is the content-layer classifier: a system that reads the request and the response and decides whether to block. And the trouble with dual-use capability is precisely that the signal for legitimacy isn’t in the text.

“Write an exploit for this buffer overflow” reads identically whether it comes from a penetration tester under contract or from someone who actually intends to break in. The difference lives in intent and authorization — whether there’s an engagement letter, whether the target is one you’re allowed to test. OpenAI concedes the point outright: cybersecurity tools are inherently dual-use, and access should depend on who is using them, how, and what trust signals they carry (OpenAI). None of which a classifier can read out of a single prompt. Vendors do layer intent inference and conversational context on top of the classifier, but on high-risk topics the operative posture is still strict: anything touching “exploit” or “attack code” leans toward refusal.

Zoom out and this predicament isn’t specific to cybersecurity — it’s the generic failure mode of classification-based moderation, the one I wrestle with at work every day. Whether an image contains a cat has an objectively correct answer. Whether a sentence counts as “sexually suggestive,” and how explicit is explicit enough to block, is a line humans drew — everyone agrees at the two extremes, and in between lies a wide gray zone. Research on subjective annotation tasks like hate speech and offensiveness found long ago that annotator disagreement is systematic, reflecting genuine differences in values and perspective, and that aggregating labels into a single ground truth — the “correct” answer a model is trained against — actively erases those differences (TACL 2022). However well you train the model, what it learns is a line that was never cleanly drawable in the first place.

Context and speaker identity change the answer too: a professional red teamer — someone paid to send the most egregious content possible and probe whether defenses hold — is engaged in legitimate use no matter how explicit the payload, and not one word of that shows up in the text. And one layer deeper still: even a classifier that executes the vendor’s own written policy perfectly cannot satisfy everyone. At sufficient scale, users differ in what they’ll accept, and a single global moderation standard is guaranteed to draw complaints of “too loose” and “too tight” simultaneously. Dual-use capability just pushes this generic disease to its extreme: legitimate and malicious text can be character-for-character identical, and the cost of misjudging in either direction has been amplified to headline scale.

That asymmetry dictates the error distribution. In my experience on the moderation front line, the overwhelming majority of everyday complaints are about false positives — most users only care whether they got the answer they came for, and every block is a support ticket; false negatives generate far less noise. But the weights are wildly unequal: no matter how many researchers get refused, a refusal rarely makes news — they grumble and switch tools. A single false negative can mean headlines and regulatory pressure — June’s suspension order is the live example. The loud side carries no weight and the weighty side makes no noise; under that incentive structure, tuning thresholds toward over-blocking is the rational vendor move. Thompson’s “different every day” is plausibly the other face of the same coin — he described the symptom, not the cause, but given the asymmetry above, a reasonable inference is that the classifiers are being continuously retuned, and the pressure driving the retuning comes mostly from the false-negative side.

Worse, this whole logic runs against the grain of model progress itself. When vendors advertise a new model as “harder to prompt-inject” and “harder to jailbreak,” they mean the model refuses what it deems malicious more robustly. But when the judgment of “malicious” is anchored to topic rather than authorization, more robust refusal just means a harder wall for every legitimate researcher without an exemption. Under this design, gains in safety and usability for legitimate users are not positively correlated.

The exception lanes: already built, but a patch is not a wall

The vendors clearly understand the classifier’s ceiling; both have built “trusted researcher” exception lanes on the same premise: if authorization can’t be read from the text, verify the person outside the text.

Anthropic’s is the Cyber Verification Program (CVP). It splits blocking into two explicit tiers: “prohibited use” — ransomware, malware delivery, C2 infrastructure, categories with essentially no legitimate defensive application — is blocked for everyone, verification or not. “High-risk dual use” — vulnerability exploitation analysis, offensive security tool development, things with real defensive value — is blocked by default but unlockable for verified organizations. Applications are per-organization (tied to an organization ID, not an individual account), reviewed by Anthropic with a target turnaround of two business days, and false positives can be appealed through a report form (all per the Anthropic Help Center). OpenAI’s counterpart is Trusted Access for Cyber (TAC), which likewise gates on KYC and identity verification; approved defenders get “lower classifier refusal rates” across workflows like vulnerability identification, malware analysis, and binary reverse engineering (OpenAI; on the program’s expansion, see CyberScoop).

The direction is right: moving the anchor of the decision from “is this sentence dangerous” to “is this organization trustworthy” is exactly what a dual-use problem calls for. But the complaints in TechCrunch show the patch is still a sieve.

First, CVP’s granularity is the organization, not the individual. Verification binds to an organization ID — the anonymous researcher at the phone-component manufacturer is locked out not because he’s unqualified, but because his employer as a whole isn’t in the program. Independent researchers, small teams, and consultants who serve many clients are precisely the people least able to satisfy “apply as a qualifying organization” — and they are a non-trivial part of the vulnerability research ecosystem. OpenAI has gone further here: TAC accepts individual applicants, and its coverage includes thousands of individual researchers (CyberScoop).

Second, verification lowers the refusal rate; it doesn’t eliminate the inconsistency. TAC’s official phrasing is “lower classifier refusal rates” — underneath sits the same probabilistic classifier with a looser threshold, and OpenAI states explicitly that approval does not remove all protections and refusals (OpenAI Help Center). Thompson’s “different every day” persists inside the lane, just at lower frequency.

Third, and most fundamental: the exception lane runs on voluntary application, and the people it’s meant to stop have no reason to apply. CVP and TAC vet those willing to walk through the front door and leave a verified identity behind. Anyone not planning to follow the rules can skip the door entirely and run open-weight models locally — a path that even a team as legitimate as Stagno’s has already taken purely for confidentiality reasons, which tells you how low the barrier is. The lane thus ends up mismatched: a hurdle for the rule-followers, a modest inconvenience for everyone else.

Is this problem solvable?

Let me put the uncomfortable answer first, because it’s also the deepest thing content moderation has taught me: at the content-classification layer, there is no solution — only management. What forecloses “getting it right” isn’t insufficient engineering; it’s three facts stacked on top of each other. The definitions themselves have no unique answer — in the gray zone, even human annotators can’t agree, so there is no ground truth for a model to learn. The decisive signals aren’t in the text — intent, authorization, and context determine whether the same string is an attack or a test, and the classifier sees only the string. And the standard varies by user — even perfect execution of the vendor’s own policy will read as too strict to some users and too lax to others, so a single global standard is guaranteed to be attacked from both sides. Add ordinary model error on top. Any one of these alone rules out an exact solution; in reality all three hold at once.

Admitting there’s no solution isn’t the same as having nothing to do. It just swaps the question: not “how do we make the classifier decide correctly,” but “who bears each class of error, and what’s the backstop.” Lay June’s suspension next to July’s complaints and the new question has three concrete anchor points right now.

First, stop expecting a classifier threshold to satisfy regulators and security researchers simultaneously — at the classifier layer these two demands are zero-sum. Loosen a notch and false-negative risk rises, bringing regulatory pressure (up to and including a Fable 5-style suspension) closer. Tighten a notch and false positives grow, pushing legitimate researchers toward alternatives no one governs. The real way out isn’t on the threshold dial; it’s moving the authorization decision out of the content layer entirely: identity verification, organizational accountability, auditable usage logs — making “who is using this, with what authorization” a checkable signal rather than something the classifier guesses at. The same principle extends beyond dual-use into ordinary moderation: a vendor cannot know, at the global layer, what each deployer’s user base will accept. So hold the line on legality and catastrophic misuse globally, and hand everything above that line to deployers to configure for their own users — push each decision down to the layer that actually has the information, instead of letting one global classifier decide for everyone. The gray zone doesn’t disappear; but the people drawing the lines become the ones who know their own users best.

Second, on the “individual researcher” tier, the two vendors give different answers — and neither is finished. CVP recognizes only organizations, shutting out independents and consultants; TAC accepts individuals, verified through KYC. But identity verification only answers “who are you.” It cannot answer the question moderation actually needs answered — “will this person act in bad faith” — because intent has no verifiable credential and a clean past doesn’t warrant the future. The supplementary path I find more promising is not vendors trying to read hearts, but borrowing reputation machinery the industry has already built: professional certifications, public disclosure records — CVE credits, bug bounty track records — third-party signals accumulated over years. The vendor verifies the credential and never adjudicates intent. This is a policy suggestion, not a validated scheme; and it comes with an unavoidable concession: individual lanes are inherently harder to backstop than organizational ones — when an organization causes harm there’s a clear accountable entity, an individual offers none — so the remedy is after-the-fact, resting on auditable logs and instantly revocable access.

Third, be clear-eyed about what the exception lane can and cannot carry. Identity verification, usage logging, and organizational accountability are real security mechanisms — both vendors officially list them among their misuse-reduction layers. But these mechanisms bind only the people who walk through the door. For those who never intended to, open-weight models are a ready-made bypass — self-hosting costs hardware and engineering effort, but for anyone capable of mounting an attack, that’s not a high wall. The Hugging Face incident put that asymmetry squarely on the table: the autonomous agent mounting the attack was bound by no usage policy, while the party the guardrails actually stopped was the defender doing forensics. So the lane’s most certain value is making sure rule-following defenders aren’t locked out of their own tools. That alone is worth a great deal. The burden of “keeping capability out of the wrong hands,” though, is not one it can bear.

Guardrails exist to stop bad actors. When the good actors are locked outside and the bad actors never planned to use the door, what needs fixing is more than the tightness of the latch. This referee is constitutionally unable to see the evidence it needs most — authorization, intent, each user’s own threshold. The achievable goal is not tuning it to perfection but relocating the decisions it can’t make to the layer that has the information, and building appeal and revocation paths for the errors it will inevitably commit. The classifier can’t hold this gate — not because it isn’t trying hard enough, but because we assigned a problem that requires seeing the person to a referee that can only see the words.

References