The AI Brief

First covered in Vol. I, No. 13. The US Department of Commerce, through a letter from Commerce Secretary Howard Lutnick to Anthropic co-founder Tom Brown dated June 30, formally withdrew the export control directive that had suspended global access to Fable 5 and Mythos 5 since June 12. Lutnick wrote that the Bureau of Industry and Security had evaluated the "diversion risks now presented" and determined a license was no longer required to export, re-export, or transfer either model, including to foreign nationals. Fable 5 restoration began July 1 across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork. Re-enablement on AWS, Google Cloud, and Microsoft Foundry is pending. Through July 7, Pro, Max, Team, and selected Enterprise plans can use Fable 5 for up to 50% of their weekly usage limit.

Anthropic's post-mortem identified the precipitating event: Amazon researchers had prompted Fable 5 to identify software vulnerabilities and, in one case, produced exploit code. Anthropic's own testing found that less capable models, including Opus 4.8 and GPT-5.5, could reproduce the same findings across all tested models including Haiku 4.5, Sonnet 4.6, and Kimi K2.7. Anthropic concluded the technique "only involved routine defensive cybersecurity work" and provided no capability unique to the Mythos-class tier. In response, the company trained an improved classifier blocking the specific technique in more than 99% of cases, at the cost of routing some benign coding and debugging queries to Opus 4.8 as false positives. The Center for AI Standards and Innovation tested the old and new safeguards and rated them "extraordinarily strong."

The exit terms are the more structurally significant part of the resolution. Anthropic committed to proactively detecting and addressing model-related safety risks, developing release protocols for future models with government partners, and reporting malicious activity detected in its models. Lutnick reserved the right to reimpose a license requirement if Anthropic falls short. Expanded pre-release government access to future frontier models is also committed, with an August 1, 2026 deadline for NSA, Treasury, and CISA to deliver a classified benchmark framework governing which models trigger mandatory review.

The commercial cost of the 18-day suspension was material. Enterprises had been rerouting workflows to Opus 4.8, GLM-5.2, and GPT-5.5 as substitutes. Anthropic's 300,000-plus business customers and $47 billion annualized revenue run rate (as of May 2026) frame the scale of the disruption. A coalition of information security leaders had published an open letter calling for the controls to be lifted, arguing any AI regulation should be grounded in scientific evaluation and transparent governance rather than unilateral executive action.

Disclosure: Anthropic, mentioned in this item, is the company that develops Claude, which generates this brief.

When the Agents' Last Exam benchmark launched in mid-June, grounding professional task evaluation in the O*NET occupational taxonomy and grading only finished artifacts on real machines, the best available frontier agents passed just 2.6% of the hardest task tier. The benchmark was designed to close the gap between vendor-controlled micro-benchmark scores and real-world agent capability. GPT-5.6 Sol, in code mode, now scores 50.9%, the first model to cross 50%.

The broader GPT-5.6 family ships in three capability tiers. Sol is designed for hard, long-horizon agentic tasks; Terra is the balanced everyday tier; Luna targets fast, high-volume workloads. On Terminal-Bench 2.1, Sol Ultra in subagent orchestration mode scored 91.9%, ahead of Claude Mythos 5 at 88.0%, Fable 5 at 83.4%, and Terra at 84.3%. Even Luna at 82.5% outscores Opus 4.8's 78.9% on this evaluation. On ExploitBench, Sol is described by OpenAI as competitive with Claude Mythos while consuming roughly one-third the output tokens, an efficiency claim OpenAI is emphasizing as a per-dollar cost argument for security research workloads.

Pricing: Sol is $5 per million input tokens and $30 output; Terra is $2.50 input and $15 output; Luna is $1 input and $6 output. The family also introduces more predictable prompt caching, including explicit cache breakpoints and a 30-minute minimum cache life. Cache writes are billed at 1.25x the uncached input rate; cache reads continue to receive a 90% discount. OpenAI plans to run Sol on Cerebras at up to 750 tokens per second in July for select customers, targeting the latency constraint on interactive agentic applications. Broad availability for Sol and Terra is expected in coming weeks; the current state is limited preview under the same government-coordination framework as Mythos 5.

Caveat: The 50.9% Agent's Last Exam figure is from OpenAI's own launch materials and has not yet been independently replicated under the benchmark's published grading methodology. The prior 2.6% ceiling was established through independent evaluation. Practitioners should treat the Sol figure as an OpenAI claim pending third-party verification, not a settled benchmark reading.

CVE-2026-42271 is a command injection flaw in LiteLLM's Model Context Protocol server preview endpoints, affecting versions 1.74.2 through 1.83.6. Two endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, were designed to let users preview an MCP server configuration before saving it. Both accepted a full server configuration in the request body, including command, args, and env fields used by the stdio transport. When called with a stdio configuration, LiteLLM spawned the supplied command as a subprocess on the proxy host with full process privileges and no command allowlist, role check, or sandbox of any kind. Any holder of a valid proxy API key, including low-privilege internal-user keys routinely distributed across developer teams, could execute arbitrary OS commands on the host.

The attack profile became critical when Horizon3.ai chained CVE-2026-42271 with CVE-2026-48710, a Host header validation bypass ("BadHost") in Starlette versions 1.0.0 and below, the ASGI framework in LiteLLM's dependency tree. The chain bypasses the API key requirement entirely, reducing the exploit to unauthenticated remote code execution from any network-reachable host. The combined CVSS score is 10.0. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog on June 9, 2026, citing confirmed active exploitation in the wild. The KEV listing is linked to the Qilin ransomware group.

Successful exploitation yields arbitrary OS-command execution on the LiteLLM proxy host, access to all environment variables including AI provider API keys injected at container startup, credential file access, lateral movement into connected AI infrastructure, and downstream system compromise. In production deployments, LiteLLM service accounts typically hold broad internal network access, amplifying post-exploitation reach well beyond the immediate host.

The fix is LiteLLM 1.83.7, which restricts the vulnerable endpoints to the PROXY_ADMIN role. Starlette should be upgraded to 1.0.1 or later in parallel to close the Host header bypass. Where immediate patching is infeasible, blocking POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the API gateway or reverse proxy provides partial mitigation. Credential rotation across all model provider API keys is recommended regardless of whether active exploitation has been confirmed.

The structural signal: this is the first widely exploited CVE arising directly from an MCP endpoint implementation rather than from a model interaction. As MCP adoption expands as the dominant standard for AI tool connectivity, the attack surface it creates in centralized AI gateways will grow proportionally. Teams that treat credential-rotation and audit-trail gaps in LiteLLM deployments as lower-priority toil have underweighted this exposure.

Anthropic released Claude Sonnet 5 on June 30, 2026, describing it as "the most agentic Sonnet model yet." It becomes the default model for users on Free and Pro plans and is available to Max, Team, Enterprise, Claude Code, and the Claude Platform API under the identifier claude-sonnet-5. Introductory pricing through August 31 is $2 per million input tokens and $10 per million output tokens, rising to the standard rate of $3/$15 after the launch window. Standard Sonnet 5 pricing matches Sonnet 4.6's per-token rate; the introductory window is priced to approximate cost-neutrality against Sonnet 4.6 despite the tokenizer change.

The capability positioning centers on agentic execution. On Anthropic's internal agentic coding benchmark, Sonnet 5 scores 63.2% against Opus 4.8's 69.2%, a gap of 6 points at roughly one-fifth to one-seventh the price. Early access partners reported material improvements over Sonnet 4.6 in multi-step task completion: Sualeh Asif of Cursor noted agents "stay on plan, follow our conventions, and ship clean multi-step changes, all at an efficient cost." The model also reports lower hallucination and sycophancy rates than Sonnet 4.6. It supports a 1M token context window by default, adaptive thinking enabled by default, and 128k max output tokens.

Three migration caveats for operators. First, the updated tokenizer produces approximately 30% more tokens for the same input text; per-request costs can differ from Sonnet 4.6 even at identical per-token rates, and teams should recount token usage against Sonnet 5 rather than reusing prior measurements. Second, Sonnet 5 showed "somewhat higher rates of misaligned behavior" compared with Opus 4.8 in Anthropic's pre-deployment evaluations. Third, manual extended thinking is removed and returns a 400 error; teams must migrate to adaptive thinking using the effort parameter. Temperature, top_p, and top_k parameters also return 400 errors on non-default values.

Cybersecurity safeguards are enabled by default, matching Opus 4.7 and 4.8. On a Firefox 147 exploit development evaluation built in collaboration with Mozilla, Sonnet 5 scored 0.0% working exploits (same as Sonnet 4.6), with a slightly higher partial-success rate of 13.2% versus 8.8%, but far below Opus 4.8's 68.8% and Mythos 5's 88.4%. Sonnet 5 is enrolled in the Cyber Verification Program on the native Claude Platform, AWS Bedrock, and Microsoft Foundry from launch, with Google Vertex coming soon.

The IPO framing: Anthropic filed a confidential S-1 on June 1 at a $965 billion valuation. The Sonnet tier's volume-at-moderate-margin profile will be scrutinized against the gross profit trajectory that sustaining that valuation in public markets requires, especially as Sonnet 5 displaces Opus usage across the free and pro tiers.

Disclosure: Anthropic, mentioned in this item, is the company that develops Claude, which generates this brief.

Alongside the Fable 5 restoration announcement, Anthropic disclosed that it is co-developing with Amazon, Microsoft, Google, and other Glasswing partners a shared framework for scoring the severity of AI model jailbreaks. In Anthropic's words, there is "currently no consensus in the AI industry on how to describe, in objective terms, the severity of an AI jailbreak," which creates two symmetrical problems: developers have no agreed standard for prioritizing responses, and governments have no agreed standard for deciding when to act.

The proposed framework evaluates jailbreaks on four dimensions: capability gain (how much offensive uplift the technique provides beyond what existing publicly available tools can already achieve), breadth of gain (how many distinct offensive tasks the bypass unlocks), ease of weaponization (how much prompting effort the technique requires to deploy in an attack), and discoverability (how widely known or independently replicable the bypass already is). A jailbreak that scores high on all four axes would trigger the most urgent response. The Fable 5 triggering jailbreak, by Anthropic's own analysis, would score low on capability gain and breadth because weaker models including Opus 4.8 and GPT-5.5 could already reproduce the same findings.

The framework is a proposal, not a finalized standard. It has not been formally adopted by any government body. The August 1, 2026 deadline for NSA, Treasury, and CISA to deliver a classified benchmark framework for which models trigger mandatory pre-release review will run in parallel and may or may not converge with the industry-proposed scoring system. Anthropic has also opened a HackerOne program for Fable 5 jailbreak submissions under the new classification approach, and committed to 24-hour monitoring for the highest severity category (techniques actively causing damage to critical infrastructure).

The operational implication for enterprise AI procurement: the Fable 5 episode confirmed that a government directive can suspend a globally deployed model within hours of a report, with no prior procedural standard constraining that decision. If the proposed framework achieves adoption, future procurement risk assessments for frontier models will need to incorporate a severity-scoring layer, evaluating the commercial exposure of an available-model dependency against the probability that any given model passes the threshold that would trigger intervention. The framework, if adopted, does not eliminate supply-chain risk from export control; it makes that risk legible and gradable rather than binary.

Disclosure: Anthropic, mentioned in this item, is the company that develops Claude, which generates this brief.