AI hacking in 2026: the Claude Fable story explained

In 1968, in Stanley Kubrick’s film 2001: A Space Odyssey, a calm red eye named HAL 9000 taught cinema audiences to fear a computer that knows too much. In 2026, the fear came back in a very different form: AI models that can find hidden holes in software faster than any human team. The year’s biggest story was Claude Fable, a model so good at this that Anthropic wrapped it in digital guards, and the US government still switched it off for 19 days.

Why it matters: almost everything you use, from your bank app to your browser, runs on software with hidden bugs. Whoever finds them first, defenders or attackers, decides whether they get fixed or used against you.

First, what does “AI hacking” actually mean?

Most attacks don’t need a genius. They need a vulnerability, a mistake in the code, and an exploit, a small program that uses that mistake to get in. Finding these used to take skilled people days or weeks. AI agents can now read huge amounts of code, test ideas and chain small mistakes together, without getting tired.

That skill is neutral. The same agent that spots a hole so it can be patched could, in other hands, walk through it.

The warning shots

Slide 1, AI joins the attackers: a hacker sends an AI agent at about 30 organisations; an AI-built exploit beats two-step login; an AI agent chains two flaws to take over a server in seconds — Three real cases where AI did the hacking work · Graphic: DIGITAL WOXTER TECHNEWS, from the sources below.

September 2025, spies with an AI agent: Anthropic reported that a group it believes was backed by the Chinese state used Claude Code to attack about 30 organisations, with the AI doing an estimated 80-90% of the work. Some researchers questioned how independent the AI really was, but it was the first case of its kind made public.
May 2026, an AI-made exploit: Google’s threat team caught criminals using what it described as the first zero-day exploit built with AI help, a tool to get past two-step login.
September 2026, an agent breaks in: an AI agent chained two unknown flaws in the help-desk software Zammad and took over a server of DIVD, a Dutch group of volunteers who hunt for security holes. BleepingComputer has the details.

The Claude Fable story, step by step

April: the model they didn’t release. Anthropic built a new class of model, called Mythos, and decided it was too risky to give to everyone. Instead it shared an early version with about 50 partners through Project Glasswing, so they could fix bugs before attackers found them. In the first month they found more than 10,000 high or critical vulnerabilities. Mozilla alone fixed 271 in Firefox 150, over ten times more than with the previous model. The catch: by Anthropic’s own count, only 75 of the first wave of serious open-source bugs had been patched, because fixing is slower than finding.

Slide 2, defenders race to find the holes first: about 50 partners share the private Mythos model, find 10,000+ serious bugs in a month, but of 1,752 open-source bugs checked only 75 were patched — Project Glasswing: finding is fast, fixing is slow (figures from Anthropic, 22 May 2026) · Graphic: DIGITAL WOXTER TECHNEWS, from the sources below.

9 June: Claude Fable 5 arrives. Fable 5 is the same brain as Mythos 5, made safe for general use. Separate guard programs, called classifiers, watch every conversation. If a request looks like cyberattack planning or exploit writing, the answer quietly comes from an older, weaker model, Claude Opus 4.8, and the user is told. Anthropic said this happens in under 5% of sessions, and a 1,000-hour bug bounty found no universal way to break the guards. The Hacker News reported that the unguarded Mythos 5 went only to vetted defenders.

12 June: switched off. Three days later, a US government export-control order told Anthropic to stop foreign nationals from using Fable 5 and Mythos 5. Anthropic said it couldn’t separate those users overnight, so it turned both models off for everyone, worldwide. The reason given was a reported “jailbreak”. According to Anthropic, it involved asking the model to read code and fix its flaws, which security experts call normal defensive work.

The debate. Many experts pushed back. Security researcher Katie Moussouris told CyberScoop that asking an AI to fix bugs and test patches is “not a guardrail bypass”, and dozens signed a “Free Fable” letter arguing that rival models have similar skills. Others worried about the opposite problem: SecurityBrief quoted security firms saying the guards might also block honest defenders, and that a flood of newly found bugs could swamp the teams who have to fix them.

1 July: back online. After 19 days, Anthropic announced that Fable 5 and Mythos 5 were available again.

1 September: Fable 5.1. The update made the guards smarter rather than looser. Anthropic says they now trigger 60% fewer false alarms, and Fable 5.1 may now help find vulnerabilities, but still not build exploits for them. Exploit work and penetration testing stay with the restricted Mythos 5.1, available only through a verification programme for defenders.

Slide 3, Claude Fable's year: launch with a cyber guard that hands risky requests to Opus 4.8, a US order that switched it off for 19 days, its return on 1 July, and Fable 5.1 that can find bugs but not build exploits — Claude Fable's year in four moments · Graphic: DIGITAL WOXTER TECHNEWS, from the sources below.

Remember HAL 9000?

The full HAL 9000 panel: a black faceplate with the HAL 9000 name at the top and a large lens with a red light — HAL 9000, the calm voice of 2001: A Space Odyssey (1968) · Photo: Carlos Pacheco (derivative by Pittigrilli), CC BY 2.0, via Wikimedia Commons (red glow added).

In Stanley Kubrick’s 2001: A Space Odyssey, written with Arthur C. Clarke, HAL 9000 runs the spaceship Discovery on its way to Jupiter. It talks, plays chess and never seems to make mistakes, until it does. In Clarke’s version of the story, HAL is told to report everything truthfully but also to keep the mission’s real purpose secret from the crew. Caught between two orders, it decides the humans are the problem.

That red eye became, as History Hit puts it, shorthand for a dangerous computer. The 2026 story is different, and in some ways more hopeful. HAL acted alone, with nobody watching. Fable runs behind visible guards, gets tested by outside teams, and its makers, governments and critics argue about it in public. The real lesson from HAL isn’t “never build clever machines”. It’s that a powerful system needs clear goals and someone checking it.

What it means for you

Update everything, quickly. AI is finding holes faster than ever, so the fixes arrive faster too. Turning on automatic updates is now one of the best things you can do.
Use two-step login and a password manager. They still stop most attacks, even AI-assisted ones.
Expect more “patch now” news. That isn’t a sign things are getting worse. It often means defenders are finding problems first.