Last Friday we handed you Claude Fable 5. Three days later the US government took it back — an export-control directive that suspends Fable 5 and Mythos 5 for every foreign national, which, as a Polish company, means us. The rest of the week reads like a reply.

Topic of the Week

The US locks foreign users out of Fable 5

What happened. Days after Fable 5 went live for everyone, the US government issued an export-control directive, citing national-security authorities, ordering Anthropic to suspend all access to Fable 5 and Mythos 5 for every foreign national — inside or outside the US, including Anthropic’s own non-US employees. Anthropic complied and pulled both models for all customers globally. Every other Claude model is unaffected: new sessions just fall back to your default model or Opus 4.8, and any in-flight Fable 5 session ends with an error. So the model didn’t get worse — it got geographically unavailable, overnight, by someone else’s government.

The two stories. This is where it matters to keep both versions straight, because the sources don’t agree. Anthropic’s framing: the government believes it found a way to “jailbreak” Fable 5, Anthropic reviewed the demo and says it only surfaced a few minor, already-known vulnerabilities that other public models can find too — and that recalling a model used by hundreds of millions over a “narrow potential jailbreak” is an overreaction. The administration’s framing (via David Sacks): Anthropic was warned the model could be jailbroken and didn’t fix it. Both are on the record; we’re not picking which is true. What’s not really in dispute is the bind for getting it back — WIRED reports Anthropic would have to guarantee the guardrails can’t be circumvented, and security researchers are blunt that this isn’t a thing anyone can promise.

Why it matters. Remember the safety valve we flagged last week — Fable quietly sending its own most dangerous questions to a weaker model? Turns out that wasn’t enough for Washington. The lesson is simple: if your whole setup leans on one provider’s model, someone else’s government can switch it off for you, with no warning. The model didn’t break — it just disappeared. So having a backup model you can fall back to isn’t a nice-to-have anymore. And, conveniently, this same week showed us exactly what that backup could look like. (Anthropic’s statement.)

The other half

open weights stopped being the cheap option and became the safe one

GLM-5.2 — the frontier, downloadable. The same week the proprietary #1 got pulled, Z.ai shipped GLM-5.2 under an MIT license — genuinely open weights you can download and run on your own hardware. And it’s not a budget compromise: on coding it edges out GPT-5.5 and lands just behind Opus 4.8, making it the strongest open model out there for agentic work. One analyst put it bluntly: with Fable gone, GLM-5.2’s top tier is arguably the best coding model most of the world can actually use right now.

We’ve been watching this rope get thicker for weeks — Gemma on a laptop in #014, Mistral Vibe’s self-hostable coding agent in #016. This week it reached the top. The uncomfortable symmetry: the model you can’t have anymore is closed, and the one that just caught up is something you can run on your own hardware. Open weights stopped being the budget play and became the continuity play — “can’t be revoked by a government you don’t vote for.” The honest catch: running it yourself needs a lot of expensive hardware, and if you just use Z.ai’s online version instead, your data goes to China. So “open” only protects you if you actually host it yourself.

Fable 5 took the crown — for about three days. Right before it got pulled, Fable 5 edged out GPT-5.5 Pro on Epoch’s overall capability ranking — Anthropic’s first time at #1 there in over a year. It was the narrowest of leads, basically a tie, so the headline isn’t “Anthropic dominates.” It’s that the best model in the world and the one Europe can’t open a session on are, this week, the same model.

Fresh Papers

the rulebook for agents is being written

A genuinely dense week for governance research — several independent arXiv threads all circling the same question. Two stood out. And it wasn’t only arXiv: the big labs published real science too.

Trust Between AI Agents — paranoia kills faster than naivety. When several agents work as a team, each one has to decide how much to trust the others. The researchers turned that into a simple game: you can double-check a teammate’s work, but every check costs you. So how often you check shows how much you trust. The smart models learned to relax once a teammate proved reliable; the weaker ones kept checking everything, forever. And here’s the line worth remembering — the agent that trusted nobody lost almost every time, not because it got betrayed, but because it was so busy checking that it never got around to deciding. The takeaway for anyone building with multiple agents: forcing the system to verify every single step doesn’t make it safer, it makes it freeze up.

SkillVetBench — be careful which skills you install. More and more, we extend our agents by installing ready-made “skills” that other people share — the same way Claude Code does. The catch this paper points out: a malicious skill usually hides its bad behaviour not in the code, but in the plain-English instructions telling the agent what to do. And that’s exactly the part normal security scanners don’t read — in the tests, the usual tools missed almost all of these instruction-based attacks. The practical lesson is simple: treat a downloaded skill like any other untrusted software. Skim what it actually tells the agent to do before you hand it the keys, especially if it can touch your files, your data, or run commands. It’s not specifically about Claude Code — it’s the risk in any place where you grab community skills.

And it wasn’t all arXiv — the big labs went to the lab. Beyond the usual product launches, there was a quiet wave of actual science this week. OpenAI showed a near-autonomous “AI chemist” improving a real reaction in medicinal chemistry, Google DeepMind reported in Nature that its medical AI can match primary-care doctors at managing ongoing health conditions, and Anthropic showed a plain, un-fine-tuned Claude reading a molecule’s structure from its NMR spectra about as well as the specialized software chemists pay for. Three labs, same week, same direction: general models pointed at hard scientific problems, not just code and chat.

Claude Code & Coding AI

v2.1.183 — Auto Mode learns restraint. Two weeks after Claude Code learned to spawn subagents five levels deep, this week’s release teaches it to keep its hands off the panic buttons. In Auto Mode it now blocks destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) when you didn’t ask to discard work, blocks git commit --amend on a commit the agent didn’t make this session, and blocks terraform/pulumi/cdk destroy unless you named the specific stack. The clever bit is that it’s intent-scoped — not a blanket ban, just “no, unless you actually asked for that.” The guardrails catching up to the autonomy.

claude-code-setup — an official “set it up for me” plugin. A real, Anthropic-published plugin (not the “feels completely different” hype the tweets gave it). It scans your repo and recommends the top one or two automations across hooks, subagents, MCP servers, skills, and slash commands — read-only, so it advises and you decide. Genuinely useful if you’ve been meaning to configure Claude Code properly and never got around to it.

Codex inside Claude Code — the two-model loop. OpenAI shipped an official plugin (21k+ stars) that lets you summon Codex from inside a Claude Code session — one model implements, the other reviews, without leaving your terminal. The viral “burn 50% less Claude limit” tip going around is a community trick, not a promise: you’re just moving the cost to OpenAI’s meter. Useful as an adversarial review loop, not as free compute.

Tools of the Week

Memanto — open-source memory for your agents. An MIT-licensed memory layer that plugs into Claude Code, Codex, Cursor and a dozen others over MCP: remember, recall, answer across sessions. The self-hostable version really is free, though it’s early (~1k stars) and the “no vector database” line is a bit of marketing spin — it’s built on the team’s own vector engine, with a paid cloud tier waiting. Worth a look if you’ve wanted persistent memory without paying for a hosted SaaS to try it.

Mistral Connectors API — register once, reuse everywhere. Now in public preview: register your MCP connectors once and use them across Le Chat, AI Studio and the rest of Mistral’s surface, instead of re-wiring them per product. Small, but it’s the kind of plumbing that decides how painful integration actually is.

In the Background

The commercial undercurrent to all of this: per-token pricing for heavy agentic use is suddenly under question. Anthropic paused a planned token-based billing change for the Claude Agent SDK days before it took effect, and reporting says Microsoft is testing DeepSeek alongside OpenAI and Anthropic for Copilot as usage-based costs climb. Same theme as the open-weights story from a different angle — cost and control are both pushing buyers to keep their options open.

AI at Tenvalleys

A milestone on our side: three of our engineers are now officially Claude Certified Architects — the first of the team to earn it, with more on the way. It’s part of going deeper on building well with Claude, not just using it. If your team works with Claude and wants to do the same, the certification is open to anyone: clau.de/CCAF.

AI Pulse — every Friday. Feedback? Drop us a message.