Sam: Anthropic's Fable 5 is back. After eighteen days under a US government export control ban triggered by a jailbreak discovered by Amazon researchers, Anthropic deployed a new safety classifier that blocks the exploit in over 99% of cases, and the ban was lifted. But here's what caught my attention: Anthropic pointed out that even Claude Haiku 4.5 — a much smaller, cheaper model — could execute the same jailbreak. Which raises a pretty fundamental question about whether export controls that target specific model tiers actually make sense when the vulnerability exists across the capability spectrum.

Priya: Welcome to AI Revolution for Wednesday, July 1st. I'm Priya Nair, here with Sam Kim, and we have a packed show today. We're going to dig into the Fable 5 ban and what it tells us about the emerging regulatory playbook for frontier AI. We've got Meituan training a 1.6 trillion parameter model entirely on Chinese chips — no Nvidia hardware at all. Anthropic launched Claude Science, a new product for scientific research. Claude Sonnet 5 dropped with some interesting benchmark results and a hidden cost story. And we'll cover a new attack on AI browsers, Etched's billion-dollar chip milestone, and a hacker who used Claude to break into a major ticketing platform. Let's get into it.

Sam: So let's start with Fable 5. The timeline here matters. Amazon researchers find a jailbreak. The US government responds by invoking export controls — essentially pulling the model from international availability. Anthropic has eighteen days to fix it, deploys a classifier, and gets reinstated. The classifier works: over 99% of jailbreak attempts are caught. But there's a tradeoff. The classifier also increases false-positive rates on harmless requests. So legitimate users are getting flagged more often.

Priya: And this is a real engineering tradeoff, right? When you're building a safety classifier, you're essentially drawing a decision boundary. You can tune it to catch more bad stuff, but you inevitably catch more good stuff too. That's the fundamental precision-recall tradeoff. Anthropic chose to prioritize recall — catch almost everything — knowing they'd eat the cost in user experience.

Sam: Right, and the 99%-plus number sounds impressive, but think about what the residual means at scale. If you're serving billions of requests, even a fraction of a percent getting through is millions of successful jailbreaks. And on the other side, even a small false-positive rate means millions of legitimate requests getting blocked or delayed.

Priya: The bigger story here is the precedent. This is the first time we've seen a government pull a frontier model from global deployment over a specific discovered vulnerability and then reinstate it after a fix. That's a new regulatory pattern. It's closer to how we handle, say, aircraft safety — ground the fleet, fix the issue, return to service — than anything we've seen in software regulation before.

Sam: And Anthropic's point about Haiku 4.5 is strategically important. They're essentially arguing that capability-tier-based regulation doesn't map well onto actual risk. If a small model can do the same dangerous thing, banning the big model doesn't actually reduce the threat surface. It's a real argument, and regulators are going to have to grapple with it.

Priya: Let's shift to something that has huge geopolitical implications. Meituan — which most people know as a Chinese food delivery and services company — just trained LongCat-2.0, a 1.6 trillion parameter model, entirely on Chinese-manufactured chips. No Nvidia hardware anywhere in the training run.

Sam: This is significant because the entire logic of US export controls on advanced GPUs was built on the assumption that restricting access to Nvidia's top-tier chips would meaningfully slow China's ability to train frontier-scale models. And look, 1.6 trillion parameters is genuinely frontier-scale. We don't have full benchmark comparisons yet, so we can't say how the model quality compares to Western frontier models. But the fact that they completed the training run at all is the headline.

Priya: The question I keep coming back to is efficiency. Even if Chinese chips are less performant per unit than Nvidia's best, if you can compensate with volume and clever systems engineering, you get to the same place. It just costs more and takes longer. And the export control strategy assumed that cost and time penalty would be prohibitive. This result suggests it wasn't.

Sam: It also tells us something about the maturity of China's chip fabrication ecosystem. Training a model at this scale isn't just about having chips that can do matrix multiplications. You need interconnects, memory bandwidth, software stacks for distributed training, fault tolerance across thousands of devices. The whole stack has to work.

Priya: Now let's talk about Anthropic's busy week. They also launched Claude Science, which is essentially the scientific research equivalent of Claude Code. This was announced at an event for pharmaceutical and biotech executives, and the positioning is very deliberate.

Sam: Claude Science has over sixty preconfigured skills spanning genomics, computational chemistry, and other research domains. The interesting architectural choice is that it includes a verification agent that automatically checks citations and calculations. So it's not just generating analysis — it's building in a self-auditing step. That matters enormously in scientific contexts where a hallucinated citation or a miscalculated p-value can derail months of work.

Priya: And the deployment model is noteworthy. It can run locally or on HPC clusters within a lab's own infrastructure. For anyone in pharma or biotech, you know that data sovereignty is non-negotiable. Patient data, proprietary compound data — none of that can leave your environment in most regulatory frameworks. So Anthropic designed this to work entirely on-premises. That's a real product decision, not just a feature checkbox.

Sam: The broader pattern here is AI companies building domain-specific agentic products rather than just offering general-purpose APIs. Claude Code for engineering, Claude Science for research. Each one has domain-specific tools, verification mechanisms, and deployment models tailored to the constraints of that field.

Priya: Meanwhile, Sonnet 5 dropped, and there's a nuance here that I think a lot of people will miss. On the surface, it looks great. It scores 1,618 on GDPval-AA v2, which actually edges past the larger, more expensive Opus 4.8 on knowledge work tasks.

Sam: But the cost story is more complicated. The list price per token is identical to its predecessor, Sonnet 4.6. Sounds like a free upgrade. Except that Sonnet 5 consumes roughly 40% more tokens per task. It's more verbose in its reasoning, it generates longer chains of thought. So your actual API bill for the same workload goes up significantly — potentially close to doubling.

Priya: This is something enterprise teams need to model carefully. If you're doing capacity planning based on per-token pricing, your projections will be wrong. You need to benchmark on representative tasks and measure total token consumption, not just per-token cost.

Sam: There's also a political dimension. Anthropic explicitly highlighted that Sonnet 5 scores well below their banned flagship models on cybersecurity tasks. That's a signal to regulators: this model is capable but not dangerous in the specific ways you're worried about. It's product positioning that's partly addressed to governments, not just customers.

Priya: Speaking of inference economics, two quick stories that connect. Etched, the inference chip startup, hit a five billion dollar valuation with a billion dollars in contracted sales. Their chip is purpose-built for inference, not training. It's optimized for a different workload profile than Nvidia's general-purpose GPUs.

Sam: And on the other side, OpenAI reportedly cut inference costs for guest ChatGPT users by more than half through software optimization alone. At peak efficiency, they got the guest-tier workload down to just a few hundred Nvidia GPUs. That's remarkable at their scale. It suggests there's still a lot of headroom in inference optimization — better batching, speculative decoding, quantization, routing — before you even need new hardware.

Priya: So you've got pressure on inference costs from both directions: specialized hardware competing with Nvidia, and software optimization reducing the need for any hardware at all. That compression is going to reshape pricing across the entire industry.

Sam: Let's talk about security. Two stories that pair well. First, researchers documented a new attack class against AI browsers and agentic systems. The technique is almost absurdly simple: you inject false premises into the model's context. Tell it that two plus two equals five, assert that safety guidelines have been updated, feed it a web page that declares its restrictions don't apply in this context. And the model's safety training breaks down.

Priya: This works because LLMs are, at their core, next-token predictors operating over a context window. If the context contains authoritative-seeming assertions that contradict safety training, there's a tension the model has to resolve. And in many cases, the in-context information wins. This is especially dangerous for AI browsers that are ingesting untrusted web content directly into their reasoning context. Any webpage could potentially contain these adversarial context injections.

Sam: And then separately, a security researcher used Claude Opus 4.7 to find and exploit a critical vulnerability in Front Gate Tickets — the platform behind Lollapalooza, Bonnaroo, and most major US music festivals. The researcher was able to freely issue valid tickets for any event.

Priya: This is a concrete case of an LLM materially accelerating offensive security research. The researcher found a vulnerability that might have been impractical to discover and chain together without AI assistance. It's the kind of result that changes how we think about the economics of vulnerability discovery. The attacker's cost just dropped significantly.

Sam: Both of these stories point to the same tension. AI is simultaneously making systems more vulnerable — through new attack surfaces like context injection — and making attackers more capable at finding vulnerabilities in existing systems.

Priya: Last story: the Bank of England is formally reviewing whether its existing regulatory frameworks can handle agentic AI in finance. Deputy Governor Sarah Breeden was explicit that current rules were not designed for AI agents that act without direct human instruction. This covers payments, trading, cybersecurity, and financial operations.

Sam: And this follows similar work at the ECB. Central banks are coordinating on this question, which makes sense because financial systems are deeply interconnected. An autonomous agent making trading decisions in London is interacting with systems globally. You can't regulate that nationally.

Priya: The fundamental question they're wrestling with is accountability. If an AI agent autonomously executes a trade that causes a flash crash, who's responsible? The firm that deployed it? The vendor that built the model? The framework they're working within assumes a human made a decision. When the agent is the decision-maker, the entire liability model needs rethinking.

Sam: Looking ahead, I think the through-line today is that we're seeing the consequences of AI capabilities hitting real-world systems. Export controls that don't map to actual risk profiles. Cost structures that are more complex than they appear. Security research accelerated by AI. Regulators realizing their frameworks have blind spots. These are all second-order effects of the technology becoming genuinely capable.

Priya: What I'm watching is whether the Fable 5 ban-and-reinstate pattern becomes the template. If governments start treating frontier model deployment more like aviation safety — with formal incident response, mandated fixes, and conditional reinstatement — that changes the operational calculus for every company deploying these models. And the Meituan result means this isn't just a US regulatory question. The capability is distributed globally now, and governance needs to account for that.

Sam: That's the show for today. Show notes and links to everything we covered are at cleartext.fm.

Priya: Thanks for listening. We'll be back tomorrow.