AI Policy

Japan's Cyber Chief Confirms US AI Ban Hit Defenses

Japan's National Cyber Director told Kyodo News a June US export ban on Anthropic's Fable 5 and Mythos 5 disrupted government vulnerability scanning, weeks before Japan's own AI-reliant cyber defense law takes effect.

AI PolicyBy Servola Tech Desk2026-08-133 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Japan's Cyber Chief Confirms US AI Ban Hit Defenses

Key takeaways

Japan's National Cyber Director Yoichi Iida confirmed on August 10 that the US Commerce Department's June 12 export ban on Anthropic's Fable 5 and Mythos 5 disrupted vulnerability scanning on Japan's own government systems - the first on-record admission of allied collateral damage from a frontier-model export order.
Anthropic suspended both models for every customer worldwide, including its own non-US staff, because it could not distinguish eligible from ineligible users at the application layer; only the NSA secured an exemption.
The disruption hit less than seven weeks before Japan's Active Cyber Defense Act takes effect on October 1, and Mythos remains restored only for a vetted set of US organizations, not for Japan.
The takeaway for EU and UK organizations: a US export order aimed at national security, unrelated to your business, can switch off a security-critical AI tool overnight - single-vendor dependence for scanning or code-audit workloads is now a demonstrated operational risk, not a theoretical one.

A Blanket Kill Switch, Not a Targeted One

On June 12, 2026, the US Commerce Department's Bureau of Industry and Security ordered Anthropic to suspend its Fable 5 and Mythos 5 models for foreign nationals worldwide, after regulators flagged a narrow jailbreak that let the models read a codebase and surface exploitable vulnerabilities faster than intended. The directive was framed as a national security measure, not a broad restriction on AI exports as such.

Anthropic said it had no reliable way to distinguish an eligible domestic user from an ineligible foreign one at the application layer, so it shut both models down for every customer on the planet, including its own non-US employees, to stay compliant. Only the National Security Agency secured an exemption, on the grounds that no other model matched Mythos's vulnerability-discovery capability.

Tokyo Just Said the Quiet Part Out Loud

On August 10, in an interview carried by Kyodo News, Yoichi Iida, Japan's National Cyber Director and Deputy National Security Advisor, confirmed publicly for the first time that the June suspension "disrupted security vulnerability scanning operations for key government systems" inside Japan itself - the first on-record admission from an allied government that Washington's export enforcement produced real operational damage, not just commercial inconvenience, on friendly soil.

Iida did not treat the incident as a reason to pull back. He called Japan's adoption of sophisticated AI technology in cyber defense "inevitable," warning that "it would be no surprise if the time between vulnerability discovery and exploitation were shortened to a fraction of a hundredth or a thousandth of what it used to be" without it.

The Timing Makes It Worse, Not Better

The disruption landed less than seven weeks before Japan's Active Cyber Defense Act, approved by Prime Minister Sanae Takaichi's cabinet in March, is due to take effect on October 1, 2026. The law authorizes the Japanese government to act preemptively against cyberattack risks - exactly the kind of proactive, AI-accelerated vulnerability scanning that Fable 5 and Mythos 5 were being used for before Washington switched them off.

Anthropic restored global access to Fable 5 on July 1 after the US restrictions lifted at the end of June, but Mythos, the more capable of the two for vulnerability discovery, came back only for a vetted set of US organizations. That means the tool Iida's own account suggests Tokyo was relying on for government scanning may still not be fully available to it, three months before the Active Cyber Defense Act goes live.

The Lesson Extends Well Past Anthropic and Japan

The mechanism that hurt Japan was not a targeted policy but an ordinary technical limit: a US vendor can be legally required to distinguish domestic from foreign users, discover it cannot do so at the application layer, and default to switching a tool off for every customer worldwide rather than risk violating an export order. That default applies to any frontier AI vendor headquartered in the US, for any future directive, regardless of who is actually implicated.

For any EU or UK organization that has built a security-critical process - vulnerability scanning, incident triage, code auditing - around a single foreign frontier model, the Japan case is the clearest evidence yet that the vendor's home government can switch that process off overnight, with no advance notice and no carve-out for allies, over an issue that has nothing to do with the customer at all. The practical answer is not to avoid US AI vendors; it is to make sure no single vendor is a single point of failure for anything that has to keep running the day an export order lands.

Frequently asked questions

What exactly did Japan's National Cyber Director confirm?

In an August 10 Kyodo News interview, Yoichi Iida said the June 12 US export ban on Anthropic's Fable 5 and Mythos 5 models disrupted security vulnerability scanning operations for key Japanese government systems - the first public admission by an allied official that the ban caused real operational harm outside the United States.

Why did Anthropic shut the models down worldwide instead of only where the ban applied?

Anthropic said it had no reliable way to distinguish an eligible domestic user from an ineligible foreign one at the application layer, so it suspended both models for every customer globally, including its own non-US staff, rather than risk violating the export directive. Only the NSA received an exemption.

Is the export ban still in effect?

The US restrictions were lifted at the end of June 2026. Anthropic restored global access to Fable 5 on July 1, but Mythos, the model more capable at vulnerability discovery, has been restored only for a vetted set of US organizations.

What is Japan's Active Cyber Defense Act?

A law approved by Prime Minister Sanae Takaichi's cabinet in March 2026 that authorizes the Japanese government to act preemptively against cyberattack risks. It takes effect October 1, 2026, and relies on the kind of AI-assisted vulnerability scanning that the June export ban temporarily disrupted.

Most coverage of the June export ban treated it as a US industry story: which American agencies got exemptions, which US customers lost access. Japan's cyber chief just supplied the missing half of that story on the record - an allied government's own defensive operations went dark because a US vendor could not tell a friend from a target at the application layer. That is not a one-off. It is what happens, by design, every time Washington tightens an export directive on a frontier model with a global customer base, and it will happen again to whichever government or enterprise is standing in the blast radius next.

JapanExport controlsAnthropicMythosActive Cyber Defense ActVendor risk

Three Months In, the US AI Testing Chief Resigned

Chris Fall is leaving CAISI after about three months. NIST director Arvind Raman takes the role in an acting capacity, and no reason has been given.

4 min read

Capital

If the Tenant Defaults, Google Takes the Data Centre

Alphabet's Q2 filing discloses 43.8 billion dollars of credit derivatives backstopping data centre payments, on terms up to 15 years. It never names who is being backstopped.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.