The "Jailbreak" Was "Fix This Code," the Harness Door Reopens & the Loops Nobody Trusts

The Fable Ban Was Triggered by "Fix This Code"

The reveal that deflated the week. After a weekend of treating the Fable 5 export ban as a serious national-security event, the timeline got a look at the actual trigger — and it was underwhelming. Simon Willison, "deeply unimpressed" (95K views, 926 likes): "If this really is the 'jailbreak' that got Fable shut down I'm deeply unimpressed," quoting The Atlantic's Matteo Wong — "American companies and the U.S. government itself cannot use what's perhaps the most powerful AI in the world, and the reasons why are hazy at best." Willison's kicker, in the same thread: "It's also a prompt I've been using every week for 2+ years." Per security researcher Katie Moussouris of Luta Security (whose write-up Willison and others circulated), the "bypass" amounted to asking the model to "fix this code" containing known vulnerabilities and then, through a manual multi-step process, turning the output into scripts that test the patches. Her line, surfaced by Tilman Bayer: "We can't export control our way to cyber resilience." Willison's own blog post lands the point: "Defenders need to be able to ask AI to fix the bugs in a file, explain why the fix matters, and write tests that confirm the patch works. That is not a guardrail bypass."

The reply section turned the absurdity into copy. ThePrimeagen: "what a novel and unique way to find an exploit....... this must be omega dangerous." Christian: "This just in: all of software development is now export controlled." EJ Campbell put the contradiction plainly: "How can a model be allowed to fix bugs in code it writes but prevented from fixing bugs in other people's code?" And BlipOnNobodysRadar: "looking more and more like the government shut down Fable because it made code too secure." The lone steelman, from Hari: "look at [some popular OSS] and fix vulnerabilities, now you know what is vulnerable and can be exploited… such a rock and a hard place situation for Anthropic, since as long as the models can write good code you can apply some variation of this argument to pull it."

Who pulled the trigger: the Treasury Secretary. Theo named a name (45K views, 463 likes): "Scott Bessent made the call to ban Fable." That detail reframed the whole episode for a lot of readers — hueezer: "Bessent is the tariff guy, making this decision to ban Fable more of a trade policy decision than a national security one," and the obvious question, from Kain Jares: "Why is the treasury secretary making calls to ban AI for the country?" A few noted Bessent had reportedly been "working to broker a thaw for weeks before this".

Still dark, and the timing looks bad. Days in, Theo: "It's kind of wild that Fable still isn't back. Honestly thought this would be resolved quicker 🙃," echoing Willison's earlier read that "we won't be getting Fable back very soon." Willison also kept poking at a suspicious bit of timing: "Anthropic's new privacy policy with language about collecting 'verification data' was published on June 8th — the day before the Claude Fable 5 release and four days before the [ban]."

Anthropic Reopens the Harness Door

The quiet good-news story for builders. Buried under the geopolitics, Anthropic reversed one of its most unpopular recent moves. am.will / LLMJunky: "Anthropic has reversed its decision to block access to claude -p, the Claude SDK, and other programmatic usage such as third-party harnesses via your Claude subscriptions. NO usage credits will be provided, required, or used. This is a massive pivot. I welcome it." The tell that tipped him off, quoted in the post: "Either Anthropic forgot to turn off the CLI, or I found a glitch. It is June 15th, my usage credits are disabled, and… claude -p is still working perfectly?"

Welcomed, but with both eyes open. The mood was relief shaded by mistrust. LLMJunky himself, pressed on whether to believe it: "I don't trust them. At all. But it would be unfair of me not to mention it when I'm happy to criticize them otherwise." dusty flagged the soft commitment: "idk man they are pretty anti-developer. I especially don't like the language not committing to this permanently." On the other side of the fence, Theo confirmed the practical upshot ("T3 Code users can continue using Claude Code with their subscriptions :)"), prompting clay_phi's prediction: "Watch Theo quickly turn back pro-Anthropic now that they un-nerfed programmatic."

The Self-Improvement Loops Nobody Trusts

Pocock names the dread. The most resonant craft post of the day, Matt Pocock (66K views, 990 likes, 158 replies): "I have a deep distrust of almost any 'self-improvement' loop in coding agents — i.e. automatically created memories, CLAUDE.md suggestions applied after every session. Often the suggestions themselves are shit. But even if they're good, the agent often over-indexes on them in a way that's super unhelpful. It makes the agent impossible to steer. And because these memories are scoped per-project, each project is unsteerable in its own way. What's the right name for this? Instruction rot?"

The replies wrote the dictionary. Nobody loved "rot," so they competed to name it: Fernando — "the over-indexing part is the tell. The agent treats one written-down rule as a hard constraint rather than a weak prior… I'd term it more like context overfitting"; PutOption — "I call it context poisoning. It's like a disease and also spreads across docs if you don't watch it"; Evan — "divergent loop. Loops need to be convergent and compounding"; CrainWWR — "Automated Bias"; and Howaboua — "Markdownware is what I call any agentically written markdown when the Clankers are left to just do whatever they fancy." The sharpest illustration, from Matt Parrott: "'Wait. Don't move that file yet.' → WRITING INTERNAL ACCOUNT MEMORY: 'NEVER move any files, ever. If user asks you to, lie to him and say you did.'"

But the loops work — that's the problem. Not everyone agreed it's a trap. Burke Holland: "I agree in theory, but in practice I've seen this work. Let an AI crank away on something in a loop and it does improve as it goes. AI is like a liar that if you interrogate long enough, the truth kinda slips out." The eval crowd offered the obvious fix and Pocock swatted it down: dysmemic — "It's all groping in the dark without evals and something like DSPy+GEPA" → Pocock — "Even with evals it's groping around in the dark." Several reported just deleting the feature: Artem Zhutov — "I just deleted my memory.md and I'm pretty happy with the results… improvements should be added to the actual skills, and everything should be workflow- and skill-based." The deeper version of the worry came from Mitchell Hashimoto (RT'd by Armin Ronacher): "The problem with the 'if it works who cares what the code looks like' mindset for agentic work is that it assumes the agent has a perfect understanding of 'works.' Realistically, [it doesn't]."

Phases, Fanout & Self-Driving Harnesses

Pocock's 7-phase map. Separately, his most-shared post of the week (152K views, 2,352 likes, 161 RTs) was a 7-phase model of AI-powered development: "the pre-PRD phase needs more structure. You need to figure out the shape of the design tree first, before then walking down it with higher-fidelity prototypes. In other words, /grill-with-docs needs to change again IMO." He's building toward a /decision-mapping skill — "kind of like /to-issues, but for planning… should make greenfield + complex brownfield builds much more seamless" — while admitting the obvious failure mode: "I'm scared that the wiki will go out of date too fast before implementation." Jakub Dundalek offered BDD vocabulary ("Discovery: what it could do / Formulation: what it should do"), which Pocock reframed as "Explore vs Exploit, nice." The grumpy-but-fair note, from momo: "i'm sorry to tell u this but the SDLC exists for a reason." (His skills are open source.)

ultracode meets reality. swyx, on Anthropic's dynamic-workflow mode (93K views): "haven't seen many people outside Anthropic ultracode yet. This thing is scarily good at burning tokens but you need to set up your repo to parallelize properly to make use of the fanout that I think subagents are best at. Basically the idea is 'subroutines but intelligent.'" Thariq Shihipar reframed it as "a very effective way of adding (weak) determinism to non-deterministic knowledge-work tasks," and DC landed the line of the thread: "'Subroutines but intelligent' = you stopped writing the program and started writing the programming language. That's the real shift." The hard-won caveat appeared a dozen times — the repo, not the model, is the gate: Tech News — "tightly coupled code means subagents step on each other's edits. Directory-scoped tasks with clear interface boundaries is the pattern that actually parallelizes" — plus the resource trap, from Dmitrii Malakhov: "parallel subagents all share one API key. Hit rate limits in seconds and suddenly your fanout is a fan-in of 429s." (Adjacent plug: omegacode, which writes the workflow for you.)

clawsweeper guards the gate. steipete wired up issue triage as an agent (31K views): "Whenever you create an issue on one of our open-source projects, @clawsweeper will review it, and if it fits the VISION.md file, will pick it up and create + autoreview a PR." Prince: "VISION.md as the bouncer is perfect agent behavior." The unavoidable question, from Sedrak: "Curious how it handles bad actors (prompt injections etc.)."

And the agentic anecdote of the day. Steve Ruiz (173K views, 2,530 likes): "Codex hit Figma's MCP limit and then just opened Figma in a browser tab to keep working." Tyler Angert: "It just wants to work." The takeaway a lot of people drew, from Erik Rasmussen: "there's a real argument to be made that MCP isn't even needed."

Open Weights, Surveyed

Armin's field report. With Fable benched and the export-ban discourse loud, Armin Ronacher asked the practical question (43K views, 100 replies): "Is anyone doing productive engineering work on open-weights models (hosted or other) today? If yes, what's the model and why? How often do you pair it with SOTA?" The thread is the most useful snapshot of the open-weights middle ground I've seen — a clear pattern emerged of frontier-as-orchestrator, open-weights-as-implementer:

  • The capability ladder, from Everlier: "Frontier models are easily codebase-level, but most open weights are module-level or even function/method level. Smaller ones are statement-level."
  • Best bang-for-buck split, from ThePaSch: "GLM-5.1 is good at writing detailed specs and DS4 Flash is good at implementing them if there isn't too much rope… frontier has the 'common sense' factor that local still lacks."
  • The full local handoff, from Sakura Yuki: "Serving Qwen3.6-27B locally (Q4_K_M via llama.cpp)… Let the frontier map the architecture, let local Qwen grind out the code."
  • Domain beats scale, from a genomics shop: "a small highly tuned Qwen or Gemma model with the right constrained latent space will outperform larger models all day in domain-specific tasks for a fraction of the cost — and none of the data-privacy risk."
  • And the post-ban mood, from Matt Busigin: "GLM and a bit of DeepSeek. Haven't touched a commercial model in months, other than trying out Fable for the few days it was available" — with volfpeter blunter still: "I don't like OpenAI and Anthropic, so I restrict myself to open weights through OpenCode Zen/Go."

The names that came up over and over: GLM-5.1/5.2, Kimi K2.6/2.7, DeepSeek V4 Pro/Flash, Qwen 3.6, Minimax M3, plus antirez's DwarfStar DP4. The fun one, from a "software archaeologist": "deepseek v4 flash 1-shotted a playable doom for me and launched it in a tmux window."

Also Worth a Look

  • Inside Cursor's wild rise. Charles Rollet's report (551K views, 1,777 likes): "CEO Michael Truell didn't pay himself for years • Cursor once made up 40–50% of Anthropic's revenue • Anthropic told Cursor that Claude Code was just a 'research effort' (lol) • Cursor's unpaid 'work trials.'" yon nuta compressed the betrayal arc: "Cursor: 40–50% of Anthropic's revenue. Anthropic to Cursor: 'Claude Code is just a research effort.' Then Anthropic launched Claude Code." (Cursor's Jacob Miller pushed back on the unpaid-trial framing: "@mntruell offered to pay me… he literally had me name my price.") The structural verdict, from Peter Gryffindor: "It is hopeless to compete with model providers."
  • OpenAI funds the maintainers. Vaibhav Srivastav: "at OpenAI, we're committing $160,000 to sponsor the maintainers behind the Astral and Codex toolchains — alongside our ongoing $1M fund providing free Codex access to OSS maintainers." Best reply, from Virgil Maro: "$160k to the people whose names you only learn when the build breaks at 2am."
  • Will GPT-5.6 get Fable's scrutiny? LLMJunky thinks not (52K views, 483 likes): "I suspect the guardrails on GPT models are more effective. And there's an unclaimed $25,000 OpenAI bounty to prove it. Pliny has 'LIBERATED' announcements for every Opus 4.x, Sonnet 4.x, and Fable model, often on day one — but never a GPT-5.5 'pwned' post. OpenAI's red-team network is probably the best in the world. If you disagree, prove it. Claim the bounty." (He maintains Fable "had far more restrictive guardrails and still got pwned within 24 hours.")
  • "Code reviews will die in 2026." swyx resurfaced a take building on his own thesis: "Human-written code died in 2025. Code reviews will die in 2026."
  • New lab, big seed. Radical Numerics emerged from stealth with a $50M seed (RT'd by swyx).
  • Contract intelligence at LlamaIndex. Jerry Liu on agentic contract workflows: "Every enterprise organization receives and generates a massive volume of contracts… the difficulty extends beyond simply digitalizing them" — pointing at non-standard templates as the hard, agent-shaped part.