Anthropic’s Suspension Is a Wake-Up Call for AI Supplier Risk

By Dan Raywood • 7 July 2026 • 6 min read

If you build critical business processes around a single AI service, what happens when that service disappears overnight? Earlier this year, organisations using Anthropic’s Claude Fable 5 and Mythos 5 models were forced to answer exactly that question.

The models, released in early June 2026, were suspended just days after launch following an order from the US government. Anthropic said it had to “abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance” with a directive believed to relate to bypassing, or “jailbreaking”, Fable 5.

The model was reportedly capable of detecting vulnerabilities in cyber systems and was suspended due to concerns that it could be exploited. Although it had only been made available to vetted organisations, the US government issued an export control directive suspending access to Fable 5 and Mythos 5 for any foreign national.

In a statement, Anthropic said the directive did not provide specific details of the government’s national security concerns. It added that, having reviewed a demonstration of the technique used to identify a small number of previously known, minor vulnerabilities, those vulnerabilities appeared relatively simple.

Anthropic further stated that, in the weeks leading up to the launch of Fable, it had worked with the US government, multiple third-party organisations and internal teams to red-team the model’s safeguards for thousands of hours. “These tests showed that Fable’s safeguards are substantially more effective than those of any previously deployed model.”

On 1 July, restrictions on Fable 5 and Mythos 5 were lifted after the Commerce Department said Anthropic had agreed to proactively detect and address security risks associated with the models, collaborate on future AI releases, and alert the government to malicious activity.

Part of the Enterprise

The suspension may have been temporary, but it exposed a much broader question: what happens when an AI service that has become embedded in business operations is suddenly unavailable?

Some organisations may have been early adopters of Anthropic’s latest models, but that is far from unusual. Businesses are increasingly quick to adopt new AI capabilities where they offer a competitive or operational advantage. The real issue is not how new a service is, but how dependent an organisation has become on it.

If AI services have become business-critical, their sudden withdrawal could create significant operational disruption. The Anthropic incident therefore raises an important question: should AI tools now be treated as critical suppliers?

Graham Pottie, an information security manager and vCISO with ClubCISO, says the criticality of AI depends entirely on how it is being used. If it’s simply being used to tidy up an email, then it is not a critical application. “But if you’re using it to gather information on clients and what they’re doing to improve your pitch, or to automate business processes,” he says, “then it becomes a critical service.”

He also points out that organisations need to understand the dependencies hidden within their suppliers. “When you do your standard supplier risk management, there may be AI embedded within those products that they’re reliant on. If it disappears and it’s a key supplier with AI built in, it can harm your business.”

Pottie adds that if you have built tools or agentic applications on top of a particular large language model (LLM), they may not work on another platform. There is also the issue of data security. “What happens to your data? Is it still within your control, or have you lost ownership?”

Into the Risk Register

If AI has become essential to your operations, it should be managed like any other critical supplier, with the associated risks formally captured in your risk register. While this incident involved Anthropic, the same scenario could affect any AI provider.

The key lesson is understanding dependency risk. Organisations need to know not only where AI is used directly, but also where it is embedded within third-party services that support critical business processes.

Pottie says that if an AI platform is critical to your business, and you’ve replaced 90% of your helpdesk staff with AI, then you have a significant operational risk that should be managed accordingly.

That assessment should also form part of any compliance programme. If you’re working towards ISO 27001 certification, reliance on external AI services should be reflected within your information security risk register.

Several ISO 27001:2022 controls are particularly relevant in this scenario. The supplier relationship controls (A.5.19–A.5.22) require organisations to understand the risks associated with external products and services, making AI providers a natural consideration where they support business-critical processes. Likewise, A.5.23, covering the use and exit of cloud services, reinforces the need to consider how AI-dependent services could be replaced or migrated if access were suddenly withdrawn.

Business continuity is equally important. Controls A.5.29 and A.5.30 require organisations to prepare for technology disruptions by identifying critical services, maintaining response plans and regularly testing them. While few organisations would have expected a newly launched AI model to be suspended within days of release, the Anthropic example demonstrates why planning for the unexpected is an essential part of resilient AI adoption.

Taken together, these controls encourage organisations to identify where AI supports critical business processes, assess supplier and geopolitical risks, and maintain documented contingency and exit plans should access to a service be restricted or withdrawn. They also help reduce dependence on a single AI provider by encouraging organisations to understand their options before disruption occurs.

Pottie says AI can also play a role in incident preparedness, but organisations should never neglect the basics. As he puts it: “Keep a pen and paper close by.”

The Bigger Picture

Although Anthropic disputed the US government’s concerns and characterised the issue as a narrow, non-universal jailbreak, the episode demonstrated how quickly access to a critical AI service can change. OpenAI has also faced increased scrutiny from the US government, with version 5.6 of its GPT model reportedly being approved on a customer-by-customer basis.

As AI becomes embedded in critical business processes, organisations need to treat AI providers as they would any other strategic supplier. That means understanding dependencies, maintaining contingency plans and ensuring supplier risk is reflected within the information security risk register. ISO 27001 already provides much of the framework required—the challenge is making sure AI is included within it.