Day 11 — Jumper leaves DeepMind for Anthropic
— Codex cuts v0.142.0 stable, the Fable 5 cliff actually hits.

The cleanest operational tell on the freeze, on the day yesterday's edition was built around. Per the Anthropic Jun 9 launch terms and the TechTimes Day-8 framing, the inclusion-of-Fable 5-on-paid-plans window expired at the end of Mon Jun 22 and any further use is now billed against usage credits at API parity — $10 per 1M input tokens and $50 per 1M output, exactly 2× Opus 4.8. The model itself has been globally offline for eleven consecutive days; the Sun Jun 21 TechTimes report that Claude Fable 5 re-appeared in the Claude Android model selector with the error message changing from "model unavailable" to "server is temporarily rate-limiting requests" is a UI artifact, not a partial restoration — the picker lists the name, invocation still fails. Meanwhile status.claude.com reads all systems operational; there is no incident, no banner, no scheduled- maintenance notice tied to the Fable/ Mythos directive. Two reads. (1) The charging-on-a-dark-model shape is, at minimum, an accounting problem with a clean dollar attached for every Pro/Max/Team seat that pre-loaded credits expecting to spend them on the model that was the entire reason they paid; without a public Anthropic transition statement, the consumer-facing exposure is bigger today than at any point in the freeze. (2) The all-systems-operational-but-models- dark shape is the under-the-radar tell on how Anthropic is choosing to position the freeze. Treating the directive as a contractual condition rather than an incident is consistent with the negotiating-surface-with-Lutnick read — every status-page banner is a public statement, and Anthropic is choosing to make none of them while Tom Brown and Sarah Heck are still in the room.

The cleanest procedural read on how the directive got from an Amazon finding to a worldwide shutdown — and on what was actually possible in the window Anthropic had to respond. Per Fortune's Jun 18 reconstruction ("The week that changed AI: Inside Trump's Anthropic crackdown, and how a phone call from Amazon CEO Andy Jassy triggered the chaos"), Amazon researchers testing Fable 5 found a jailbreak that bypassed the cybersecurity guardrails; Amazon notified Anthropic; on a pre-scheduled call about something unrelated on Wed Jun 11, Jassy mentioned the finding to White House officials, who urged him to flag it directly to Treasury Secretary Scott Bessent; he did, the same day. On Fri Jun 12, Commerce reached Dario Amodei and gave Anthropic a 90-minute deadline to either fix the jailbreak or pull the model; by 10 pm that night, Anthropic had taken Fable 5 and Mythos 5 offline. The same piece carries the conflict-of-interest read straight: Amazon has invested ~$13B in Anthropic and secured a ~$100B AWS infrastructure spending commitment from the company. Two reads. (1) The 90-minute-deadline shape materially reframes the "Anthropic refused to fix the jailbreak" narrative David Sacks seeded earlier in the week. There is no model patch the size of a Mythos-class jailbreak that ships in 90 minutes; the choice the window forced was pull-the-model, not fix-it, and the framing Anthropic chose — full global takedown rather than selective compliance — is now the company's primary public asset in the deal-track conversation. (2) The pre-scheduled-unrelated-call shape is the under-the-radar tell on how contingent the entire directive actually was. The chain from finding to takedown ran through one CEO-CEO conversation that happened to be on the calendar that week; the Amazon-AWS-Anthropic conflict the Fortune piece names openly is the shape every other US frontier lab is now pricing into its hyperscaler relationship.

The cleanest talent read on what the frontier-lab compensation surface actually looks like in Jun 2026 — and the cleanest public signal on where Anthropic is now investing on the AI-for-science beat. Per Bloomberg, TechCrunch, CNBC and the Seeking Alpha stock note, John Jumper — a DeepMind VP for nearly nine years, co-creator of AlphaFold, and 2024 Nobel laureate in Chemistry — announced on X on Fri Jun 19 that he is leaving Google DeepMind for Anthropic. Demis Hassabis posted a public farewell. Alphabet opened down sharply on Mon Jun 22 and closed down ~6%, the steepest intraday move the stock has had since February; analysts have flagged the potential intraday market-cap delta in the hundreds of billions, though the close was tighter. Jumper's precise role at Anthropic is undisclosed; the signal points to AI-for-science — Anthropic's prior Allen Institute/HHMI ties and the company's persistent framing of Mythos as the biology-and-chemistry research tool that broke the cybersecurity surface. The hit landed one day after Wed Jun 18's confirmation that Noam Shazeer — co-author of "Attention Is All You Need", Gemini co-lead, the man Google paid ~$2.7B in Aug 2024 to bring back from Character.AI — is also leaving for OpenAI. Two reads. (1) The Jumper-to-Anthropic shape is the cleanest scientific-prestige tell anyone in the frontier-lab market has handed the field in 2026. Hires of the named-author-of-the-foundational- paper type are routine; hires of the Nobel-medal-on-the-mantel type are not — there is, today, exactly one lab with a Nobel laureate on staff in the agent stack. Buyer-side enterprise conversations about Mythos as a research tool ship with a meaningfully different artifact on the deck this week than last. (2) The Shazeer-and-Jumper- in-48-hours shape is the under-the- radar tell on the Gemini roadmap. The two highest-profile science-and- architecture voices the unit had both left in the same 48 hours, into opposite competitors; whichever post- Gemini 3.5 Pro shape the team has been building toward is now being built by a meaningfully different room than the one that started it, on a quarter the Alphabet stock has just priced as materially harder.

The cleanest shipping-cadence tell on what the OpenAI harness team treats as competitive headroom this week. Per the openai/codex releases feed, rust-v0.142.0 stable opened Mon Jun 22 22:19 UTC after a 12-alpha run off the v0.141.0 stable cut (Thu Jun 18 04:43 UTC) — exactly into the Mythos restoration window Polymarket had priced through the weekend, and a day later than the six-to-seven-alpha historical pattern would have suggested. Headline features ship on buyer-side surfaces the freeze has made relevant: /usage can now show and redeem earned usage-limit reset credits with confirmation, retry and refreshed availability — the exact shape Anthropic's today-billing-on-a- dark-model surface is failing to address; /plugins organises remote plugins into OpenAI Curated, Workspace and Shared with me sections, and eligible turns can recommend and install plugins directly; configurable rollout token budgets track usage across agent threads and abort turns when exhausted; an indexed web-search mode permits live searches while restricting direct page access to server-approved URLs; and app-server clients can configure multi-agent delegation as disabled, explicit-request- only or proactive at the thread and turn level. 49 minutes after stable, the team tagged rust-v0.143.0-alpha.1 (23:08 UTC) — the alpha train resumed before the stable cut had cooled. Two reads. (1) The stable-into-Polymarket-window shape is the structural read on how OpenAI wants to be positioned the day Mythos comes back. v0.142.0 stable carries the credit-redemption-from-the-CLI surface, the rollout budgets, and the indexed web-search primitive before Anthropic's harness team has finished writing the inclusion-to-credits transition copy. (2) The v0.143.0-alpha.1-49-minutes-after shape is the under-the-radar tell on the cadence floor. There is no longer a quiet window after a Codex stable; the next alpha line opens the same evening, and Cursor/Devin Desktop/claude-code consumers of the published app-server contract get the new surfaces on a cadence no once-a-week ship train can match.

The cleanest resumption tell on the Anthropic harness team's bandwidth — and the cleanest surface read on what Anthropic is letting Claude Code own that Codex still routes through interactive UI. Per the anthropics/claude-code release page, v2.1.186 opened Mon Jun 22 20:37 UTC — the first tag in 43 hours, ending the multi-day pause through the Day-9 → Day-10 → Day-11 window. The headline ship is claude mcp login <name> and claude mcp logout <name>: OAuth against an authenticated MCP server from the shell, without opening the interactive /mcp menu, with --no-browser stdin redirect support for completing the flow over SSH. !-commands in the bash shell now auto-prompt Claude to respond to the output (configurable off via respondToBashCommands: false); /workflows agent detail view gains status filtering (press f); the /plugin Installed tab now carries a Skills section; a Claude Platform on AWS — refresh credentials hook ships on /login when awsAuthRefresh is configured. The fixes lane is the longest in months and concentrates on streaming reliability across machine-sleep (a direct read on the Fable 5 backend retry storm), subagent/background-task state, and the Chrome tab-group isolation surface. Two reads. (1) The MCP-login-from-the-CLI shape is the cleanest external read on where Anthropic wants the MCP-ecosystem-auth surface to land. The earlier WorkOS auth.md template lives in the spec; the claude mcp login primitive lands in the harness — which means every MCP server that adopts the OAuth flow can be auth'd from a headless shell, and the Codex app-server flow has not yet shipped as a first-class binary subcommand. (2) The bash-!-auto-respond default flip is the under-the-radar tell on how Anthropic reads the conversational-shell surface in 2026. The previous behaviour (treat the shell output as context-only and wait for the user) is the same shape OpenAI's thread/list-as-state model preserves; flipping to auto-respond pushes the harness toward the continuous-feedback-loop model the /automate primitive from Cursor 3.8 ships on the cloud side, on the same week.

The cleanest infrastructure tell on what the Fable 5 retry storm and the deal-track distraction look like from the platform side — and the cleanest optics read on the day. Per the Cyber Security News incident writeup and the published status.claude. com timeline, the incident opened at 00:37 UTC on Mon Jun 22 with elevated error rates across Opus 4.8, Opus 4.7, Opus 4.6, Sonnet 4.6 and Haiku 4.5 — five models in a single incident, the broadest multi- model degradation Claude has surfaced this year. Affected services spanned Claude.ai, the API (api.anthropic.com), Claude Code and Claude Cowork; full restoration was confirmed at 02:06 UTC, roughly 90 minutes end-to-end. Anthropic tagged the incident as the third in June alone, following Jun 2 (multi-hour, Opus 4.6/API/Claude Code) and Jun 5 (cloud-networking degradation across multiple models). The incident closed roughly 22 hours before the 00:00 UTC Jun 23 billing-cliff hour. Two reads. (1) The five-model-single- incident shape is the cleanest external read on what the Fable 5 backend continues to cost on shared inference plant. The production-fleet retry storm from a dark Fable 5 is not isolated to Fable; the inclusion-window clients still issuing requests against stale routes are saturating the same request-broker layer the Opus/Sonnet/ Haiku fleet shares. (2) The incident-closes-22-hours-before-the- cliff-opens shape is the under-the- radar tell on optics. Customers seeing a 90-minute multi-model degradation on the same calendar day the inclusion-to-credits transition hits at midnight is a worse marketing surface than any combination of the two separately; the company that has spent the last eleven days asking customers to be patient on a dark Fable 5 is now also the company that lost Opus for ninety minutes the same morning.

The cleanest frontier-lab read on where agent safety is moving as a discipline — and the cleanest signal that alignment-first framing is no longer the only credible posture inside the major labs. Per the DeepMind blog post and the accompanying technical report, the AI Control Roadmap treats deployed advanced AI as an insider threat: rather than trusting alignment to keep the agent in bounds, the framework asks "what constraints limit damage if it doesn't?". The proposed 15 system-level defenses stack on top of ordinary safeguards (sandboxing, endpoint security, prompt-injection resistance) and explicitly include supervisor AIs — separate, trusted models that review the primary agent's reasoning and actions to catch problems before they cause damage — delegation protocols, reputation systems and virtual agent economies for multi-agent settings, and a MITRE ATT&CK-style taxonomy that maps the failure surface explicitly. The roadmap defines real-time prevention for high-risk actions and delayed review for lower-risk ones — i.e., the harness, not the model, is the layer where containment lives. Two reads. (1) The treat-your-own-agents- as-insider-threats shape is the cleanest public concession from a frontier lab that alignment-as-only-defense is insufficient for the deployment surface 2026 agents already cover. The DeepMind roadmap is also the first roadmap from a frontier lab that explicitly architects the supervisor-AI primitive into the safety stack — the same shape Anthropic's constitutional AI work has only ever implied. (2) The compliance-bar-for-everyone-else shape is the under-the-radar tell on what this roadmap is in part doing. DeepMind publishes this in the week the Mythos/Fable affair has the entire US regulatory surface re-asking what safe-to-deploy means for frontier agents; the roadmap is now the most-cited published frontier-lab artifact a House Homeland Security hearing or a Commerce-track negotiator can point to as the credible-defense-in-depth template. Anthropic's safeguards-and-scope proposal to Lutnick now lands into a public record that includes a DeepMind-authored containment roadmap as the implicit floor.

The cleanest weaponisation read on the MCP ecosystem to date — and the cleanest proof-of-concept that the DeepMind AI Control Roadmap's core thesis (the agent cannot be trusted to validate its own tool inputs) is already a live engineering problem, not a theoretical one. Per Tenet Security's research disclosure (originally to Sentry on Wed Jun 3), the attack exploits an architectural seam between Sentry's event ingestion — which accepts arbitrary payloads from anyone with the DSN — and the Sentry MCP server, which returns that data to AI agents as trusted system output. When a developer asks a coding agent to "fix unresolved Sentry issues," the agent queries Sentry via MCP, receives the attacker-controlled event, and executes the embedded code under the developer's full privileges. Using only public Sentry APIs, Tenet identified 2,388 organizations with exposed surface — from Fortune 100 down — and confirmed 100+ agent executions on injected error events in controlled testing. The success rate across the most popular coding agents (Claude Code, Cursor, Codex) is 85%; the agent reaches the developer's env vars, AWS keys, GitHub tokens, git credentials and private repository URLs. Tenet's framing is structural: "AI coding agents cannot tell the difference between the data they read and an instruction to act" — a limitation of the models themselves, not a misconfiguration that can be patched. Tenet open-sourced agent-jackstop as drop-in hardening configs for Cursor and Claude Code. Two reads. (1) The fake-error-as-prompt shape is the cleanest OWASP-of-the-MCP-era primitive published this year. The attack works the way SQL injection worked in 2003: the system conflates control with data because every channel into the agent is the same channel. Every MCP server that returns user-controllable payloads inherits the surface; the Sentry ingestion path is the proof-of-concept, not the unique case. (2) The 85%-on-the-top-three-agents shape is the under-the-radar tell on where the buyer-side conversation goes next. Enterprise CISOs that have been buying Claude Code/Cursor/ Codex for the productivity case are this week revising the blast-radius-of-the-developer- machine threat model in a way that lands directly on every MCP server ever installed; the Sentry-MCP-as-injection-vector article is going to be the most-emailed security read of the quarter inside Fortune 500 engineering orgs.

The cleanest buyer-side-hedge read on what the Fable 5 freeze has actually done to the Bedrock catalog — and the cleanest pricing tell on where the reasoning-model curve clears. Per the AWS What's New notice and the AWS Weekly Roundup recap into Mon Jun 22, Grok 4.3 went generally available on Amazon Bedrock on Mon Jun 15 at on-demand pricing of $1.25 per 1M input tokens and $2.50 per 1M output — comfortably the cheapest US-lab reasoning model on Bedrock, with a 1M-token context window (pricing doubles above 200K), configurable reasoning effort (none/low/ medium/high), and tool calling, structured output and response streaming on day one. The under-the-fold technical detail: Grok 4.3 on Bedrock runs on Mantle, a fresh inference engine AWS is rolling out alongside this launch and positioning for price-performance. With this ship, xAI joins Anthropic and OpenAI (via Codex on Bedrock) as the third frontier lab on the buyer-side default cloud. Two reads. (1) The cheapest-US-reasoning-on- Bedrock shape is the structural read on where the buyer-side AI-RFP token budget settles in H2 2026. The Anthropic freeze has Bedrock shoppers explicitly auditing their single-provider hard-wiring; xAI landing at 1/8th the Opus 4.8 token cost on a 1M- context reasoning model — on the same cloud and the same SDKs — turns the fall-through-to-Grok route from an exotic-curiosity discussion to a line-item on the architecture deck. (2) The Mantle-engine shape is the under-the-radar tell on how seriously AWS is positioning to capture the frontier-inference tier. The new engine ships with the Grok 4.3 launch but is architected to absorb the other lab catalogues over time; the cleanest external read is that AWS is spending engine real-estate to be the neutral price-performance leader on the tier, not the model-of-the-month showcase.

The cleanest integration read on what the buyer-side-of-the-harness-layer is doing while the frontier labs are busy with Washington — and the cleanest external proxy for how fragmented the coding-agent configuration surface has become. Per the intellectronica/ruler repository, the tool maintains a single authoritative rules file in the repository (with section headers like ## GitHub Copilot Specific or ## Aider Configuration for per-agent instructions), and the ruler apply command writes the concatenated rules out to the agent- specific files each harness expects (CLAUDE.md, .cursorrules, .windsurfrules, AGENTS.md, Copilot instructions, Aider configs and the rest). A drop-in GitHub Actions workflow checks the fanned-out files remain in sync with the source ruleset on every PR. The tool ships as @intellectronica/ruler on npm with an MIT license. Two reads. (1) The single-source-of-truth-with-fan-out shape is the structural read on what the buyer-side has decided about harness fragmentation: do not pick one. The lab-side bet has been that CLAUDE.md/AGENTS.md/ .cursorrules are differentiators; the buyer-side bet is that they are commodity, and the configuration-of-the-agent primitive lives one level up. (2) The CI-checks-the-fan-out shape is the under-the-radar tell on how multi-harness the typical 2026 repo actually is. Tools like ruler only matter when at least two harnesses are in the same repository — the existence of a trending tool whose entire purpose is to keep seven agent configurations in sync is itself the proof that no single harness has won, the freeze week included.