Security daily

Synthesized by Clarity (Claude) from 2 sources · May contain errors — spot one? [email protected] · Methodology →

Commerce Bars Foreign Nationals From Anthropic's Fable 5

Sources
2
Words
834
Read
4min

Topics Agentic AI AI Regulation

◆ The signal

The US Commerce Department barred all foreign nationals from Anthropic's Fable 5 and

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    AI Model Export Controls Create Same-Day Access Crisis

    act now

    Commerce Dept barred foreign nationals from Anthropic Fable 5/Mythos. SK Telecom access revoked by White House over China-nexus concerns. Any enterprise with international engineers on Claude endpoints faces EAR exposure and potential contract termination today.

    1
    source
    • Models restricted
    • Access revoked
    • Enforcement actor
    1. Mythos at NSA (Project Glasswing)Deployed for offensive ops
    2. Export controls enactedForeign nationals barred
    3. SK Telecom revokedWhite House order
    4. Enterprise compliance deadlineImmediate
  2. 02

    Shadow AI Agents Entering Corporate Environments via OAuth

    monitor

    Six consumer AI agents (Manus, Claude Cowork, Jamie, Wispr Flow, Chat Hub, Prompt Cowboy) are being adopted as personal tools and landing in corporate tenants via OAuth grants. Agentic tools request mailbox read/send + Drive access — identical scope profiles to APT29-style token theft campaigns.

    6
    unsanctioned AI agents
    2
    sources
    • Tools identified
    • Risk tier
    • Scope pattern
    1. 01Manus (autonomous agent)Critical
    2. 02Claude Cowork (task delegation)Critical
    3. 03Jamie (meeting audio)High
    4. 04Wispr Flow (voice dictation)High
    5. 05Chat Hub (multi-model)Medium
    6. 06Prompt Cowboy (prompt gen)Low
  3. 03

    GitHub Vulnerability Triage Trust Failure (Supply Chain Worm Update)

    monitor

    Update: The supply-chain worm (now attributed as Shai-Hulud) exploits vulnerabilities GitHub itself dismissed when reported by Deep Specter. Two rejected reports, both now weaponized. This shifts the story from 'worm exists' to 'platform triage process failed' — GHAS/Dependabot signals are provably incomplete.

    2
    dismissed vuln reports
    1
    source
    • Reports dismissed
    • Packages compromised
    • Reporter
    1. GitHub-native detection40Incomplete
    2. Independent telemetry85Required
  4. 04

    Camera-Equipped Smart Glasses Reach Visual Parity

    background

    Smart glasses with cameras are now indistinguishable from prescription eyewear at conversational distance. This normalizes covert recording in offices, data centers, and trading floors. Physical security policies scoped to 'cameras' rather than 'recording capability' are now unenforceable.

    1
    source
    • Form factor
    • Policy gap
    • Affected zones

◆ DEEP DIVES

Deep dives

  1. 01

    AI Export Controls Hit Enterprise: Your Claude Deployment Has a Deemed-Export Problem Today

    act now

    What Happened

    The US Commerce Department has barred foreign-national access to Anthropic's Fable 5 and Mythos models. Separately, the White House revoked SK Telecom's access to Mythos on China-nexus grounds. This sits on top of last week's disclosure that Anthropic placed roughly 6 engineers inside NSA, running Mythos for offensive cyber operations under Project Glasswing.

    Models used in classified offensive work are now export-controlled. Most enterprise Claude contracts include the affected families.


    Why This Is an Emergency for International Teams

    Under the Export Administration Regulations (EAR), granting a foreign national access to controlled technology, including a non-US-person employed by the licensee and working on US soil, is a deemed export. SSO group membership is not a defense in a Commerce audit. The nationality attribute has to come out of HR, into the IdP as a claim, and be enforced at the AI-gateway layer.

    If a non-US-person on the engineering team can reach a Claude endpoint that routes to Fable 5 or Mythos, the violation is current, not pending.

    Enforcement Reality

    The SK Telecom revocation came from the White House, not Commerce staff. That is the signal. Audit scrutiny is a question of months, not years, and multinational engineering teams on Claude enterprise are the obvious first cohort.


    What You Need to Do

    1. Identify exposure. Confirm whether the Anthropic enterprise contract includes Fable 5 or Mythos. If Anthropic has not sent written notice of which model families are controlled, request it in writing.
    2. Wire nationality into access control. Pull the citizenship field from the HRIS (Workday, BambooHR, etc.) into the IdP as a claim. Enforce at the AI gateway or proxy, not at the application, where a developer can route around it.
    3. Segment API routing. Where the gateway supports model-level rules, block Fable 5 and Mythos for sessions carrying a non-US-person claim. Route those users to uncontrolled model families only.
    4. Document for audit. Commerce auditors want technical enforcement, not policy PDFs. Capture an access-denial screenshot from a test non-US-person account. Retain the gateway logs.

    Strategic Implication

    Anthropic is no longer a neutral SaaS endpoint. It is a dual-use vendor with models explicitly tasked for offensive operations and sitting under export control. Governance frameworks built on the premise that it is just an API need a rewrite. Expect the same access-control requirement to spread to other providers as more frontier models enter classified programs.

    Action items

    • Contact Anthropic account team to confirm which model families in your contract are export-controlled
    • Implement nationality-attribute access controls on AI gateway endpoints by end of week
    • Audit Claude API access logs for past 90 days to identify any non-US-person access to restricted models
    • Update enterprise AI governance policy to classify model providers by export-control status this quarter

    Sources:Chris Short

  2. 02

    Six AI Agents Your Employees Already Installed — And the OAuth Scopes They're Holding

    monitor

    The Shadow AI Agent Problem

    The threat this cycle: consumer-grade AI agents entering corporate environments through the same channel shadow SaaS has always used — employee self-service OAuth grants. The difference from a rogue Trello board is scope. An agentic AI with mailbox read/send, calendar write, and Drive access is a data-exfiltration channel wearing a friendly logo.

    Six tools named across sources. Two flagged critical because they are agentic — they execute actions without human-in-the-loop approval:

    ToolFunctionCritical ScopeDetection Gap
    ManusGeneral autonomous agentWhatever user grants — executes actionsNo visible footprint in M365/GWS admin
    Claude CoworkTask delegation to ClaudeDocuments, code, data in delegation contextAnthropic-hosted — scope creep risk
    JamieAI meeting notes (no bot visible)Audio/transcripts — bypasses recording governanceNo artifact in Zoom/Teams — invisible to compliance
    Wispr FlowVoice dictationContinuous audio incl. credentials, PIIEndpoint-resident with mic + accessibility perms
    Chat HubMulti-model LLM aggregatorPrompts fanned across N providersOne paste = multiple data-residency footprints
    Prompt CowboyPrompt generationSource material pasted inLow risk but gateway to higher-risk tools

    Why This Is Different from Normal Shadow IT

    The scope profile requested by agentic AI tools is identical to what APT29-style token theft campaigns go after: mailbox read/send, calendar write, file-store access. The distinction is that employees are granting these scopes voluntarily, from managed accounts, to third parties with no DPA and no SOC 2.

    An employee granting Manus broad OAuth scopes from a work account is functionally identical to a successful consent-phishing attack — except the employee did it on purpose.

    This connects to last cycle's supply-chain trust theme. GitHub's triage failures meant platform-native signals were insufficient. Employee tool choices mean perimeter controls are insufficient. Same lesson, different layer.


    The Structural Fix

    Admin consent workflow with default-deny for high-risk scopes is the single highest-ROI control for 2026. M365 supports it. Google Workspace supports it. If it is not enabled, any employee can grant any third-party app any scope, with no security visibility until a log query surfaces it weeks or months later.

    Non-technical users now trust agents to execute financial transactions and run workflows autonomously. The trust pattern accelerates as Manus and Claude Cowork improve. The governance window is now, before adoption hits critical mass. After that, the conversation is about clawback, not consent.

    Action items

    • Add Manus, Claude Cowork, Jamie, Wispr Flow, Chat Hub, and Prompt Cowboy to CASB/SSPM allow-deny review queue today
    • Pull OAuth grant logs for past 90 days from M365 and Google Workspace; flag any app with mail, calendar, or Drive write scopes
    • Enable admin consent workflow with default-deny for high-risk scopes if not already active
    • Publish an internal sanctioned-vs-prohibited AI tools list before employees choose for the organization

    Sources:Chris Short · Box of Amazing

◆ QUICK HITS

Quick hits

  • Update: Supply-chain worm (now named Shai-Hulud) confirmed exploiting 2 vulnerabilities GitHub itself dismissed from Deep Specter reports — validates that GHAS/Dependabot alone is an incomplete control; stand up independent package-install telemetry

    Chris Short

  • Intel released MIT-licensed 'performance skills' for Claude Code, Copilot, Codex, and Gemini CLI — inventory which AI coding agents hold which tool permissions before this becomes the next PAM problem

    Chris Short

  • Epic Games' 'lore' VCS emerging as alternative supply-chain trust anchor — track its signing/verification primitives as a contingency if GitHub trust model continues degrading

    Chris Short

  • Autonomous household AI agents (Claire, Sylvie, Clark) demonstrate non-technical users now trust agents to execute financial transactions without human-in-the-loop — expect this trust pattern to transfer directly to workplace tools

    Box of Amazing

◆ Bottom line

The take.

The US Commerce Department just made Anthropic's frontier models export-controlled technology — if your Claude enterprise deployment is accessible to non-US-person engineers, you're in deemed-export violation today, not theoretically — while six consumer AI agents are granting themselves mail/calendar/Drive access through your employees' OAuth consents with the same scope profile as APT29 consent-phishing campaigns.

— Promit, reading as Security ·

Frequently asked

Does using Claude with non-US-person engineers now count as an export violation?
Yes, if those engineers can reach Fable 5 or Mythos endpoints. Under the EAR, granting a foreign national access to controlled technology — even a non-US-person employee working on US soil — is a deemed export. SSO group membership does not satisfy Commerce; the nationality attribute must flow from HR into the IdP and be enforced at the AI gateway.
How do I confirm which Anthropic models in my contract are actually export-controlled?
Contact your Anthropic account team in writing and request an explicit list of controlled model families under your enterprise agreement. Anthropic has not necessarily sent proactive notice, and you cannot enforce restrictions on models you have not identified. Retain the response for audit evidence.
What's the fastest technical control to stop deemed-export exposure this week?
Wire a citizenship claim from your HRIS into the IdP, then enforce model-level routing rules at the AI gateway that block Fable 5 and Mythos for sessions carrying a non-US-person claim. Enforcing at the gateway rather than the application prevents developers from routing around the control, and gateway logs provide the audit trail Commerce expects.
Why are agentic AI tools like Manus and Claude Cowork treated as critical shadow-IT risks?
Because they request the same OAuth scopes — mailbox read/send, calendar write, Drive access — that APT29-style consent-phishing campaigns target, except employees grant them voluntarily from managed accounts. Once granted, agentic tools execute actions autonomously with no human-in-the-loop, turning a self-service SaaS signup into an active data-exfiltration channel.
What single control most reduces shadow AI agent sprawl in M365 and Google Workspace?
Enable admin consent workflow with default-deny for high-risk OAuth scopes. Both M365 and Google Workspace support it natively. Without it, any employee can grant any third-party app mailbox, calendar, or file scopes with no security visibility until a log query surfaces the grant weeks later.

◆ Same day, different angle

Read this day as…

◆ Recent in security

Keep reading.

Spot an error? [email protected]