Cognition Is a Controlled Substance

It was a Friday evening, and something you had come to rely on stopped answering. Perhaps you were halfway through a build. The call to the model returned an error, then another, so you did what everyone does. You checked the status page. On Amazon’s it read, in the flat language of infrastructure notices, that access to Claude Fable 5 and Claude Mythos 5 was unavailable, and that Anthropic had asked for it to be revoked for every user to comply with a United States government export control directive. Three days earlier that same model had launched as the most capable thing the public could touch. Now it was gone for everyone at once.

You did not export anything. You did not download a set of weights or carry a chip through customs. You typed into a box on a website, and a machine in someone else’s building typed back. On Friday the government decided that this, the answering itself, was something it could license, restrict, and switch off. And it did.

The sequence is short. On the ninth of June, Anthropic released a new tier of model, a clear step above anything it had shipped before. It came in two forms. Fable 5 was the public version: the full capability, wrapped in safety classifiers that intercept the most sensitive requests and route them down to a weaker model. Mythos 5 was the same engine with those guardrails lifted, locked to a small set of vetted partners through a cyber defence programme. The safe one for everyone, and the unrestricted one behind a locked door. Both were described, by the company itself, as powerful enough to help defenders and powerful enough to help attackers. That was both the selling point and the warning.

On the twelfth, at 5:21 in the evening Eastern time, a letter arrived from the Commerce Secretary to Anthropic’s chief executive. Fable 5 and Mythos 5 were now subject to export controls. No foreign national could use them, whether inside the United States or outside it, and that included Anthropic’s own foreign born staff. The reason given, as far as anyone has been told, was a jailbreak: a way of getting the model to read a codebase and point out the security holes in it. The letter did not spell out the national security concern. There was no public justification, no risk tiering, no window to appeal.

Anthropic could not separate foreign nationals from everyone else in real time across a shared service, so it did the only thing that guaranteed compliance. It switched both models off for every customer worldwide, and asked the clouds it runs on, Amazon among them, to revoke access too. Every other Claude model stayed up. The company said it disagreed with the order, believed it was a misunderstanding, and would work to restore access. It gave no date.

That is the whole event. A frontier model went from generally available to gone in the space of an evening, by letter, with no chip shipped and no file moved.

I had been using Fable since Wednesday. It is the most capable model I have worked with. It is fast, and the output is good enough to trust. I used it to build whole training frameworks in a few hours, to re-engineer systems I had already built, and to stand up agents that would normally have been a much bigger job. Work that used to take days or weeks took minutes or hours instead.

It was not cheap, about twice the running cost of the model below it, and it used up my plan allowance quickly. It was still worth it. Plenty of other people spent the week the same way, rebuilding software they already had, because the model was finally good enough to make that worth doing.

That is what got switched off on Friday, three days after it launched.

Export controls are old machinery. For decades they governed atoms: a chip you could ship, a centrifuge, a piece of hardware with a serial number. Later they reached technical data and source code, the blueprints rather than the thing, through a rule that treats handing controlled code to a foreign engineer in your own office as if you had exported it to their home country. Lawyers call this a deemed export. It is a sensible idea when the worry is that knowledge walks out of the building in someone’s head or on a drive.

What happened on Friday is not that. Nothing walked out. The weights never left Anthropic’s servers. The model sat exactly where it had always sat, and the government reached across the wire and stopped the inference. The thing being controlled was not a product moving across a border. It was a sentence being generated in response to a question.

A model is no longer only a product you rent. It is now, in the eyes of at least one government, a controlled capability that the state can license like a weapon and disable on command. The off switch exists. It is not in your hands, and it is not in the hands of the company you pay. It sits with a department in Washington, and it can be thrown by a letter you are not allowed to read.

In the 1990s the United States classed strong encryption as a weapon. It sat on the same munitions list as missiles and fighter jets, and exporting it without a licence was a crime. The reasoning was the one being used today: a dual use capability, powerful enough to matter to national security, kept out of foreign hands.

It did not hold. The mathematics was already published and taught in every university, so the controls mostly handicapped American companies while foreign rivals sold the same thing without restriction. And the courts decided that source code was protected speech, which turned a trade rule into a constitutional problem. By around 2000 the controls had been largely unwound, after American firms had spent a decade competing with one hand tied while the capability spread anyway.

That decade has an uncomfortable lesson for the policy. Controlling a capability that is already widely available tends to punish the home industry more than the adversary it was meant to stop. Anthropic’s central complaint, that comparable ability already exists in other models, is the same argument that eventually took the encryption controls apart.

The government’s side has a real case, stronger than its critics allow, and it deserves to be put properly.

Mythos class models are good at finding software vulnerabilities. Not in a vague, marketing sense. The earlier preview was kept behind tight access gates precisely because of how capable it was at locating and exploiting flaws in code, and the company built broad safeguards into the public version for the same reason. A model that can read an unfamiliar codebase and chain its weaknesses into a working attack is a different category of tool from a chatbot that drafts emails. If you sit in a national security role and you are shown a credible way to turn that capability against critical systems, doing nothing is not a neutral choice. And the government did not act without warning. It had reportedly asked Anthropic to hold the release back, and the company went ahead.

There is also the uncomfortable matter of who asked for this power to exist. Anthropic has argued, in public and at length, that governments should have the legal authority to block dangerous AI deployments. That position is coherent and, to many people, correct. The difficulty is that the authority they championed has now been used against them, stripped of every safeguard they said should come with it. They asked for a brake pedal. They did not ask for one that any official could press without explanation, notice or review. The state should be able to stop a genuinely dangerous system. This use of that power was opaque, disproportionate and without any real process.

Reasonable people are landing on both sides. One camp sees a reckless model release reined in. The other sees a company punished by letter for capability that competitors sell openly, including a comparable coding ability available from at least one rival lab. The capability concern is real. The process was indefensible. And the process is the part the rest of us will have to live with.

Start with the most concrete consequence, the one a developer felt on Friday. The phrase generally available has lost its meaning. It used to imply a floor: the model is here, it is stable, you can build a business on it. Now it carries an asterisk. A model can be generally available on Tuesday and unreachable by government order on Friday, with no notice and no appeal, across every cloud at once.

That changes how serious software gets built. Provider lock in was already a known risk. Political revocation is a new one, and it does not respond to the usual mitigations. A second account does not help you. A different region does not help you. The only real hedge is to design so that no single model sits on your critical path without a tested fallback, and to treat the model layer as something you can swap rather than something you marry. Every team that had Fable in production learned this lesson in an afternoon, the expensive way.

There is a deeper shift underneath the engineering one. Every powerful model release is now a policy event, not only a product event. The question a buyer asks is no longer just how good is this model and what does it cost. It is also who can switch it off, under what authority, and what happens to me when they do. That question used to belong to people who bought satellites and encryption. It now belongs to anyone whose business runs on a hosted frontier model, which is to say almost everyone reading this.

One consequence will outlast the incident. If a hosted model can be withdrawn by letter, the rational response for anyone who needs certainty is to stop renting capability they cannot control and start running weights they own.

It is already happening. Within an hour of the shutdown, a foundational AI company operating across the United States, the United Kingdom, Australia and four other countries published a pointed response. Every model they ship, they said, has been available for air gapped self hosting since the day it launched, and they had no intention of changing that. They did not have to scramble. Their customers were never exposed to an off switch in Washington, because there was no switch to throw. Sovereignty was already built into the product.

Expect a great deal more of that. The buyers who care most about continuity, regulated industries, national institutions, anyone outside the United States, now have a worked example of why a model they fully control is worth a real premium. Open weight models you host yourself cannot be disabled by directive, because there is no provider to serve the directive to. That property used to read as a footnote for the security conscious. It now reads as a strategic advantage.

The asymmetry underneath this should trouble anyone who cares about safety. A control like this can only reach a model that runs on a provider’s servers. A model whose weights have been published cannot be recalled by anyone, because the weights are already sitting on thousands of hard drives around the world. So the lever the government pulled works only on the labs that host their models, watch how they are used, and keep the ability to switch them off. The labs that release their weights into the open are beyond its reach. The careful approach is the exposed one, and the approach that worries safety researchers most is the one no letter can touch.

The policy carries an awkward contradiction. A measure designed to restrict foreign access to American capability is a strong argument for foreign buyers to adopt models that are not American at all. Some of the best open weight models in the world come from outside the United States. A control aimed at keeping capability away from foreigners may end up teaching foreigners to stop depending on American models in the first place. That is close to the opposite of the intended effect, and it is being said openly across the industry.

Governance is where this gets hardest, because there is no easy fix.

A government has established, in practice rather than in theory, that a commercial AI model can be treated as a controlled national asset with a real time off switch. It did this without publishing the rule. The letter is not public. So every other lab is now trying to reverse engineer the red line: which capability, which prompt, which red team result earns a letter of your own. You cannot engineer around a rule you are not permitted to read. That uncertainty does not freeze one product. It chills the next dozen releases across the whole field, which is exactly what Anthropic warned would happen if the standard were applied broadly.

There is a sharper edge still. The action reportedly began when a rival company reported the jailbreak to the administration. If reporting a competitor’s vulnerability can trigger a government shutdown of their flagship product, then disclosure stops being a safety practice and starts being a competitive weapon. That is a dangerous incentive to introduce into a young industry, and nobody designed it on purpose. The precedent creates it on its own.

For those of us outside the United States, the governance question is not abstract. The directive bars foreign nationals, and that net catches the United States’ closest allies. A British engineer, a Canadian researcher, an Australian institution: all foreign nationals to an American model, regardless of how aligned their governments are. If you are reading this in London, as I am, you have just learned that your access to the most capable American models is contingent on a relationship between your supplier and a government that is not yours, and that the relationship can change between one evening and the next.

The dependency runs deeper than access. The frontier of American AI sits with a few labs and three American clouds, so the most capable models on the planet pass through infrastructure that one government can switch at will. For an ally, that is not a billing inconvenience. It is strategic dependency. And the order reaches inward as well as outward. The foreign nationals it shuts out include the engineers building these models from inside American companies, in an industry that runs on imported talent. A measure aimed at foreigners abroad lands on the people in the building.

This is not the first collision between this company and this administration. Earlier in the year, after Anthropic refused to let the military use its system for autonomous weapons and mass surveillance, the government moved to bar its products from federal agencies, and a court found the conduct looked like retaliation for protected speech. So the company now sits in a strange double bind: too dangerous for the government’s own use according to one arm of the state, and too dangerous for foreign use according to another. Whatever you think of Anthropic, a world where capability is governed by feud rather than by clear and stable rules is bad for everyone who builds on top of it.

That history matters for what comes next, because it is not even clear this order would survive a challenge. Treating a remote conversation with a hosted model as an export is a novel reading of the law, and it runs into the same wall the encryption controls hit: courts have already held that code can be speech. A company with a live free speech case against this same government, one it has already won a first round in, handed an opaque order with no published basis, is not likely to keep complying without a fight.

Most likely, Fable comes back. The dispute is live, the company is pushing, and a negotiated narrowing of the order is the obvious resolution. If you are waiting to use the model, you will probably get it back within days or a few weeks. Hold that as the base case.

But the model returning does not retire the precedent, and the precedent is what matters. Three futures sit in front of us.

In the first, this is a one off. An overreaction, walked back, remembered as the week the government overstepped and then retreated. Even here, something has changed: the tool now exists, everyone has seen it used, and no future release will be planned without it in mind.

In the second, this becomes a repeatable instrument. Every sufficiently powerful release triggers a review, a licence, a possible letter. The market splits cleanly in two. On one side, American frontier models, the most capable, governed as controlled assets, available to the right nationals under the right conditions. On the other, open weight models, slightly behind on the benchmarks, available to anyone, switchable by no one. Builders choose which world to live in based on how much certainty they need, and a great many will choose the world without an off switch.

In the third, this forces the question of sovereign infrastructure. Governments and large enterprises outside the United States decide that depending on a capability another country can revoke is an unacceptable risk, and they fund, buy or build models they control end to end. The compute, the weights, the serving, all inside their own borders. This is the most expensive future and the slowest to arrive, but Friday made the business case for it in a single evening, and the people who already believed in it now have their evidence.

These are not mutually exclusive. The most probable path is the first in the short term and the second and third together over the longer one. The capability gets reined in this month, and the structure of the industry bends towards control and towards sovereignty over the next few years.

You do not need to panic, and you do not need to rip out your stack. You need to change one assumption.

Stop treating model access as a settled utility, like electricity from the wall. Start treating it as a dependency with political risk attached, like a currency you hold or a supplier in a country whose politics you do not control. That single shift changes your decisions in useful ways. You keep a tested fallback for anything that matters. You favour an architecture where the model is a component you can replace, not a foundation you have poured. You ask your suppliers the new question, the one about who can switch this off, and you treat a good answer as worth paying for.

And you put your effort where no letter can reach. The model is the part the state can disable. The orchestration around it, the context you have assembled, the workflows you have built, the judgement encoded in how you route and combine and check the work: that is yours, and it does not have an off switch in Washington. The model was always the most replaceable part of the system. Friday made that visible in a way no amount of argument could. The durable advantage was never the engine. It is the car you built around it, and your willingness to change the engine without stopping the car.

A model was switched off by letter this week. It will probably come back. The question it leaves behind will not: how much of your future are you willing to rent from someone who can be told, by someone else, to take it back?

If this landed, subscribe. The next anchor piece looks at what sovereign inference actually costs once you stop hand waving about it: the compute, the talent, the unglamorous economics of owning the layer nobody can switch off.

Craig Hepburn is an AI strategist and Perplexity Fellow. Twenty years building at the frontier of digital, from Microsoft and Nokia to Art Basel and UEFA. Now building at the frontier of agentic intelligence.