Washington Put the Autonomous Cyberweapon Back Online and Left the Chatbot Dark. Safety Was Never the Variable.
On June 12 the US government pulled two Anthropic models off the market, then quietly restored one: Mythos 5, the model that writes its own zero-day exploits, went back to ~100 vetted organizations while the general-purpose Fable 5 stayed dark for everyone. Graded as risk management that is exactly backwards — which is the point. Across five separate actions, Washington has stopped regulating frontier AI and started allocating it: deciding org-by-org who may run which model, with no statute, no published criteria, and no appeal.
The US government pulled two of Anthropic's newest models off the market on June 12, and then it put one back. It restored Mythos 5 — the model whose selling point is that it discovers and writes zero-day exploits on its own — to roughly a hundred organizations. It left Fable 5, the general-purpose model that drafts emails and writes code, dark for everyone, including paying subscribers who had gained access three days earlier. If you grade that sequence as risk management, you have it precisely backwards: the state took the autonomous offensive-cyber tool and handed it back to a select list while keeping the harmless one switched off. Backwards is the tell. This was never risk management.
Here is what it was. Washington has stopped trying to regulate frontier AI and started allocating it — deciding, organization by organization, who is permitted to run which model. Not through a law. Through a list. The press has covered the past few weeks as "AI regulation finally arrives," and that framing is close to the opposite of what happened. A rule is published, applies to everyone, and can be appealed. What the government built instead is discretionary, case-by-case, and unwritten, which is a larger power than any rule, not a smaller one.
The mechanics of the June 12 action matter, because they are the template. Anthropic launched Fable 5 and Mythos 5 on June 9. At 5:21 p.m. ET on June 12, Commerce's Bureau of Industry and Security — Secretary Howard Lutnick's letter — served an export-control directive built on the "deemed export" rule, which treats giving a foreign national access to controlled technology as an export to their home country. That rule was written for physical goods and on-premises hardware, not a hosted API. Because Anthropic could not verify the citizenship of every user in real time, the only way to comply was to disable both models worldwide. A deemed-export rule meant for shipping crates produced a roughly 15-day global recall of a commercial cloud service. That is the first confirmed instance of a US export order pulling a deployed frontier model off the market, and it should not be filed under "narrow national-security response."
The stated trigger was a jailbreak demonstration, and the severity is in open dispute. Anthropic says the demo surfaced "a small number of previously known, minor vulnerabilities"; White House AI adviser David Sacks says Anthropic "refused to fix" the problem. I am not going to adjudicate that — nobody outside the room can yet — but notice that the dispute is beside the point. Whatever the jailbreak was, it cannot explain why the offensive model came back and the benign one didn't. A safety rationale that restores the dangerous capability and withholds the safe one is not a safety rationale.
Read the export action next to four other moves from the same stretch and the single mechanism comes into focus. One: the export control itself, applied to SaaS for the first time. Two: procurement clearance — the Pentagon cleared eight firms for classified IL6/IL7 networks and excluded Anthropic, reportedly after it refused to drop its surveillance and weapons guardrails; access as a compliance lever. Three: pre-launch gating — OpenAI's GPT-5.6 shipped to only about twenty government-approved companies, with the administration signing off customer by customer. Four: equity — the government is reportedly in talks, at Sam Altman's suggestion, to take a direct ownership stake in OpenAI (talks only, no terms, so treat it as a proposal, not a deal). Five: coalition — at the G7 in Évian, the heads of Anthropic, Google DeepMind, and OpenAI co-authored a China-exclusionary access-and-chips bloc with heads of state. Five instruments, one power: discretionary control over who runs what.
The common denominator is the absence of the thing everyone keeps calling it. There is no statute, no published criterion, and no appeal. The Annex A allow-list that brought Mythos 5 back online for ~100 critical-infrastructure organizations has no published entity standard — you are on it or you are not, and nobody has told you why. TechPolicy.Press has it right that each enforcement action is becoming its own precedent, which is governance by accumulation rather than by rule. And the chip story confirms which lever is live: when the administration approved H200 sales to China in January, Beijing blocked them and zero chips moved. The trade policy was inert. The allocation — who is allowed what — is the entire game.
The legal foundation is thinner than the confidence behind it. Whether API access even counts as an "export" is genuinely unsettled; the House felt it needed a separate Remote Access Security Act precisely because hosted access wasn't clearly covered. That question is now in court: Legion LegalTech v. United States, filed June 23 in the DDC, argues no existing export control reaches a hosted model or its outputs. The plaintiff is a customer, not Anthropic, which makes it the cleanest possible test of whether running a prompt is an act of export. If that case wins, the legal basis for the whole apparatus gets a lot shakier — watch it.
The complication that should bother you most is who is asking for this. The labs are not resisting the cage; several are building it. Dario Amodei and Demis Hassabis personally advocated the structured-access, China-exclusion coalition — the governed lobbying for the governance, because an allow-list with you on it is a moat against everyone who isn't. That alignment of interest is also the seed of the worst-case outcome. A government weighing an equity stake in OpenAI while it decides who may run OpenAI's competitors is a regulator contemplating ownership of the regulated. There is no published firewall because there is no published anything.
One discipline before the projection: don't over-connect this. It is tempting to say Anthropic's guardrail refusal caused both the Pentagon exclusion and the harsher export treatment, and the Pentagon link is on the record. The export link is not — Mythos 5 is an autonomous zero-day weapon, and its capability alone is sufficient to draw BIS attention without any guardrail grudge. One refusal driving both penalties is a clean story and an unproven one. Leave it as a hypothesis.
Where this goes: a durable two-tier regime — cleared defenders on one side, everyone else on the other — formalized through the Annex A template and the audit-and-preemption machinery taking shape in the GAAIA draft, whose "development versus deployment" line is the legislative front of the same fight the export order opened administratively. The structural shift no S-1 has priced is that a frontier lab's addressable market is now partly set by a government list. Anthropic ate a 15-day flagship outage — enterprises reportedly decamped to DeepSeek during the blackout, which means exclusion at home manufactures demand abroad — right as it tries to sell investors an IPO story. I think this hardens rather than reverses, because every party with power here, including the labs, gets something from it. What would change my mind: BIS publishing real Annex A criteria with an appeal path, or Legion v. US establishing that a prompt is not an export. Until one of those happens, the model is no longer the unit of regulation. You are.