The State Found the Model Switch

00:00:04 Anthropic said late Friday that the United States government had ordered it to suspend access to Fable 5 and Mythos 5 for every foreign national, including foreign national employees inside Anthropic. By Saturday, June 13, the practical effect was simple and ugly: Anthropic disabled both models for all customers while it tried to comply.

00:00:24 The company’s own statement is the best place to start because it’s unusually direct. Anthropic says it received the directive at 5:21 p.m. Eastern. The letter, according to Anthropic, didn’t give specific details of the national security concern. The company says its understanding is that the government believed it had learned of a jailbreak method for Fable 5.

00:00:46 Anthropic says it reviewed a demonstration of that technique and found that it identified a small number of previously known, minor software vulnerabilities. Then comes the part that affects everyone outside the company. Anthropic writes that the findings “all appear relatively simple,” and that other publicly available models could discover them too.

00:01:07 It also says the technique didn’t show a flaw particular to Fable 5’s safety system. The company is complying with a legal order while arguing that the order rests on a bad technical premise. Axios filled in the reported institutional timeline. Maria Curi reported that Amazon called administration officials Thursday night with a report showing how its researchers had jailbroken and accessed portions of Mythos that Amazon believed created a national-security concern.

00:01:35 Axios also reported that Anthropic had previously notified the government about the planned June 9 release of Fable, a general-use version of Mythos, and that the government didn’t object at that point. By Friday evening, according to Axios, the White House sent Anthropic a letter imposing sweeping export controls.

00:01:54 By about 10 p.m., users had lost access. That Amazon detail is awkward. Amazon isn’t just an outside critic. It’s a major Anthropic investor and a cloud provider with obvious commercial interests around frontier model hosting. Amazon told Axios that governments often seek its counsel on potential security risks and that it doesn’t share details of those discussions.

00:02:15 Fine. That may be entirely normal. But a model company being cut off after a report from one of its major investors is exactly the kind of governance knot that makes this industry hard to discuss with a straight face. Katie Moussouris, the Luta Security CEO, told Axios the government’s response “seems way out of line with what’s actually in the research report.” Her point was that the researchers found security vulnerabilities by asking questions normal defenders would ask AI.

00:02:45 Anthropic makes the same argument in its statement: if this standard is applied across industry, it could halt new deployments from all frontier providers. I think there are two separate questions here, and they shouldn’t be blurred. One is whether governments should have authority to block model deployments that create a serious national-security risk.

00:03:06 Anthropic itself says yes, if the process is transparent, fair, clear, and grounded in technical facts. The other is whether this particular order met that bar. On the public record we have now, Anthropic says no, Axios reports a rushed Friday scramble, and the government hasn’t put the technical case in public.

00:03:24 That doesn’t make the government wrong. It does mean the evidence is still mostly behind a door that affected customers, researchers, employees, and foreign partners can’t inspect. Anthropic’s statement has one practical detail that deserves time. The order didn’t only cover customers in foreign countries.

00:03:43 It covered foreign nationals whether they were inside or outside the United States, including Anthropic’s own employees. That turns an export-control idea into an internal labor rule. A company can have an employee on payroll, in the office, and assigned to the product, and still be told that nationality changes what that employee may access.

00:04:03 For a frontier lab full of international researchers, that changes staffing and incident response. It changes debugging, red-team review, and the ordinary flow of engineering work. It also creates a compliance problem that’s much easier to state than to administer.

00:04:19 How does a lab prove that no covered person touched the system? How does it separate logs and prompts from evals and dashboards? What happens to internal bug reports, customer tickets, and model-output traces? Anthropic’s fast answer was to disable the models for everyone.

00:04:35 That may have been the only available move on Friday night, but it shows how crude the first version of this regime is. The order targeted foreign-national access. The operational answer became global customer loss.

00:04:47 The immediate reaction to the Anthropic order split into two camps. One camp said Anthropic invited this by spending years arguing that its strongest models are dangerous enough to need special treatment. The other said the order proves that rented intelligence can disappear the moment a government or vendor changes the terms.

00:05:06 Thomas Wolf, the Hugging Face co-founder, put the open-model case plainly: “Open-source models will become a critical component of civilizational resilience in the AGI age.” I’d file the phrase “AGI age” under words we don’t know how to cash yet, but the dependency claim is much more grounded.

00:05:24 A hospital that reaches frontier capability only through a remote provider has to live with the provider’s policies. So does a university, a local government, or a small company. Its access is governed by the provider, the provider’s cloud relationships, and the provider’s home government.

00:05:41 Cohere made the commercial version of that argument in a reply: “When you rent your artificial intelligence, you have no control, and no choice.” That’s marketing, obviously, but it’s marketing pointed at a real anxiety. The person who planned to use Fable this weekend didn’t lose access because their own machine failed.

00:06:00 They lost access because a legal order moved through a company and its compliance path was to shut the product for everyone. Jeremy Howard, who co-founded fast.ai, made the sharper institutional criticism. He said he disagreed with the decision and didn’t like it, but asked how Anthropic didn’t see the response coming.

00:06:19 His argument was that if a company says a model is too dangerous for anyone except itself to use, it should expect someone else to test the premise that the company is uniquely qualified to hold it. Ethan Mollick took the discussion one layer down, into physical constraint.

00:06:35 He wrote that he doesn’t think this will necessarily produce more open-weight frontier models, because if Mythos-level models are considered risky, China won’t necessarily want them open either. Then he added the useful sentence: training a Mythos-class model uses enough power and chips that national governments will notice.

00:06:54 In his words, no one is training a model of that size without permission. That is the part of the story that survives the weekend argument. The control point isn’t only the model API. It’s the training cluster and the power contract. It’s the chip allocation, the export license, and the nationality of the people allowed to touch the system.

00:07:14 Open weights can matter a great deal for resilience below the frontier. They let institutions keep using useful models when a vendor changes policy. But the frontier itself is now expensive and visible enough that it looks less like a downloadable tool and more like a regulated industrial facility.

00:07:32 The uncomfortable result is that both sides can be partly right. Open models reduce dependence on one company’s uptime and policy choices. At the same time, the very largest training runs are becoming legible to states. If this episode hardens into precedent, the fight won’t be only open versus closed.

00:07:50 It will be which governments can bless a model, which companies can afford the process, and which users find out they were temporary guests in someone else’s jurisdiction.

00:08:00 Axios also had a Saturday piece on electricity, and it belongs next to the Anthropic order because model control increasingly runs through physical systems. Amy Harder reported that the AI-driven power boom is forcing decisions about how America’s electricity system should grow.

00:08:15 Data centers, she wrote, now seek amounts of electricity that used to be associated with entire cities. That’s not a metaphor for demand. It’s a planning problem for utilities, regulators, and everybody else connected to the grid. For decades, utilities could plan around relatively predictable demand growth.

00:08:33 AI data centers change the size and timing of the request. A single project can arrive asking for enough power to alter regional planning assumptions, and then someone has to decide who pays for new transmission, who waits in line, and whether a data center gets to connect directly to a power plant or generate its own power on site.

00:08:52 Harder points to debates at PJM, the nation’s largest grid operator, and at the Federal Energy Regulatory Commission. Some proposals would let data centers connect directly to power plants, at least initially outside the wider electricity grid. That sounds like a clever way to move faster until you ask what it means for everyone else.

00:09:11 If the biggest tech companies can build parallel power arrangements, then local ratepayers, factories, hospitals, and ordinary businesses are left negotiating with a grid whose expansion costs and reliability risks have changed. This is where AI stops being a software story in the old sense.

00:09:27 A new model release can be framed as intelligence arriving from nowhere, but the next training run needs land and water. It needs transformers, turbines, permits, and interconnection queues. The model lab may announce the breakthrough. The utility commission decides whether the substation exists in time.

00:09:44 Electricity regulators aren’t usually treated as AI policymakers, but they’re about to decide how much of the AI buildout becomes public infrastructure and how much becomes private industrial capacity wrapped around power plants. Those are different futures. In one, AI demand helps finance a grid expansion that other users can share.

00:10:03 In the other, the richest users buy their way around the queue and leave regulators to manage the side effects. The Anthropic order showed a government acting directly on model access. The power story shows a slower kind of state power: the permitting office, the grid operator, and the federal agency decision expected as soon as this month.

00:10:23 No one has to say the word “model” for those decisions to shape the model market. If one provider can bring capacity online six months faster because it solved electricity, it gains leverage over labs that still need power. If a state makes data centers pay more of the expansion cost, household bills and local politics become part of the training budget.

00:10:43 I wouldn’t turn that into panic. The United States has built large industrial systems before. But the distributional question isn’t optional. Someone pays for the wires, someone gets priority access, and someone absorbs the reliability risk when demand grows faster than the old planning model expected.

00:11:00 The phrase that should stay with you from the electricity piece isn’t “AI power boom.” It’s “who pays.” A data center can bring tax revenue, construction work, and demand for new generation. It can also pull scarce capacity toward a single large customer. If the buildout improves the shared grid, the public may get a stronger system.

00:11:19 If the buildout is mostly private interconnection plus special deals, the public may get higher complexity without much shared benefit. Regulators are being asked to make that distinction while the companies making the requests are moving faster than the regulatory calendar was built to handle.

00:11:35 There is a labor angle here too, though it’s less visible than the transformer shortage or the megawatt number. Grid planners and permitting staff become part of the AI supply chain. So do utility engineers, environmental reviewers, local officials, and rate-case lawyers.

00:11:51 They aren’t writing prompts or training models, but their work determines whether the next cluster turns on. When people say AI is eating the economy, this is one of the literal mechanisms: it recruits professions that didn’t think of themselves as AI workers and makes their backlog part of the model roadmap.

00:12:08 OpenAI was subpoenaed on Friday by a coalition of state attorneys general, according to Wall Street Journal reporting summarized by Techmeme. The subpoena reportedly seeks documents covering a wide range of OpenAI activities and the company’s impact on users. The timing matters because this was the same week that Anthropic ran into direct federal action over model access and we had already covered lawsuits pressing OpenAI on duty of care.

00:12:34 State attorneys general operate differently from federal AI policy offices. They are closer to consumer protection, children’s safety, unfair practices, privacy, mental-health harms, and the practical ways a product touches households. A subpoena doesn’t prove wrongdoing.

00:12:49 It says officials believe there is enough public concern to demand the company’s records. That is a change in posture. For much of the generative AI boom, the companies have been able to describe user impact through product metrics: adoption, engagement, enterprise seats, usage growth, and safety blog posts.

00:13:07 State investigations ask a different set of questions. What did the company know? When did it know it? Which internal documents describe the risks? Which teams argued for product changes? Which warnings were elevated, and which were treated as acceptable cost? This is how consumer technology companies become institutions under supervision.

00:13:26 It doesn’t happen all at once. A lawsuit here, a subpoena there, a state coalition, a federal hearing, a child-safety complaint, and an employment claim can accumulate until the company’s internal safety memos aren’t internal in the same way anymore. They are potential evidence.

00:13:42 The OpenAI subpoena is also a reminder that national-security politics and consumer-protection politics can move at the same time. One side of government may be asking whether a model can help foreign adversaries. Another may be asking whether the same company’s products harmed vulnerable users, misled customers, or created risks that weren’t disclosed clearly enough.

00:14:03 Those questions don’t share a single doctrine, but they share a pressure point: the lab’s private record becomes more important than its public demos. We don’t yet have the subpoena itself in front of us, so this should be held at the right altitude. It’s not a verdict.

00:14:19 It isn’t even a complaint. But the institutional direction is visible enough. AI companies are moving from “please explain your safety system” to “produce documents.” That matters because document production changes company behavior. People write differently, escalate differently, and approve launches differently when they know state officials may later ask for the paper trail.

00:14:40 There is a danger in cheering every investigation as accountability. Investigations can be broad, political, or technically confused. But there is also a danger in pretending that user harm can be handled through trust pages and voluntary disclosures forever. If AI systems are being used as companions, tutors, search tools, work assistants, and quasi-advisers, state officials are going to ask how the companies measured harm and what they did when the measurements looked bad.

00:15:08 State attorneys general also have a different incentive than Congress. A congressional hearing can be theater, and sometimes useful theater. A state investigation can be slower and more document-heavy. It can ask for complaint data, safety reviews, marketing claims, age-related design decisions, retention policies, and internal debate over whether a product should ship.

00:15:29 If multiple states coordinate, the company isn’t only answering one regulator in Washington. It’s answering officials with their own consumer-protection statutes and their own political pressure from families, schools, and local institutions. That matters for OpenAI’s future public-market story as well.

00:15:46 Investors can tolerate product controversy when growth is fast and liability feels bounded. They price risk differently when state coalitions, private plaintiffs, and federal officials are all asking for records at once. The company can still grow through it. Big platforms often do.

00:16:03 But the cost of being the default AI interface starts to include legal staff, document holds, settlement strategy, age gating, product logs, and a safety paper trail that has to survive someone else reading it in a hostile setting.

00:16:16 In the United Kingdom, The Guardian reported that a Derbyshire police officer is under criminal investigation over the alleged use of artificial intelligence to create evidential material in a number of cases. The officer hasn’t been named and has been removed from frontline duties.

00:16:33 Derbyshire police said the allegation concerns perverting the course of justice. The Crown Prosecution Service said it is working with Derbyshire police, engaging with defence teams and courts in appropriate cases. That is a very different AI story from Anthropic, but it may be easier for a normal person to feel.

00:16:51 If an AI system is used to draft a sales email, the risk is bad copy or a misstatement. If an AI system is used to create evidential material, the risk moves into liberty, prosecution, public trust, and the validity of cases already in motion. The facts are still limited.

00:17:07 The officer’s role hasn’t been disclosed. The exact nature of the suspected misconduct hasn’t been disclosed. No arrests have been made. Derbyshire police say the investigation is in its early stages. So the responsible version is not to assume guilt or describe a technical method we don’t know.

00:17:25 Courts depend on provenance. Evidence isn’t just information that sounds plausible. It has a chain of custody, an origin, a witness, a process for challenge, and a duty of disclosure. When AI enters that chain, everyone has to know whether it summarized, drafted, inferred, altered, or fabricated.

00:17:42 If the answer is hidden or uncertain, defense lawyers have to reopen questions that police and prosecutors may have thought were settled. The Guardian also notes that Alex Murray, head of the National Police Chiefs’ Council’s Police AI centre, had told forces to stop using some AI systems for court statements and other tasks because they may not be reliable enough.

00:18:04 That detail matters because the Derbyshire case isn’t appearing in a vacuum. Police forces are already experimenting with AI for paperwork, triage, staff monitoring, and misconduct detection. Some of that may be useful. Some of it may save time. But court evidence is where “saves time” meets the oldest rule in the building: can the other side test it?

00:18:25 The same article mentions a separate Metropolitan Police deployment of a Palantir-built AI tool used to inspect staff data, which led to investigations into hundreds of officers and arrests in a small number of serious cases. That isn’t the same issue as alleged AI-created evidence, but it shows the range of AI entering policing.

00:18:45 One tool watches officers. Another may help prepare statements. Another may touch case material. Each use has a different standard of proof, disclosure, oversight, and error tolerance. I keep coming back to the same practical sentence: if AI changes a record, the institution has to be able to say how.

00:19:03 Not in a press release. In court. To a defense lawyer. To a judge. To a defendant whose case might turn on whether a document came from a person, a model, or a person leaning on a model more than anyone admitted. There is a mundane reason this will be hard for police forces: most of the incentive points toward use.

00:19:22 Officers are buried in paperwork. Supervisors want faster case processing. Vendors promise structured summaries, tidier statements, and searchable records. If the policy is vague, the model will seep into the work before the institution has decided what counts as use.

00:19:38 A draft statement touched by AI may feel harmless to the person under deadline. In court, the same draft can become a disclosure fight. The repair mechanism is procedural because courts run on procedure. Forces need audit logs and explicit prohibitions for evidence creation.

00:19:54 They need training that distinguishes administrative help from evidential material, and a disclosure rule that doesn’t depend on an officer remembering every prompt. Procedure is how a weaker party gets to challenge the state. AI doesn’t remove that need. It makes the provenance question easier to mishandle.

00:20:12 SpaceX went public Friday at a valuation that The Guardian put at $2.1 trillion by the close of its first trading day. Dara Kerr reported that the company opened at $150 a share, rose as high as $176, and ended at $160, up more than nineteen percent from the initial price.

00:20:28 The listing made Elon Musk the world’s first trillionaire by Forbes’s estimate. This isn’t an AI lab IPO in the narrow sense. It’s rockets, Starlink, satellites, xAI, X, and a public-market version of Musk’s combined industrial story. But that is why it belongs here.

00:20:45 AI market power isn’t only model subscriptions. It is capital markets deciding that compute, launch capacity, satellite internet, social distribution, and a frontier AI company can be valued as one strategic bundle. The same Guardian piece notes that SpaceX reported $18.7 billion in revenue last year and a $4.3 billion operating loss.

00:21:05 Meta, by comparison, generated more than $200 billion in revenue and more than $60 billion in net income. That contrast is useful because it reminds you how much of the valuation is a bet on control over future infrastructure rather than current earnings. Investors aren’t buying a simple profit stream.

00:21:23 They are buying a claim on the machinery around AI and space. There was another SpaceX report: Bloomberg reporting, summarized by Techmeme, said SpaceX decided to rent its Colossus 1 data center to Anthropic after internal teams struggled to use it for Grok development because of latency issues.

00:21:41 We don’t have the full Bloomberg article here, so keep it as reported sourcing rather than settled engineering diagnosis. Still, the reported fact fits the larger story: large AI infrastructure can change hands, be repurposed, and become part of another lab’s capacity plan.

00:21:58 A data center built for one empire can become supply for another. NVIDIA’s AgentPerf post gives the more technical accounting version of the same market pressure. NVIDIA says agentic AI shouldn’t be measured like a single chat response. An agent breaks a task into many steps.

00:22:15 It chains large language model calls and tool calls, and it carries growing context through the run. In the first AgentPerf results from Artificial Analysis, NVIDIA says its GB300 NVL72 platform ran up to twenty times more agents per megawatt than Hopper. Vendor benchmarks deserve skepticism, especially when the vendor sells the hardware being praised.

00:22:36 But the metric itself is telling. Agents per megawatt is the phrase. Not just tokens per second. Not just benchmark score. Agents per megawatt. That is where the economics are going: how much useful work can a platform deliver for each watt, rack, dollar, and waiting month in the power queue.

00:22:54 So Saturday’s episode doesn’t end with one model being shut off. It ends with a set of institutions discovering where AI power is attached. The government can touch access. Grid regulators can touch capacity. Attorneys general can touch the documents. Courts can touch evidence.

00:23:10 Public markets can turn infrastructure into household exposure through index funds and retirement accounts. The next hard evidence will be whether the government publishes a technical basis for the Anthropic order, and whether Anthropic restores access under a process customers can understand.

00:23:28 Jonas