The Model Needed A Diplomatic Channel

00:00:04 Anthropic staff were in Washington on Sunday to meet White House officials about the Fable 5 and Mythos 5 shutdown, according to Axios. That is the update to yesterday's story, and it matters because the dispute has moved out of the status page and into the room where export-control decisions get negotiated.

00:00:22 Axios says senior technical staff from Anthropic were there to try to fix a fight that had taken the company's top models offline. Administration officials, in the same report, claimed Anthropic had not engaged in a serious manner. A source close to the company said Anthropic technical staff had held virtual meetings with White House officials since the first outreach on Friday.

00:00:44 Sources from both sides said they wanted a resolution. Axios labels this a developing story, so I would keep the facts narrow: the models are still the subject of a government order, Anthropic is trying to restore access, and the dispute is no longer only about whether one jailbreak worked.

00:01:01 The order didn't just block a customer class. Anthropic said the government directive required it to suspend access to Fable 5 and Mythos 5 by any foreign national, including foreign national Anthropic employees. The company said that, to comply, it had to disable both models for all customers.

00:01:19 That detail turns this from a safety argument into an institutional control argument. If the compliance target is nationality, and the provider's own workforce crosses that boundary, the provider may lose the ability to operate the model at all. Anthropic's statement says the directive arrived at 5:21 p.m.

00:01:37 Eastern on Friday and didn't provide specific details of the national security concern. The company's understanding was that the government believed it had become aware of a method of bypassing, or jailbreaking, Fable 5. Anthropic says it reviewed a demonstration of that technique being used to identify a small number of previously known, minor vulnerabilities, and that other publicly available models could discover the same vulnerabilities without the bypass.

00:02:04 That may be true. It may also be incomplete. We don't have the government letter, the full demonstration, or the internal risk assessment that produced the directive. But the asymmetry is already visible. Anthropic can publish a long technical disagreement. The government can issue an order.

00:02:21 Customers can only wait. There is a temptation to treat this as another lab-versus-regulator fight, and that misses the more immediate fact. A frontier AI model became a controlled asset over a weekend. The company's remedy wasn't a patch note. It was a delegation to Washington.

00:02:37 If you depend on one provider's most capable model, the risk isn't only whether the model hallucinates, whether the price changes, or whether the provider has downtime. It is whether a national-security office, a trade official, or a political appointee can make your access contingent on facts you may never get to see.

00:02:56 Yesterday I said I wanted to know whether the government would publish a technical basis and whether Anthropic could restore access through a transparent process. On Sunday, the answer was no on the first and not yet on the second. The technical basis remains mostly inside claims and counterclaims.

00:03:14 The restoration path looks less like a normal incident response and more like a diplomatic repair job.

00:03:20 Anthropic launched Fable 5 and Mythos 5 by saying Fable was a Mythos-class model made safe for general use. That is almost the whole fight in one sentence. The launch post says, quote, "Fable 5’s capabilities exceed those of any model we’ve ever made generally available." Anthropic described it as a model with exceptional performance in software engineering, knowledge work, vision, scientific research, memory, and long-running tasks.

00:03:46 It also said that without safeguards, the same capabilities in areas like cybersecurity could be misused to cause serious damage. So the product structure was split. Fable 5 used safeguards. Some requests involving cybersecurity, biology and chemistry, or distillation were routed to Claude Opus 4.8 instead.

00:04:04 Users would be told when that happened, and Anthropic said more than ninety-five percent of Fable sessions had no fallback at all. Mythos 5, by contrast, was the same underlying model with some safeguards lifted for a small group of cyberdefenders and infrastructure providers, initially through Project Glasswing and in collaboration with the U.S.

00:04:25 government. You can hear the institutional compromise in that design. One model for the broad market. One model for trusted actors. One classification layer deciding when the safer public version silently becomes a less risky fallback. A thirty-day retention policy for Mythos-class traffic so Anthropic can study jailbreaks and attacks across requests.

00:04:46 That isn't just product packaging. It is a private company building a release-control regime around a capability it believes has crossed a threshold. Then, hours before the government directive, Anthropic Chief Commercial Officer Paul Smith gave Forbes the plain version of the tradeoff.

00:05:03 He said, quote, "You have to make a judgment call on these things." He added that the safest option is not letting people use the model at all, but then, as he put it, how does that help people derive value from Mythos-level intelligence? That quote refuses the fantasy that safety decisions are purely technical.

00:05:21 The company can measure jailbreak resistance, run red-team tests, add classifiers, log traffic, and narrow false positives. It still has to decide how much capability to release, to whom, under what monitoring, and with which customers losing functionality when the classifier fires.

00:05:38 Anthropic's answer last week was conservative but commercial: release Fable broadly, keep Mythos restricted, and use fallback behavior for risky domains. The White House's answer, at least as Anthropic describes it, was more categorical: suspend access for foreign nationals.

00:05:55 Anthropic replied that the finding was narrow, non-universal, and not specific enough to justify recalling a commercial model deployed to hundreds of millions of people. The company's strongest line was that if this standard applied across the industry, it would essentially halt new model deployments for all frontier providers.

00:06:14 I don't know whether that is overstated. Companies under regulatory pressure often make the precedent sound maximally alarming. But a serious question sits underneath it. If a non-universal jailbreak for known vulnerabilities can trigger an export-control shutdown, every frontier launch becomes exposed to a last-minute veto.

00:06:33 The government may need that authority for dangerous systems. People outside the order still can't see the evidentiary threshold. Anthropic itself has argued that government should have the ability to block unsafe deployments through a statutory process that is transparent, fair, clear, and grounded in technical facts.

00:06:53 On this one, the company says the action didn't meet that standard. That is the awkward part: Anthropic asked for release control in principle, and then objected when release control arrived through an opaque directive.

00:07:05 The Anthropic fight didn't stay domestic. Reuters, summarized by Techmeme, reported that the European Commission was assessing the practical consequences of the U.S. restrictions and said such measures "should not be discriminatory against partners." Bloomberg, also summarized by Techmeme, reported that Canadian Prime Minister Mark Carney said the ban showed the dangers of "over-reliance on certain models" and compared the risks to those that led to the 2008 financial crisis.

00:07:33 Those two reactions have different jobs. The European Commission is talking like a trade and sovereignty regulator. If Washington can restrict a U.S. lab's model in a way that affects European users, employees, and firms, Brussels has to ask whether allied customers are being treated as collateral.

00:07:50 Canada is using financial-system language. Carney's comparison to 2008 may sound dramatic, but the underlying idea isn't exotic: concentrated dependence on opaque instruments can create system risk before everyone agrees on what the instrument is worth. AI dependency isn't identical to mortgage-backed securities, and we shouldn't force the analogy.

00:08:11 A model outage doesn't become a banking crisis because a prime minister used the comparison. But the wording tells you where governments are placing the worry. They aren't asking only whether a model is safe enough to release. They are asking what happens when a small number of models become embedded in companies, public agencies, cyber defense, research labs, and national productivity plans, and then one government can pull a lever.

00:08:36 That question is sharper because Fable and Mythos weren't minor models. Anthropic's own launch post presented them as its most capable generally available system and its strongest trusted-access system. The company cited customers using Fable for long-horizon coding, finance reasoning, legal redlines, frontier physics work, and spreadsheet tasks.

00:08:56 It said Mythos had helped protein-design experts accelerate parts of drug design by around ten times, and that the model had produced molecular-biology hypotheses advanced to experimental evaluation. You can be skeptical of vendor launch examples and still see why foreign governments care.

00:09:13 If these systems sit inside cybersecurity operations, scientific workflows, and regulated industries, access isn't just a software subscription. It is a dependency that gets entangled with national capability. A European hospital, a Canadian bank, or an allied government contractor may not think of itself as importing a controlled American asset.

00:09:33 This weekend's fight says it might be. There is also a labor angle inside the sovereignty angle. Anthropic said the order covers foreign national employees. That means the rule doesn't map neatly onto where the customer sits. It maps onto who the person is. In a global AI company, that can affect internal engineering, safety testing, customer support, and incident response.

00:09:54 It is one thing for export controls to restrict sales into hostile jurisdictions. It is another for those controls to split a company by passport in the middle of operating a model. The open-model community's reaction, unsurprisingly, has been to say this is why local models matter.

00:10:11 I think that is partly right and partly incomplete. Open models can reduce dependence on one API vendor, and they are harder for one government order to switch off everywhere at once. But frontier training still depends on chips, energy, data, capital, and legal exposure.

00:10:26 A distributed model ecosystem helps, but it doesn't make national control disappear. It moves the control points. Europe's line about partner discrimination and Canada's line about model concentration are the two international versions of the same pressure. If AI becomes a general-purpose input for institutions, countries won't accept permanent dependence on another country's private labs without asking what happens during a dispute.

00:10:52 The Anthropic order gave them a live example, and it arrived before the governance language had caught up.

00:10:58 President Trump said Sunday he wouldn't back renewal of Section 702 of the Foreign Intelligence Surveillance Act unless Congress attached his SAVE America Act voting bill, according to Axios. That isn't an AI story in the narrow product sense. It belongs here because the same state capacity that governs foreign intelligence, data access, and surveillance is increasingly the state capacity that will govern AI systems.

00:11:23 Axios reports that Section 702 lapsed Friday for the first time since the program began in 2008, after the House failed to extend it in a 198 to 218 vote. Nineteen Republicans joined Democrats to block the law. The authority lets the government surveil foreigners abroad and, in the process, collect and search Americans' communications when they are in contact with those targets.

00:11:45 Conservatives including Thomas Massie, Chip Roy, and Mike Lee have pushed for warrants for searches involving Americans. Trump's demand tied that surveillance renewal to proof-of-citizenship and photo-ID voting legislation. His quoted line was: "I'm against FISA if it doesn't come with The Save America Act (Full version!) firmly attached to it." Axios also notes that he defended Bill Pulte, a housing regulator and MAGA enforcer with no national security experience, as acting director of national intelligence, while Senate Republicans were uneasy about what Pulte could do with FISA's warrantless powers.

00:12:21 The AI connection isn't that Section 702 is secretly about chatbots. The connection is administrative. Advanced AI systems are hungry for data, useful for intelligence analysis, attractive to security agencies, and difficult to audit after the fact. If the legal authorities for collecting and querying communications are being bargained against voting rules, and if leadership posts over those authorities are contested on loyalty grounds, then the future AI layer on top of that surveillance system inherits a legitimacy problem.

00:12:53 This is where civil-liberties people and AI-safety people sometimes talk past each other. One group worries about model capability, misuse, and release thresholds. The other worries about warrants, oversight, abuse, and political targeting. In practice, a capable model connected to a contested surveillance authority is both problems at once.

00:13:13 It can make analysis faster, but it can also make searches broader, triage more automated, and mistakes harder for a person to challenge. The lapse itself may be temporary. Congress can revive the authority. Courts, agencies, and telecom providers may end up living in a transition period while the politics move.

00:13:32 But the Sunday fight gives us a useful reminder: state power over AI won't arrive as a neat AI bill with clean headings. It will arrive through intelligence law, export controls, procurement rules, voting fights, budget leverage, and personnel choices. That matters for the Anthropic story too.

00:13:49 The same weekend gave us a model-access directive whose technical basis was not public and a surveillance authority whose renewal was tied to a separate political demand. Different files, same problem: when the state reaches for high-consequence technical systems, the process has to be visible enough that institutions outside the executive branch can assess it.

00:14:11 Otherwise every side starts treating technical governance as raw leverage. I'm not saying Section 702 should or shouldn't be renewed in this exact form. The warrant debate has substance. So does the foreign-intelligence need, and so does the abuse risk. I am saying that AI makes the old surveillance fights less separable from the new model-governance fights.

00:14:32 Once software can summarize, classify, prioritize, and correlate at institutional scale, the question of who may query which data under what rule becomes even less forgiving.

00:14:42 The Financial Times, summarized by Techmeme, says the AI boom is changing U.S. stock markets as hyperscalers cut buybacks and raise capital for AI spending. The line quoted in the summary is blunt: "Big Tech no longer prints money; it needs it." The same summary cites Alphabet's planned roughly eighty-five billion dollars in equity offerings for AI.

00:15:03 That item sits next to a Forbes detail from the Anthropic interview: SpaceX's S-1 reportedly says Anthropic is paying SpaceX fifteen billion dollars a year through 2029 to run models on the Colossus supercomputer. Paul Smith told Forbes the deal came together because Anthropic wanted to diversify compute sources and SpaceX wanted to diversify who used that compute.

00:15:25 His line was that it came together "very, very, very, very quickly." Dryly, that is about the speed you expect when both sides are holding a very expensive dependency and would like someone else to share it. For the last several years, the public AI conversation has often treated model capability as the central variable.

00:15:45 Better model, bigger context window, stronger benchmark, more autonomous task completion. That still matters. But the weekend's market items point to something more prosaic: the institutions funding this buildout are moving from cash machines to capital absorbers.

00:16:01 Data centers, chips, power contracts, networking gear, and long-term compute leases aren't small operating expenses. They change balance sheets. That matters outside tech because it changes who gets pulled into the financing chain. Equity investors, energy regulators, local communities, transmission planners, cloud customers, and public markets all become part of the AI story.

00:16:23 If a hyperscaler cuts buybacks to fund AI capacity, shareholders feel it. If a lab signs a multiyear compute deal, its future product economics have to support that cost. If a utility has to plan for data-center demand, households and factories may end up arguing over who pays for grid upgrades.

00:16:41 The Anthropic shutdown adds a strange wrinkle. Imagine committing billions to compute for a model class that can be interrupted by export-control disputes. That doesn't mean the deal was irrational. It means compute finance and policy risk are now joined. Lenders and investors will increasingly ask whether a model provider has diversified compute, diversified markets, and a realistic path through national-security review.

00:17:06 Customers will ask a simpler question: if I build on the expensive model, does it stay available when the politics change? The labor story is moving in the same direction. Techmeme summarized Casey Newton's Platformer interview with Brookings researcher Molly Kinder about her "messy middle" essay on AI-driven disruption of knowledge jobs.

00:17:27 Kinder is leaving Brookings to work on solutions for that middle zone, where AI changes tasks before job titles, firms, or policy systems know what to do. That phrase is useful because it avoids the fake certainty of total automation on one side and no change on the other.

00:17:43 A company doesn't have to replace a whole department for workers to feel the pressure. If software can draft, review, classify, code, summarize, and route work, the first effect may be that fewer junior people get hired, mid-level workers supervise more machine output, and senior workers become responsible for errors they didn't personally produce.

00:18:04 Capital and labor are connected here. The money being raised for AI infrastructure has to produce returns. Those returns can come from new products, higher productivity, higher prices, lower headcount growth, or some combination. When executives talk about AI as a growth platform, workers hear a staffing question even if the slide deck uses softer language.

00:18:26 When investors fund eighty-five billion dollars of AI capacity, they are not funding a science fair. They are funding an expectation that institutions will change how work gets done. So the story isn't simply that AI needs more money. It is that the money now has demands attached.

00:18:43 Compute contracts want utilization. Public markets want margins. Workers want a path through task disruption that doesn't amount to being told, after the fact, that their job was broken apart into prompts, review queues, and exception handling. That is the pressure Sunday added to the week.

00:19:00 Apple's new Siri AI is reportedly good enough to ease the company's AI crisis, and internal iOS 27 builds already include the ability to tap third-party models beyond OpenAI, according to Mark Gurman reporting summarized by Techmeme. Treat that as sourced reporting, not an Apple announcement.

00:19:18 Still, the direction is believable: Apple doesn't need to own every model if it controls the surface where hundreds of millions of people ask for help. That distribution position matters more after the Anthropic fight. If operating systems can route requests among model providers, then the question isn't only which model is best.

00:19:38 It is which provider Apple, Microsoft, Google, Samsung, or another platform operator can safely expose under privacy rules, latency needs, national regulations, and political pressure. A model can be technically capable and still be a bad default if it might be unavailable to a class of users, blocked in a jurisdiction, or incompatible with a platform's data promises.

00:20:00 This is where the open-versus-closed argument gets more complicated. Open models can be downloaded, inspected, adapted, and run outside a single vendor's API. Closed models can offer stronger central monitoring, more expensive training, and clearer vendor accountability.

00:20:16 But neither side escapes the trust problem. Closed models have access and control risk. Open models have provenance, licensing, and safety questions that can become institutional problems when governments or public agencies start using them. A good example came through Hacker News and GitHub on Sunday.

00:20:34 Nex-AGI posted an issue claiming that Rio de Janeiro's Rio-3.5-Open-397B, presented as a homegrown 397 billion parameter model from IplanRIO, is actually an element-wise merge of Nex with Qwen. The post says the blend is about 0.6 Nex and 0.4 Qwen, and says, quote, "we find no evidence of any training of their own." It also claims that when Rio's hard-coded "You are Rio" prompt is removed, the deployed model identifies itself as Nex seventy-nine percent of the time and as Rio zero percent of the time.

00:21:05 Those are allegations from one party in a public GitHub issue, not a court finding. The municipality and its vendors may have an explanation. But the evidence described is concrete enough to matter: model identity claims, weight-tensor comparisons across layers, and prompt-removal behavior.

00:21:22 If those claims hold up, then a public-sector AI system was presented as original local capacity when it may have been a mixture of someone else's model and Qwen. That matters because public AI procurement will depend on provenance. A city can't responsibly claim digital sovereignty by relabeling a model if the weights, license obligations, safety assumptions, or upstream dependencies point somewhere else.

00:21:47 It also can't evaluate risk if it doesn't know what it is running. Model cards, release notes, and benchmark tables aren't decoration in that setting. They are part of the public record for who built the system and what obligations follow it. Put Apple and Rio next to each other and you get two ends of the same trust problem.

00:22:06 At one end, the platform owner decides which external models become invisible infrastructure for ordinary users. At the other, a public institution may claim local AI capacity while the technical record suggests a borrowed or merged foundation. In both cases, the person affected by the system may never see the routing decision, the weight origin, or the policy constraint.

00:22:29 The Sunday record points to a larger control layer. The next phase of AI power isn't only model capability. It is access control, distribution, financing, surveillance authority, labor redesign, and provenance. The model still matters. The institutions around it now decide who can use it, who pays for it, who is watched by it, and who can prove where it came from.

00:22:50 The next concrete signal is whether the White House or Anthropic publishes the technical basis for the Fable and Mythos directive, and whether allied governments get a process they can trust before Monday's markets and agencies open. Jonas