Who Gets to Use the Model Now?

This is a follow-up to Commerce Found the Kill Switch and Is an AI Answer an Export?, our earlier coverage of the government's move against Anthropic's frontier models.

Two weeks ago, the U.S. government switched off Anthropic's two most powerful models. On June 26, it switched one of them back on. But Claude Mythos 5 did not return the way software usually returns, with a status page going green and previous users getting access again. It came back to a list.

Commerce Secretary Howard Lutnick sent Anthropic a letter saying the company could restore Mythos 5 for a defined set of approved organizations, reportedly more than a hundred companies and institutions, including many Fortune 500 companies. Anthropic described the approved group as cyber defenders and infrastructure providers. The approval reaches a little further than that, too. Foreign-national employees at those organizations can use the model, and so can Anthropic's own foreign-national employees, the same people the original directive had specifically locked out. Fable 5, the public-facing version of the same underlying system, was not mentioned at all. It is still outside, waiting, with no date attached.

So Mythos did not come back to the public. It came back to a guest list. That matters because frontier AI access is starting to look less like a normal product launch and more like a permission system. A model can be ready to ship and still unavailable unless the user is on the approved side of the line.

What actually crosses the border

The reason this is hard to think about cleanly is that AI keeps breaking the categories export control was built to handle. Those rules were written for objects that move: a crate of chips, a hard drive of source code, a technical manual handed to a foreign engineer. You can point to the controlled item and say it left the country.

Start with the lawsuit we wrote about earlier this month. Legion LegalTech sued Commerce after the shutdown cut off its Canadian developers, and the company's argument went straight at this problem. Its engineers were not receiving weights, source code, object code, or training data. They were sending prompts to a service running in Virginia and getting text back. So what, exactly, was exported? An answer came back over the wire while the model itself never moved.

Now widen the lens to the chips. A Carnegie Endowment analysis from May laid out a parallel version of the same puzzle on the hardware side. The U.S. spent years restricting which advanced chips China can buy, but a Chinese firm does not necessarily need to own the chips to use them. It can rent their computing power remotely through a data center in a third country, and under current law that arrangement is generally legal. The chip stays put while its computing power travels.

The Mythos letter takes the same problem one step further. Here, nothing crosses in the normal sense. The model sits on Anthropic's servers, the weights never go anywhere, and the government is not granting permission to receive a file. It is granting permission to log in. Export control was designed to govern objects that move across a border. What the government is reaching for now is the use of a capability under conditions it sets. As the UC Berkeley public-policy professor Andrew Reddie put it in Tech Policy Press, the open question is whether a system built to control things can govern capabilities.

The wording of the new permission makes the stretch visible. According to Reddie's account of the letter, Commerce said a license would no longer be required to "export, reexport, or in-country transfer" Mythos 5 to the approved entities, their foreign-national employees, or Anthropic's own foreign-national employees. That is export-control language applied to domestic access, employment status, and hosted software. The control point is not just where the model is located. It is who is allowed to use it.

It is not just Anthropic anymore

You could read this as an Anthropic-specific mess: a jailbreak dispute, a rushed government intervention, and a company negotiating its way back to normal. That became harder to believe the same week, because OpenAI released its newest flagship models through almost the same door.

OpenAI's announcement of the GPT-5.6 family, its Sol, Terra, and Luna models, described a limited preview that begins with a small group of trusted partners. The company said it had previewed the models' capabilities with the U.S. government, was starting with narrow access at the government's request, and had shared the partner list with officials. OpenAI was also unusually direct about the downside. It wrote that this kind of government access process should not become the long-term default, even as it works with the administration on a cyber executive-order framework and a repeatable process for future releases.

The important part is not that OpenAI objected to the process. It is that OpenAI still used it. In the same week, two of the most capable AI labs routed major model access through the government: Anthropic as the resolution of a crackdown, OpenAI as a limited preview before wider release. Dean Ball, who runs strategic futures at OpenAI and previously advised the White House on AI, summed up the new posture when he said frontier developers need an explicit green light from the government now. Once the former government-side official describes the process that way, it is hard to treat it as a one-off.

Nobody will say what law this runs on

The unresolved problem is authority. It is still not clear what legal power the government is using to gate access this way.

It could be export control stretched to cover hosted access. It could be the June executive order on AI security. It could be procurement leverage, with the government using its weight as a customer to shape who else gets served. It could be a Commerce "is informed" letter, a narrow tool meant for specific bad actors, doing duty as a blanket licensing system. The public record does not say. The original June 12 directive remains in force; Friday's letter is an exception carved into it, not a repeal. Lutnick reserved the right to reevaluate and narrow the approval again if circumstances change. The only export classification that ever directly covered advanced model weights was rescinded last year with nothing put in its place. There is no published rule, no stated threshold, no appeal, and no equal-treatment guarantee across labs.

Anthropic had already written a cleaner version of this process. On the same morning it launched Fable 5, the company published a framework arguing that governments should be able to block dangerous models, but only through specific legal triggers, third-party evaluation, judicial review, and equal standards for equally capable systems. Days later, Anthropic was switched off by a mechanism with none of those features. The power to shut a model down arrived before a public process for using that power carefully. The power to let one back on, conditionally, for a chosen few, has now arrived the same way.

There is a real case for caution. A hosted frontier model can help a capable user with offensive cyber work or other dangerous tasks even though no file ever changes hands. The labs describe their newest systems in similar terms, advertising major coding and cybersecurity gains and spending hundreds of thousands of GPU hours hunting for jailbreaks. If that capability is real, letting a vetted hospital or grid operator use it while the public waits may beat shutting everyone off at once. A guest list can be the humane version of a ban.

But temporary arrangements have a way of becoming permanent infrastructure before anyone votes on them. Mythos is back through a side door, GPT-5.6 came in through a preview list, and Fable is still outside. Maybe this is a bridge to a real framework, with rules, thresholds, and a way to argue you belong on the list. Or maybe the framework has already arrived, and no one has to name the law because a guest list is easier to run when the rules stay off the page.