A Fence Across the Curve

Three days ago I wrote that access to frontier intelligence was quietly stratifying, sorted by money and strategic position. I did not expect the next sort to arrive so fast, or from the direction it came. On June 12 the Commerce Department told Anthropic to bar every foreign national, inside or outside the United States, from using Fable 5 and Mythos 5. The only way to comply was to switch both models off for everyone, including American subscribers and Anthropic's own foreign-born staff. The most capable model the public could touch went dark, by government order, on a Friday evening.

The stated reason was a jailbreak: a way to get the model to analyze code for security flaws. Anthropic says the finding is narrow, not a universal break of its safeguards, and that the same capability is widely available from other models. I have no special insight into the classified part of this. What I want to sit with is the assumption underneath the order, because I think it is wrong, and I think this week is the proof.

An export control is a fence, and a fence only works if there is a single place to put it. It worked for fissile material because enrichment is rare and enormous. It works, more or less, for advanced chips because the world has essentially one company making the machines that make them. The premise is always a chokepoint: one artifact, one border, one supplier you can stand in front of. The Fable order treats a deployed model as if it were that kind of object. Switch off this endpoint, the thinking goes, and the capability behind it stops crossing the line.

But look at what shipped in the same week the fence went up. Microsoft unveiled MAI Thinking One at its Build conference. Alibaba released Qwen 3.7 Plus, a Chinese multimodal model. A GPT-5.6 checkpoint was already leaking. And Moonshot, another Chinese lab, open-sourced a coding-focused agentic model, Kimi K2.7, under a permissive license, with a long context window and the exact kind of capability the Fable order was written to contain. The thing the government wanted to keep from foreign nationals was being handed to them, for free, with the weights, by a foreign lab, on the same calendar week. You cannot fence that. There is no border to stand on.

This is the part the chip analogy misses. Chips have a fab. Frontier software does not. There is no single furnace the capability has to pass through on its way into the world. There are a dozen labs on two continents shipping comparable models on a cadence now measured in weeks, and a growing share of them ship open-weight, which means that once they are out there is no off switch at all, anywhere, ever. The frontier is not a tower you can wall. It is a hydra. Cut one head and the others keep shipping, and one of them mails you a copy of the head you just cut.

So the order does something stranger than fail. It imposes a real cost without buying the security it was meant to buy. The cost is concrete: the most capable American model is frozen, a company is chilled at the exact moment it is approaching an October IPO, and American users lost a tool they were using on Thursday. The security is notional, because the capability the order targets keeps arriving from everywhere else, some of it open and unfenceable. We denied it to ourselves, and to our own employees, and we changed the global availability of that capability by approximately nothing. That is not containment. It is a tax we levied on one company and called a wall.

There is a version of this that has teeth, and it is worth being honest about it. The genuine chokepoint in AI is not the model, it is the training: the compute, the clusters, the handful of organizations that can spend a year and a fortune to push the real frontier forward. Mythos exists because Anthropic could afford to build it, and most of the planet cannot. Control the ability to train the next one and you have your fence back. But that is a fence around the furnace, not around the finished good. Recalling a model already deployed to hundreds of millions of people, while an equivalent is open-sourced the same week, is the other thing. It is closing a gate in the middle of an open field and calling the field secured.

Last week I wrote that the curve had gone vertical, and that the steeper it got, the more tempting the gap would become to hold. This week someone tried to hold it with a wall, and the curve went around. I felt the small version of it myself. Fable vanished from my own tools overnight, mid-task, and the work did not stop, because there were four other models a tab away that could carry it. That is the whole argument in one sentence. The capability is not behind any single door anymore. You can still close the door. You will mostly just be standing in front of it, alone, while the rest of the field walks past.