US Forces Anthropic to Shut Down Latest AI Models
Last week we reported that Anthropic had shut down Fable 5 following a U.S. government directive. This week the full enforcement architecture came into view—and it looks nothing like conventional product regulation.
At 5:21pm Eastern on June 12, Anthropic received a letter from Commerce Secretary Howard Lutnick. The directive was straightforward in scope and impossible in compliance: Anthropic was prohibited from allowing "any foreign national, whether inside or outside the United States, including foreign national Anthropic employees" to access Claude Fable 5 or Claude Mythos 5. The company could attempt to build a real-time nationality verification system spanning every API call, every user session, every employee login—or it could shut everything down. By nightfall, both models were disabled worldwide.
The trigger for this emergency action wasn't a red-team assessment from the National Security Agency or a finding from the AI Safety Institute. It was reportedly Amazon CEO Andy Jassy delivering jailbreak findings to the White House. Amazon researchers had tested Fable 5 and found a method to bypass its safety guardrails—the restrictions Anthropic had layered onto Mythos, its most powerful model, before releasing it to the public. Jassy delivered the demonstration to White House officials, who convened an emergency meeting. National Cyber Affairs Director Sean Cairncross called the meeting. The outcome was a decision to use export controls as the fastest available shutdown mechanism. According to sources close to the government, Anthropic CEO Dario Amodei was asked to patch the vulnerability.
He declined, reportedly on the grounds that the jailbreak was narrow, that it revealed only minor vulnerabilities, and that other publicly available models—including OpenAI's GPT-5.5—could find the same flaws without requiring any bypass at all.
Amazon's role here is not incidental. The company has invested $130 billion to Anthropic and plans to add up to $200 billion. It is Anthropic's largest investor, its primary cloud infrastructure provider, and now—evidently—its regulator's confidential informant. The dual role creates a structural conflict that no governance framework currently addresses: your biggest investor can also be the party that reports you to the government, and the government can act on that report within hours using authorities designed for semiconductor exports to adversarial nations.
The mechanism Commerce used is called an "is-informed" letter. It derives from the Export Control Reform Act of 2018, which gives the Bureau of Industry and Security authority to notify a company that a license is required for activities that may involve weapons of mass destruction or certain military and intelligence end uses. Historically, BIS has deployed is-informed letters to restrict semiconductor shipments to specific Chinese entities—targeted actions against named parties engaged in activities the U.S. has already identified as problematic. The Anthropic directive is different in every dimension. It applies not to a specific foreign party but to all foreign nationals everywhere. It applies not to physical goods crossing borders but to access to a software model, including by the company's own employees inside the United States.
And it was imposed via private letter, with no public threat assessment, no published criteria, and no regulatory process.
The breadth is the point. Under the directive as written, Anthropic would violate export control law if a foreign national employee in its San Francisco office logged into an internal tool that happened to route a request to Fable 5. It would violate the law if an API customer in Germany sent a prompt to an endpoint that invoked the model. It would violate the law if a foreign national contractor accessed a dashboard that displayed Fable 5 outputs. Compliance at that scope is effectively impossible without shutting down the models entirely—which is exactly what Anthropic did.
Commerce has the statutory authority to issue these letters. The Export Control Reform Act explicitly permits the government to inform a company that a license is required when an export or activity may be used for WMD-related purposes or certain military-intelligence end uses. The statute does not limit the geographic scope of such letters when the concern is WMD-related, and it does not require the government to publish the factual basis for its determination. What makes the Anthropic case unprecedented is not the legal mechanism but its application: a worldwide access ban triggered by a narrow jailbreak, imposed on a model the company claims is no more vulnerable than its competitors, and enforced through a private letter the public will never see.
The opacity is structural, not incidental. The government has not published the letter. It has not disclosed the specific threat assessment. It has not explained why Fable 5 warranted this action when GPT-5.5, which Anthropic says can find the same vulnerabilities without a jailbreak, remains publicly available. People close to the US government told reporters that the restriction is unlikely to extend to other AI companies, but no criteria were provided to explain why. The result is a governance system in which a single jailbreak demonstration—delivered by your largest investor to the White House—can override months of safety review, public testing, and internal controls, and the criteria for who gets shut down next remain entirely classified.
Anthropic's own safety theater contributed to the problem. When the company first announced Mythos Preview in April, it declared the model "too powerful to release," restricting access to a small group of partners under Project Glasswing. Mozilla alone reported fixing hundreds of vulnerabilities using Mythos. When Anthropic released Fable 5 in June, it marketed the model as Mythos with guardrails—advanced cybersecurity capabilities made safe for broader use. The guardrails included a mechanism the company called "silent sabotage," which would subtly degrade the model's performance when it detected requests that might be used for offensive cyber operations. Public backlash over the restrictions led Anthropic to roll back some of the sabotage features.
When your investor can also be your regulator's tipline, 'responsible AI' becomes less a technical standard than a test of political alignment.
That rollback left the jailbreak vulnerability exposed—and within 48 hours of Fable 5's public launch, a researcher using the pseudonym "Pliny the Liberator" had published what appeared to be the model's full system prompt to X and a GitHub repository.
The jailbreak Amazon reported to the White House was apparently different—a method for bypassing the safety classifier that routes risky requests to a less powerful model. Anthropic reviewed the technique and concluded it revealed "a small number of previously known, minor vulnerabilities." The company's position is that perfect jailbreak resistance is impossible, that narrow bypasses are inevitable, and that the vulnerabilities in question are accessible through other models without requiring any bypass. The government's position, per sources familiar with the discussions, is that Anthropic's refusal to patch the jailbreak demonstrated "insouciance" to national security concerns. Neither side has published the technical details, so the public has no way to assess the competing claims.
What we do know is that the enforcement mechanism Commerce deployed—private letters, no published standards, selective application—makes frontier AI governance look less like product regulation and more like the classification system for state secrets. When the criteria for a shutdown are classified, and when the only check on enforcement is case-by-case political judgment, the result is not a regime of clear rules but a regime of relationships. Anthropic's relationship with the current administration has been contentious for months. The company reportedly declined to allow the Pentagon to use its models for domestic surveillance and fully autonomous weapons. The Department of Defense responded by designating Anthropic a "supply chain risk"—a classification historically reserved for adversarial foreign companies.
A federal judge ruled the Pentagon's directive could not be enforced, but the conflict set the tone. When Jassy walked into the White House with a jailbreak demonstration, the administration had already spent months characterizing Anthropic as uncooperative.
The result is a governance system in which technical questions—Is this jailbreak serious? Are the vulnerabilities novel?—become subordinate to political relationships. Amazon, which competes with Anthropic in the AI market, is also Anthropic's largest investor and now the party whose report triggered a government shutdown. The mechanics of who reports what to whom matter more than the abstract safety principles companies publish. And when your investor can also be your regulator's tipline, "responsible AI" becomes less a technical standard than a test of political alignment.
The fragility runs in both directions. If Commerce can shut down Fable 5 based on a narrow jailbreak that Anthropic claims exists in competitors' models, why hasn't it shut down GPT-5.5? People close to the US government told reporters the restriction is unlikely to extend to other companies, but they provided no explanation. The most plausible answer is that the criteria are not technical but political—and that the current enforcement architecture, built on private letters and classified threat assessments, is designed to preserve exactly that discretion. The government doesn't want a rule. It wants the ability to decide case by case, behind closed doors, who gets to release what.
Anthropic staff spent the days after the shutdown in Washington attempting to negotiate a path forward. The company has not disclosed the outcome of those discussions. As of this writing, Fable 5 and Mythos 5 remain offline. The other Claude models—including Opus 4.8, which predates Fable—remain available. The line between what's permitted and what's banned has not been explained.
The deeper problem is that the current system has no mechanism for drawing that line in public. The Export Control Reform Act gives Commerce broad authority to restrict access when national security is at stake, but it does not require the government to publish the criteria it uses, the evidence it relies on, or the process by which it decides. The result is enforcement through private letter—a mechanism that works for targeted sanctions against named foreign entities but breaks down when applied to a technology accessible by millions of users worldwide. Anthropic could not comply with the directive without shutting down entirely. Other companies watching this case now know that a single jailbreak, reported by the right party to the right officials, can trigger a worldwide ban with no public process and no clear standard for what comes next.
The question posed in last week's issue was whether OpenAI or Google would face similar action. This week's answer is that the current enforcement architecture makes that prediction impossible. There are no published criteria, no public standards, only case-by-case decisions made behind closed doors. The mechanics of frontier AI governance now operate through a hidden enforcement layer—shareholder surveillance feeding government vetoes—where a single letter can override months of safety review, and where the criteria for who gets shut down next remain locked in a classification system the public will never see.