Mythos Ban Sets Precedent

On June 9, 2026, Anthropic released Claude Fable 5 and Claude Mythos 5, its most capable models yet and the first in a new tier called Mythos that sits above Opus.

The next day, Anthropic's own CEO, Dario Amodei, published an essay calling Mythos the "emblematic example" of the national security risk that frontier AI models pose, and calling for mandatory third party safety testing before models like it ship.

Two days after that, on June 12 at 5:21pm Eastern, Anthropic received a directive from Commerce Secretary Howard Lutnick, citing national security export control authority. It ordered Anthropic to cut off access to both models for any foreign national, anywhere, including foreign nationals who work at Anthropic itself.

Because the order covered Anthropic's own staff, Anthropic said there was no way to comply with it selectively. Within hours, both models were disabled for every user on earth. That includes the more than 160 organizations across 15-plus countries, among them AWS, Apple, Google, Microsoft, and Nvidia, that had access through Project Glasswing, a program built specifically around these models being unusually good at finding and patching security flaws before attackers do. Anthropic's other models, including Opus, stayed up.

According to Anthropic's June 13 statement, the order left the company unable to comply in any way other than disabling Fable 5 and Mythos 5 for every customer.

Anthropic disputes the order. In its own statement, it says the government's concern traces back to a single narrow jailbreak report, that the capability shown in that report already exists in other models including OpenAI's GPT-5.5, and that applying this standard industry wide would, in its assessment, halt nearly all new model deployments. The directive followed the same administration barring Anthropic's products from federal agencies back in February 2026. As of this writing the models remain offline. I will keep this page updated as that changes.

This is the cleanest real world example I have seen of the thing our decentralization page argues against.

That page makes the case that the most dangerous vulnerability in any system, technical or social, is a single point of control, because a single point of control is also a single point of failure. If one party can flip the switch for everyone, eventually someone will, for whatever reason they have at the time, and everyone downstream goes dark at once.

On June 9, 2026, Anthropic put its most capable AI models into the hands of the public and more than 160 partner organizations across 15-plus countries. On June 12, one directive took both models offline, everywhere, for everyone, including Anthropic's own staff, within hours. One switch. One party. Total reach. No appeal. Here is what happened, in order, and what I think it means.

Related: our decentralization mission.

Here is the timeline as I understand it, pieced together from Anthropic's own statements and the reporting linked at the bottom of this page.

April 2026. Anthropic launches Project Glasswing alongside Claude Mythos Preview, giving early access to AWS, Apple, Microsoft, Google, Nvidia, Cisco, Broadcom, CrowdStrike, JPMorganChase, the Linux Foundation, and Palo Alto Networks. The model is unusually good at finding and fixing zero day vulnerabilities, the kind of thing that is genuinely useful for defenders if it reaches them first.

June 2, 2026. Anthropic expands Glasswing to 150 more organizations across 15-plus countries, bringing the total to more than 160.

June 9, 2026. Claude Fable 5 and Claude Mythos 5 go live for everyone.

June 10, 2026. Dario Amodei publishes "Policy on the AI Exponential," calling Mythos the emblematic example of the national security risk frontier AI poses and proposing mandatory third party testing before models like it ship.

June 11, 2026, Thursday night. According to subsequent reporting, Amazon, one of the Glasswing partners, reports a jailbreak of Fable 5 to administration officials.

June 12, 2026, 5:21pm Eastern. Anthropic receives a directive from Commerce Secretary Howard Lutnick ordering it to cut off Fable 5 and Mythos 5 for any foreign national, anywhere, including Anthropic's own foreign national employees.

Within hours. Anthropic disables both models for every user, everywhere, because the directive could not be complied with selectively. Its other models stay up.

June 13, 2026. Anthropic publishes a statement disputing the basis for the order. AI policy figures and industry leaders react, some calling the move disproportionate, others calling it overdue.

A model that can find and exploit zero day vulnerabilities at machine speed is a serious thing, and a government wanting a say in who has access to it makes sense to me. That part isn't what I'm here to argue about.

Here is what I am here to argue about. One directive. One company. Hours, not weeks. Every user on the planet, including the company's own engineers, including the more than 160 partner organizations specifically recruited for defensive work. The government's evidence, by reporting, was verbal: a single narrow, non-universal jailbreak, the kind of thing you patch, not the kind of thing that justifies pulling a model from hundreds of millions of users overnight.

That is a single point of control sitting on top of a piece of infrastructure that, as of June 9, hundreds of millions of people and more than 160 of the world's largest organizations across 15-plus countries were starting to build their defenses on. Three days later it got switched off, for everyone, on the authority of one directive.

One more thing is worth sitting with. The day after Fable 5 and Mythos 5 launched, Amodei published an essay arguing that Mythos was the clearest example yet of why frontier AI needs outside oversight: third party testing, a real regulatory process, the works. Two days later, oversight arrived. Not as a testing regime. As a switch, thrown once, with no distinction between the public, the company's own staff, and the defenders Anthropic had spent two months recruiting into Glasswing for exactly this kind of work. I doubt that is the oversight Amodei was asking for. The gap between the oversight he described and the oversight he got is, to me, the whole story.

I have spent most of my working life thinking about single points of failure, because that is what you think about when your job is keeping systems online. A system with one master switch works fine right up until someone flips it, on purpose or by mistake, for a good reason or a bad one, and once it is flipped it does not matter how good the reason was. Everyone downstream goes dark at the same time.

This is where Ostrom's work comes back in for me. In our decentralization mission page I wrote about her finding that the most common reason a self governing arrangement breaks down is not internal mismanagement, it is an external authority stepping in and overriding what the people inside had already worked out. Anthropic, its partners, and its users had something that was, in its own narrow way, a working arrangement. An outside authority overrode all of it at once, with no appeal and no carve out for the partners who were using the access defensively. I have not seen that failure described this cleanly before.

This time, the thing that got switched off was access to a chatbot, even a very capable one. Genuinely disruptive for the companies that had built defensive tooling on top of it, but nobody's lights went out and nobody went hungry.

And this was not even the first time this year. In February 2026, the same administration barred Anthropic's products from federal agencies, no public process there either. Two unilateral actions against the same company in four months is not a one-off. It is a pattern, and patterns are how mechanisms get normalized.

The mechanism that just got demonstrated is not specific to AI. One directive, one company, hours, global, evidence that never goes beyond a verbal description in the room. That is a mechanism, and a mechanism that has been used twice, in public, with this little friction, is a mechanism that gets used again.

Run it on a payment processor instead of a chatbot. A logistics platform a large share of a country's grocery supply chain runs on. A handful of vendors a power grid's control systems depend on. One directive, no public evidence beyond someone's word, global shutdown within hours, no appeal, is now a documented precedent, and precedents get cited.

And historically, the thing precedents like this attach to first is dissent. A restriction justified by an appeal to safety or security that nobody outside the room can fully verify, applied broadly and fast, is also the shape of how access to organizing tools, communication platforms, and financial services gets cut off when people are protesting, organizing, or saying something the people holding the switch would rather they did not say. That is the shape. Shapes get reused.

As of this writing, Fable 5 and Mythos 5 are still offline, and Anthropic says it is working on a fix. I plan to keep this page updated as that develops, because I think the most useful version of this is not a single verdict written the week it happened, it is a record that gets corrected and added to as more comes out.

If you read this and think I am missing the strongest version of the other side, or you have a better source than what is cited below, I want to hear it. That is the only way this gets better.