The U.S. government reversed export controls on Anthropic's Mythos and Fable AI models late Tuesday, just two weeks after the restrictions forced Anthropic to disable them for all users. The sudden policy flip exposes a chaotic approach to AI controls that is already pushing enterprises and allied governments to question their reliance on American frontier models.
Export control whiplash
The controls, imposed without public explanation, were lifted first for Mythos on Friday evening and then for Fable on Tuesday. For cyber defenders eager to use Mythos to find and patch software vulnerabilities before attackers can, the reversal restores an important tool. Yet the two-week blackout sent a clear signal: access to U.S. models can be terminated without notice.
The U.S. continues to operate a de facto licensing regime for frontier AI, even as officials publicly deny one exists. Rules appear to be invented on the fly by various government offices, making compliance unpredictable. This opacity has already damaged America's standing as a reliable AI supplier.
A permanent loss of trust?
Even with controls lifted, the damage is lasting. Potential customers, particularly in Europe, now see strategic risk in depending on American models for critical functions. The need for fall-back options is growing, and even enterprises inside the U.S. are increasingly discussing open-source alternatives.
Open-source models from China race forward
The most capable open-source models today come from Chinese firms, creating a fresh problem. Western companies can download and run these models on their own cloud infrastructure to keep data from leaking to China, but reputational risks and fears of future U.S. government intervention make that path uncertain. Some experts predict Washington could eventually bar American firms from using Chinese AI.
A recent report highlighted that Zhipu AI's GLM-5.2 spotted many of the same software vulnerabilities as Mythos, though it could not autonomously chain exploits together. That gap will likely close within months. Guardrails that limit malicious use are easily stripped from open-source models, a dynamic the Five Eyes intelligence agencies warned makes an imminent cyber threat from advanced AI likely.
Toward a voluntary framework
In response, the U.S. is reportedly working with leading AI labs on voluntary cybersecurity standards. Meeting those standards would give labs a reasonable expectation that a model's public release won't be blocked. Anthropic also said it is working with Amazon, Microsoft, Google, and other Glasswing partners on a shared framework for assessing jailbreak risks, though OpenAI was conspicuously absent from that initial group. The move hints at efforts to bring transparency to what has been a deeply opaque process.
As policymakers navigate these rapid shifts, resources like the AI for Government collection and an AI Learning Path for Policy Makers can provide a clearer understanding of the technology's implications.
Why this matters for Government
For government professionals, the episode illustrates that U.S. AI export policy is still formative and inconsistent, making planning difficult. Agencies relying on American AI for cybersecurity, defense, or critical infrastructure should actively test open-source alternatives and engage in shaping the emerging voluntary standards. Without a seat at the table, government users may find themselves locked out of capabilities they once took for granted.
Your membership also unlocks:
