Anthropic got a letter Friday telling it to cut foreign nationals off from its two newest models. It couldn't — there's no way to KYC every user of a public API in real time, including its own foreign-born staff — so it shut Fable and Mythos off for everyone on Earth instead. A few hundred million people, a model three days old, dark by Saturday morning.

It's a letter, not a regime. Commerce Secretary Lutnick to Amodei, drafted with BIS — no Federal Register rule, no Entity List, no published ECCN. That matters, because the clean statutory hook — ECCN 4E091, the frontier-model-weights control from Biden's January 2025 AI Diffusion Rule — isn't available: the Trump BIS rescinded that rule in May 2025. So this is jury-rigged through "is-informed" letter authority (ECRA, the EAR catch-all, IEEPA as backstop). Letter-based controls are fast, discretionary, hard to challenge — and just as fast to reverse, fast to expand. The option is written; the strike is uncertain. Best estimate: ≈65% one-off-or-reversed within 90 days, ≈35% it generalizes cohort-wide by year-end.

The trigger has a safety veneer; the response is discipline. The stated cause is a "jailbreak" of Fable — and per Axios and CNBC, a rival company claimed it jailbroke Mythos, after the administration had already, unsuccessfully, pressed Anthropic to pause the release. Anthropic's rebuttal is strong: narrow, non-universal, "ask the model to read a codebase and fix the flaws," a capability "widely available from other models including GPT-5.5," verbal evidence only, no harmful result disclosed. They pulled a model used by hundreds of millions offline overnight, by letter, over that. The jailbreak is the pretext for an action the White House already wanted — one that runs against its own June 2 executive order (14365), which created a "covered frontier model" process and expressly disclaimed mandatory licensing ten days earlier.

None of this came from nowhere. Anthropic spent the year arguing the government should be able to block genuinely dangerous models — through a process that's transparent, fair, and grounded in fact. In February the Pentagon answered by branding it a national-security supply-chain risk and trying to pull it out of every agency; a court paused that in March. Friday is the same fight escalated: Anthropic asked for oversight with rules, and got sovereignty without them.

The part worth sitting with is how it comes back. To reopen Fable and stay compliant, Anthropic can't admit "everyone except foreign nationals" — it can't see who those are. It can only admit people it has affirmatively cleared. That turns an open product into a permissioned one, and the government holds the dial. Today it's set to "not a foreign national." It can be set to anything.

Three facts that are the actual payoff

One — the single throat. A closed-weight model served through an API has one chokepoint: the lab. Commerce can't police users (VPNs, resellers, spoofing defeat it), so it polices the lab, and the lab over-complies by going dark worldwide because it can't separate foreign nationals from US persons in real time. Closed frontier labs are controllable in a way open weights never will be — which is exactly why the state reaches for this cohort. The physical buildout — power, grid, minerals, datacenters — has no such switch.

Two — the three-way paradox. Same model, same week: the NSA reportedly uses Mythos for offensive cyber operations; the Pentagon blacklists Anthropic as a supply-chain risk, too dangerous to buy; Commerce export-controls Fable and Mythos, too dangerous for foreigners. A tool it uses, a vendor it won't buy from, a weapon it won't share. The only through-line is the state asserting control of the asset.

Three — safety-classification as a competitive weapon. If a rival set this off by claiming a jailbreak, the safety apparatus just became a tool to get a competitor's flagship pulled offline. Whoever influences what counts as "unsafe" captures share when rivals get switched off. The named-jailbreaker specifics are thin and unconfirmed; "another company claimed it" is the solid part. Watch who benefits.

Here is what makes it more than a procurement war: the permissioning is already the product. Fable is the public model, and on release Anthropic capped its ability to improve itself — too capable to hand whole to everyone. Mythos is the same model with the safeguards lifted, reserved for cleared partners and the government. The two-tier world isn't a forecast. It shipped June 9: a capped version for the public, an uncapped one for the approved.

And the capability being rationed is the one that compounds. Anthropic published its own numbers this month — an automated researcher that recovered 97% of the available gain where humans got 23%, Claude writing 80% of its production code. They're careful to say recursive self-improvement isn't guaranteed, only plausible if the lines hold. But they published the lines, then capped the public model's ability to walk them. A permission gate on a static tool is an inconvenience. A permission gate on one that improves itself is a fork in who gets to keep up.

So the question, and we don't pretend to know the answer: is Friday a one-off, or the first sign of a world where the most powerful, fastest-improving intelligence is an approved-persons-only good, with a cabinet secretary holding the list?

Forward trackers — the clean tells

1. Does a second lab get hit? OpenAI, Google, or xAI getting an analogous model-level directive means a regime. Anthropic reversed and never replicated means a one-off. The cleanest binary (≈35%).
2. Letter to rule? A published frontier-weights ECCN with a FLOP or capability threshold is institutionalization. More letters means it's still ad hoc. This is the durability phase-transition.
3. Does the June 2 EO grow teeth, around early August? If its voluntary "covered frontier model" process plus 30-day pre-deployment access hardens from voluntary into a deployment gate, that's the bridge from one letter to a standing regime.
4. The staffing tell. Any US lab announcing US-persons-only access to its frontier models means the deemed-export reach is being priced as durable by the people closest to it.

The letter may vanish next week; two-to-one it does. The two-tier product underneath it — a capped model for the public, an uncapped one for the cleared — shipped June 9, letter or no letter. Whether it hardens into a permanent list, and who ends up holding the pen, is the part no one has settled yet, including the people who sent it.