The Indispensable Pariah

JD VANCE called the CEOs himself. All five of them picked up: Sam Altman, Dario Amodei, Elon Musk, Sundar Pichai, and Satya Nadella. The Vice President told them that Anthropic's new model, Mythos, would disrupt small-town banks, hospitals, and water plants whose IT departments could not absorb the kind of attack an autonomous vulnerability-finding system would produce. We all need to work together on this, he said — the kind of line, in a White House call to the heads of the five most powerful AI companies in the world, that depending on the room can mean cooperate or can mean brace yourselves. Bessent, Rubio, and Cairncross — the new National Cyber Director — listened.

This administration had spent its first year keeping AI out of the Cabinet. The file had run through a part-time White House czarship held by the venture capitalist David Sacks. Sacks had stepped down at the end of March.

Three months earlier, the same administration had declared Anthropic — the five-year-old San Francisco firm whose CEO was on the line — a threat to its supply chain, and given federal agencies six months to disengage. The White House was now on the phone with that very company, asking it to coordinate the federal response to the most dangerous, most sought-after, most deliberately rationed AI model in production. The model was its own.

Between February and May, an administration that had arrived in Washington promising to remove barriers to the deployment of artificial intelligence had, without admitting any reversal, restructured its AI strategy around a capability it could not control and a firm it had recently classified as untrustworthy. The reversal would never be announced. It was already, by the time anyone looked closely, the policy.

The Cold Call

What had alarmed Vance had alarmed Bessent first. For weeks, the Treasury Secretary had been calling the chief executives of the largest American banks. Treasury Secretaries do not, as a rule, call Wall Street to warn about an AI model. Bessent was calling. On Fox News last Sunday, he had described the situation as a calculus between innovation and safety. He was, by the time he said it, narrating the policy back to the country.

Bessent had been calling the bankers about the same company the Pentagon had, in February, declared a risk. The contract that broke had been a $200 million award from July 2025 — the one that made Anthropic the first frontier-model provider cleared for classified networks. The dispute was narrower than the rhetoric. Anthropic had insisted on two contractual carve-outs and refused to drop them: Claude could not be used for mass domestic surveillance of Americans, and could not be used in fully autonomous weapons. Defense Secretary Pete Hegseth demanded the models be available for "all lawful purposes" without restriction. Amodei said no. On February 27, Hegseth designated the company a supply-chain risk; Trump, that same day, ordered federal agencies onto a six-month transition off Anthropic technology.

There is no comfortable way to hold these facts at the same time. A company whose insistence on guardrails had been incompatible with the Pentagon's procurement was, by April, the firm whose model the National Cyber Director was working to integrate into federal cyber defense. The thing that had made the firm a pariah at the Defense Department had not changed. What had changed was the model the firm was now releasing, and the threat the model was capable of producing if released without coordination. Mythos had made Anthropic indispensable to the same government that had recently judged the company untrustworthy.

Washington had been here before. The Cold War defense industrial base, in its first decade, was full of contractors whose products the government considered both necessary and not entirely safe to leave to industry alone — the airframe makers, the chemical companies, the early aerospace firms. The state's instrument for managing that tension was a combination of formal acquisition rules, classified directives, and informal back-channel coordination among a small number of named principals. It was not an FDA. The FDA, by 1962, had statutory authority to refuse a drug. The procurement system for B-52s had no such authority over Boeing. The closest thing to it was the negotiation between customer and supplier, which over the following decades produced, by stages, the contracting bureaucracy that exists today.

Kevin Hassett reached for the FDA analogy on Fox Business on Wednesday, the most explicit version of a frame the administration had been edging toward for two weeks. The National Economic Council director compared AI model review to pharmaceutical clearance. The phrase traveled. By Friday the order had quietly dropped it. The directive the West Wing is preparing, according to Bloomberg's reporting that day, will require partnerships, not approvals. It will expand the cybersecurity information-sharing programs already running through CISA and the FBI. It will, in the language of senior White House officials, decline to pick winners and losers.

By Wednesday, Susie Wiles had said the quiet part on X. Not in the business of picking winners and losers. The phrase had the structure of a refusal. What it refused was the regulatory authority the FDA analogy would imply.

An apparatus has been operating quietly inside Commerce, and it looks more like a Cold War partnership than a pharmaceutical regulatory state. The Center for AI Standards and Innovation has been accumulating pre-release access to the major labs' frontier models. Google, Microsoft, xAI, OpenAI, and Anthropic have all signed up; OpenAI confirmed this week that it would let CAISI test its forthcoming GPT-5.5-Cyber. The arrangement is voluntary, which is to say that it functions as long as the labs' interests align with the government's. The labs gain free red-teaming, regulatory cover, and a defensible posture for the next time a powerful capability surfaces inside the building. The government gains visibility. What neither side gains is the authority to refuse.

Permission slips

Strip the rhetoric and the order is an access-control architecture. The fight, in the weeks the order has been drafted, has been about who gets the model and on what terms. The White House has rejected Anthropic's plan to distribute Mythos to several dozen additional companies and organizations, citing security concerns. OpenAI, having previewed its own cyber model, is rationing it. The administration is, separately, drafting a national security memo that would require the Pentagon to use multiple AI vendors — a clause aimed at preventing the single-supplier dependency that produced the Anthropic dispute in the first place. The architecture being built is one of permissioning, not approval. Who gets the model, and on what terms, has replaced whether the model should ship.

This is the conversation Anthropic is now in the middle of. Dario Amodei met with Wiles and other administration officials on April 17, four days before the call to the broader CEO group. The meeting, by all accounts, was about what would happen with Mythos. Amodei is, among the AI lab founders, the one who has spent the most public time describing his company's posture in moral terms — the one who has written, repeatedly, about racing toward capabilities the firm itself worries about. The position has been, in the AI industry's commercial life, a competitive complication. In Washington, in May, it has become an asset. The firm that had positioned itself, to its own commercial detriment, as the lab most willing to refuse certain uses turned out to be the firm the government most needed for a coordination problem in which the answer would consist almost entirely of refusals.

The partnership language conceals an asymmetry. The administration cannot regulate Mythos in the formal sense; the legislation does not exist, the executive authority is contested, and the company has, in any case, decided in advance the categories of use it will refuse. What the administration can do is align with the company's existing refusals, formalize them through information sharing, and treat the company's restraint as de facto regulation it has not had to author. The cyber order, when it appears, will read like a partnership. Read more closely, it will look like an outsourcing the state hasn't admitted it's doing.

OpenAI complicates the picture. When the February contract broke, the firm moved within hours to take the Pentagon work, signing on roughly the same terms — the same prohibitions on mass surveillance and autonomous weapons that had cost Anthropic the deal. The indispensability runs through Mythos, not through Anthropic as a firm. On the supplier side, the state has more than one option. On the capability side, it does not. Mythos is the model that found thousands of zero-day vulnerabilities across every major operating system in seven weeks. There is no second one yet.

Inside the administration, the arrangement has not been universally loved. Sacks, in particular, had not stopped talking about it. By April he had become a former insider whose objections traveled by podcast, and on a recent All-In he had suggested the Mythos response was an overreaction, the existential framing misplaced as long as the right tools were in the right hands. The remark was, by then, being read inside the West Wing without being answered. It has been Cairncross — the former Republican National Committee official and Millennium Challenge Corporation chief, who told the Senate at his confirmation hearing he had no technical background in cyber — running the file. The bureaucratic relocation is the policy event. AI, in this administration, had been a deregulatory project as long as the venture-capital wing of the White House ran it. It became a security project as soon as a model with autonomous cyber capability arrived in a Cabinet briefing. The frame changed, and the personnel followed.

What every FDA system has and this one lacks is teeth: the threat of denial. Anthropic's restraint is voluntary; it is also the only restraint the order has. The Pentagon's six-month clock on the supply-chain designation was meant to expire in late August, but a federal judge in California has already complicated that timeline. In late March, US District Judge Rita Lin indefinitely blocked the designation in a forty-three-page ruling that called it "classic illegal First Amendment retaliation" for Anthropic's refusal to drop its surveillance and autonomous-weapons carve-outs. The government has appealed. Defense officials have signaled, in recent weeks, that they regard the cyber capability of Mythos as a separate matter from the procurement dispute — a bureaucratic fence intended to allow each track to proceed without infecting the other. Whether the fence holds is a function of how dependent the administration becomes on Mythos before the appeal is decided. Each new agency that integrates the model is another reason to permit Anthropic to continue operating, and another reason to soften the designation that had been meant, in February, to be a wall.

The position the company occupies has no clean name. Captured is not quite the word; the administration has not, in any conventional sense, brought the company under its authority. What has happened is closer to mutual entanglement: a state that needs a capability it cannot reproduce, and a company whose insistence on certain refusals has, by accident of timing, made it the most useful partner the state can find. The leverage runs in both directions, and it is not at all clear which direction it runs more strongly.

Consider the analogy the administration keeps reaching for. The FDA was a creation of the state. The pharmaceutical companies submitted to it, in the end, because the alternative was no market. Mythos's analogue is different. The market for Mythos exists at the discretion of the company that built it. Anthropic has not released the model publicly. It has released it, on terms it has chosen, to a small number of large tech and Wall Street firms. The order, when Trump signs it, will formalize the arrangement under which Anthropic's discretion happens to align with the state's preferences, and call the result regulation.

The pattern was older than Mythos. The Cold War contractors, in their first decade, had taught a generation of policymakers what it meant to depend on a private sector for the instruments of national power. The arrangement that emerged — bureaucratic, contested, full of designations that meant one thing in Washington and another in Burbank — has held, more or less, for sixty years. Whether something similar will hold for the AI labs is a question the cyber order will not answer. The order will, at most, make the question harder to ignore.

The supply-chain designation, in February, had been meant to put a wall between the company and the state. By May, in any honest reading, it was not the wall between them. It was, more nearly, the thing they were jointly defending — each from the other's reach, and both from anyone else's.