Washington flipped Anthropic's kill switch

Anthropic shipped the world's most capable model only a week or so ago. The United States government effectively took it down only 3 days later.

The order came on June 12, by phone in the afternoon and by signed letter from Howard Lutnick, the commerce secretary, that evening. It invoked export-control authorities to bar any foreign national, anywhere (inside the United States or out, including Anthropic's own non-citizen staff), from accessing Claude Fable 5 and Claude Mythos 5, and it threatened criminal and civil penalties for non-compliance. Selective compliance was impossible at that reach, so Anthropic, the lab whose safety-first positioning is the whole brand, disabled both models for everyone, on its own servers and on Amazon's. Its other models, Claude Opus 4.8 among them, were untouched.

It was, by the account of export-control specialists, the first time Commerce had used its authority over emerging technology — granted in 2018 to keep sensitive capabilities away from adversaries — against a frontier AI model. Days on, the models are still dark, and the two sides are still negotiating their return.

The government's reason for alarm has not held still. The trigger, officials first indicated, was a jailbreak: Amazon researchers had coaxed Fable 5 into writing a working "proof of concept" for software vulnerabilities, a blueprint that helps an attacker into a system. By the time Mr Lutnick spoke publicly, the worry had widened into the classic logic of export control, that the models might be diverted to military-intelligence users in China, Russia or elsewhere. Anthropic says Chinese access was never raised in the conversations about the jailbreak. David Sacks, the White House's AI adviser, says the administration told Dario Amodei, Anthropic's chief executive, to fix the flaw or pull the models, and that he refused; Anthropic disputes the account. The versions have not been reconciled.

What makes the reversal vertiginous is that the government helped wave the models out the door. Before release, Anthropic ran them through thousands of hours of red-teaming with American and British government bodies and, by its own account, secured clearance to deploy. The same apparatus that stress-tested the models in the lab pulled them from the market the week they shipped.

Control issues

Whether that jailbreak is dangerous, whether Chinese intelligence ever touched Mythos, whether Mr Amodei refused a fix: these are the arguments now being had, and they are beside the structural point. Strip the merits away and a colder fact sits underneath. The most expensive thing Anthropic has ever built was switched off by a phone call and a letter, inside a single afternoon, by a government that did not have to prove its case first. A frontier model, it turns out, is not an asset the way a factory or a patent is an asset. It is a license: granted by the state, revocable by the state, and now demonstrably revoked.

That is a strange thing to discover about the company that argued hardest for the regime now binding it. Anthropic has been frontier AI's most consistent advocate for state authority over dangerous models, for pre-deployment testing, for the power to gate unsafe systems, for export controls that keep the sharpest capabilities away from foreign adversaries. The apparatus was built to deny China the frontier. It has now been pointed, for the first time, at an American company's own product, on American soil, against American customers.

This is the second time this year the machinery of national security has closed around the same company. Earlier this year the Pentagon designated Anthropic a "supply chain risk," a label historically reserved for foreign adversaries, after the lab refused to drop its prohibitions on autonomous weapons and mass domestic surveillance. The designation requires defense contractors (Amazon, Microsoft and Palantir among them) to certify they keep Claude out of military work, and it paused a Pentagon contract worth up to $200m. Anthropic sued the administration to reverse it, and the litigation is still running.

The timing is what should concentrate investors' minds. Anthropic filed confidentially for a public listing this month, off a private round that valued it near $965bn. The pitch for that number rests on frontier capability, on Anthropic shipping models nobody else can match and capturing the returns. June established that the most capable of those models can be unplugged by the state between lunch and dinner, with litigation as the only recourse and weeks, at best, as the timeline. That sovereign risk has been sitting inside the equity all along, unpriced because it had never been demonstrated. Now it has been. The repricing is not Anthropic's alone; any lab shipping at the frontier runs one demonstration away from the same afternoon.

The lesson travels past the cap table. The directive reached far beyond Anthropic's payroll: every foreign customer lost access at once, allied governments among them, and Canada had only just been admitted to the Mythos preview while Britain's own safety researchers had helped test the models before launch. Washington has spent the AI race urging friendly states to build on American models rather than Chinese ones, to treat the American frontier as the trustworthy default. The directive tells those same allies the default can be withdrawn overnight, without notice and without an explanation they are entitled to see. For any government or foreign enterprise weighing whether to wire its operations to a model it does not control, that is the strongest argument yet for a hedge, whether sovereign capacity, a second vendor, or a stack that does not route through Washington.

For now the models remain offline while Anthropic's technical staff and Commerce officials look for terms that restore them. An administration official has said they will stay locked until the government's "national security apparatus is hardened," a horizon measured in weeks. Pete Hegseth, the defense secretary, has used the episode to argue that every passing day vindicates the original blacklisting. Whatever the talks yield, the precedent is set, and restoring access will not unset it.

In a hearing over the supply-chain designation this spring, a government lawyer named the Pentagon's deepest fear about relying on Anthropic: that the company might one day build in a "kill switch," some hidden ability to change how its models behaved or to shut them down. The lever, the worry went, existed, and Anthropic's hand was on it. Then the lever was thrown. The hand was Washington's.