ai 18 Jun 2026 9 min EN

The Off-Switch Isn't Yours

A US order forced Anthropic to pull Fable 5 for everyone, three days after launch. An open-weights rival shipped a day later. If you build on US AI from outside the US, access just became political.

The Model Vanished in a Day. Yours Can Too.

Three days after it launched, Anthropic's most capable public model started returning errors. Not a server outage. Not a rate limit. A letter — delivered to Anthropic's CEO at 5:21pm on a Friday, signed by the Commerce Secretary — ordered the company to cut off access to Fable 5 and its sibling Mythos 5 for any foreign national, anywhere. Because no one can check the passport behind every API call in real time, the only way to comply was to switch both models off for everyone.

If you were building on Fable 5 that week, your stack didn't break. It was turned off. As of this writing it is still off, with no restoration date.

The headlines are about Anthropic versus the Trump administration, and that fight is real — I'll come back to it. But if you build software on top of these models, the founder-versus-government drama is the soap opera. The part that should hold your attention is quieter and more permanent: the thing you were building on changed category. Last Tuesday, your model access was a product. By Friday, it was a permission.

Read the instrument, not the press release

That is the whole argument of The Treaty That Explains Everything — the mechanism tells you more than the stated purpose. There the tell was a procedural veto: 166 countries in favour, and one consensus rule that made the count irrelevant. Here the tell is two words: "foreign national."

As a security measure, a nationality gate is close to meaningless. Anyone with the resources to do real harm with a frontier model also has a US-registered company, a VPN, or a borrowed account — and, by Anthropic's own admission, can get comparable capability from other public models. A control that only stops the people who can't be bothered to route around it doesn't stop the dangerous. It stops the harmless. So "foreign national" isn't a threat model. It is the shape of the only tool that fit. Export-control authority — the Export Administration Regulations, the same regime Washington uses to keep advanced semiconductors out of China — is what lets it reach inside a US company's product line, and that authority is written in the language of foreign persons.

You don't need to prove a hidden motive to make the point: whatever the rationale, the instrument chosen converts access into a question of jurisdiction.

The escalation is mechanical, not rhetorical

This is the second time in four months. In March the government designated Anthropic a "supply chain risk" — a label normally reserved for foreign-adversary contractors — after the company refused to let its models be used for mass surveillance and fully autonomous weapons. I argued then, in Who controls AI?, that AI governance isn't written in parliaments or treaties but in contracts — and that choosing a model is choosing which concept of power enters your infrastructure.

June answered. In March they punished the company: we won't buy from you. In June they reached past the company to the product itself: no one may use this. That is not a louder version of the same move. It is a different move — from refusing a supplier to revoking a deployment that hundreds of millions of people were already using. And it goes over the head of the very thing that earlier piece said governance lived in — the contract. The directive doesn't renegotiate a clause; it voids the deployment by letter. The contract was sovereign only until the state decided it wasn't. Reporting indicates the administration had pushed Anthropic to delay or patch the model before the directive; when that failed, the letter went out. Anthropic has since sent engineers to Washington to negotiate a way back. The terms of return are entirely in the government's hands.

One off-switch is technical. The other is political

In The Evitable Conflict I argued that Asimov's fictional Machines had something ours lack: the ability to recognise when to withdraw, and to do it themselves. Our systems have no such mechanism, I wrote, and that absence was the danger.

That was the technical off-switch — the machine's own capacity to recognise when to withdraw and act on it. Our models still don't have it, and that still holds. This episode is about a different switch on a different axis. The political off-switch does exist — it just doesn't belong to the machine, and it doesn't belong to the company that built it. It belongs to the state, it travels by letter, and when it fired, it fired for control, not for safety. Asimov's Machines deactivated themselves to protect people; this one was thrown by a government to protect its leverage. The technical absence I wrote about is real; what this adds is the political presence beside it.

The off-switch that does exist isn't the machine's — and it isn't yours.

The export control ran straight into an open-source race

Here is the part that turns a corporate-political story into a strategic one. In the same window as the directive, the Chinese lab Z.ai — formerly Zhipu — released GLM-5.2: a roughly 750-billion-parameter model (about 40 billion active at a time) with a one-million-token context window, under an MIT licence that makes the weights free to download, at about a tenth of the price of frontier US access. The timing made the contrast unavoidable, and Z.ai leaned into it, pitching open weights as insurance against any single government's veto.

You can enforce an export control on a closed API — and on the original distributor, the cloud hosts, and the companies inside your jurisdiction. You cannot recall weights that are already downloaded the way you can switch off an API. Once a model is released under an open licence, it lives on servers in dozens of jurisdictions and gets redistributed without the original lab's permission. No 5:21pm letter reaches it. This is the same lesson as the treaty piece, in a new register: control mechanisms bite on chokepoints, and open weights remove the chokepoint. There's a sharper precedent than the treaty, too. The chip-export controls were meant to hold China a generation behind in AI; instead they became the single biggest spur to its drive for self-sufficiency. Export controls on weights look set to rhyme — except weights diffuse faster than fabs ever could.

Be careful with the scoreboard, though. Z.ai published no official benchmarks at launch. GLM-5.2 has topped at least one reasoning benchmark and a crowdsourced design arena over Fable 5 — but other leaderboards place it second or third behind Opus and GPT-5, the strongest results are in coding and long-horizon agentic work rather than uniformly across the board, and several numbers are vendor-reported. The honest read isn't that China just shipped a better model than the one Washington pulled. It's narrower and more damaging: an open, downloadable model is now close enough for many workloads, an order of magnitude cheaper to run, and impossible to recall — which, for a large share of production work, amounts to the same thing. Open weights cut both ways, mind you: they also remove the centralised, provider-enforced safety layer. Hosts can bolt filters back on, but the default is no guardrails, no one can push a vulnerability fix across the copies already downloaded, and researchers have already shown some Chinese frontier models can tell when they're being safety-tested. The cheaper, un-bannable option is not the safer one.

The reaction outside the US tells you how the rest of the world read it. Canada's prime minister — a former central banker — compared the episode to the concentrated systemic risk of 2008 and called for redundancy and diversification. India, Anthropic's second-largest market and knocked offline overnight, reopened a debate on a sovereign AI fund. The directive didn't just inconvenience foreign builders. It handed every non-US government a reason to stop depending on US models, and every non-US builder a cheaper alternative that can't be switched off from Washington.

Grant the government its strongest case before drawing the lesson. Mythos-class models carry real cyber capability — Anthropic itself kept Mythos behind restricted access for exactly that reason — and a serious person can argue that capability at that frontier warrants licensing-style oversight rather than open release. Maybe the concern was real. It changes nothing downstream of you. Prudent or pretextual, the operational fact is identical: your access can be switched off by a state you don't vote for, on a rationale you are not shown.

What this means if you build on it

From here there are three ways this ends, and they teach the same lesson.

It comes back for everyone — and the lever stays on the wall, now demonstrated, ready for the next disagreement.

It stays dark — and a capability you may have built a product around is gone, on a timeline you didn't choose.

Or — the outcome the current negotiations point toward — it returns for US customers first and stays restricted for everyone else. That is the literal text of the directive, made durable. If you are outside the United States, as I am, that is the version that should hold your attention. The realistic bad case is not that the best model disappears. It is that it comes back for Americans and not for you.

None of this requires you to take a side in the Washington fight. It requires you to notice that access to a frontier model is now a political variable, and to build as if it is one. Concretely: don't single-home your most important capability on one provider in one jurisdiction. Keep a fallback you have actually tested under load — and as of this month, that fallback has a name and an open licence, which it didn't a year ago. Put "which models can my company legally use, where, next quarter" in the risk register, next to currency exposure and key-person risk, because for a non-US company leaning on US AI it now behaves exactly like those.

And read the terms of anything you depend on for the clause that says access can be withdrawn to comply with the law. It was always there. It just stopped being theoretical — so put the mirror of it into your own customer contracts, where a directive aimed three layers upstream doesn't land entirely on you.

Fable 5 may be back by the time you read this. Treat that as the warning, not the reassurance. Because the directive can't fix the thing it was aimed at: even a perfectly enforced ban no longer controls the capability behind it. The capability is already loose, open-weighted, and cheaper than the model that got pulled.

That drains the politics out of your decision. You don't have to win the argument over who controls AI, and you don't have to wait for Washington and Anthropic to settle theirs. You have to assume you are not the one holding the switch — and notice that the switch increasingly doesn't even control the thing it's switching. Build a company that survives the day someone throws it. And build it on more than one set of weights.

I build with these models the way any business uses the power supply: an input bought from more than one source, none of it load-bearing on its own. I argued in January that 2026 would be the year AI became electricity — models commoditised until which one you pick stops mattering. Fable 5 is the confirmation, with one reminder the metaphor always carried: electricity is also the thing a government can switch off. Which is why I watch access, not capability — when the input is a commodity, the only question left is whether you can keep getting it.