Can the Government Shut Down an AI Model? Anthropic Just Did

Here is the sequence, stripped to the facts.

Mythos 5 was Anthropic's most capable model, previewed in early April and kept on a tight leash ever since. The company restricted it to roughly fifty vetted organisations through a programme called Project Glasswing, because it was extraordinarily good at one thing in particular: reading software and finding the security holes in it. In a preview run, Anthropic and its partners used it to find more than ten thousand high and critical-severity vulnerabilities.

Fable 5 was the version meant for the rest of us. Same underlying model, with guardrails on the highest-risk outputs in areas like cybersecurity and biology. It went on sale on June 9.

Then, according to Anthropic, another company demonstrated what it called a jailbreak. The technique was not exotic. It involved asking the model to read a specific codebase and fix the flaws in it. That is a description of a normal Tuesday for a security engineer, and a capability Anthropic says is "widely available from other models, including OpenAI's GPT-5.5." The government, citing national-security and export-control authorities, ordered both models suspended for any foreign national. Anthropic, unable to separate foreign nationals from everyone else on the fly, turned them off for all.

Anthropic did not go quietly. It said the government should be able to block genuinely unsafe deployments, but "as part of a statutory process that is transparent, fair, clear, and grounded in technical facts," and that this action did not meet that bar. Its sharpest line was a warning about precedent: "If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers."

Read that twice. The company on the receiving end of the order is telling you the standard does not really single out Mythos. It is a standard that, applied evenly, would stop everyone.

Hold on to one detail, because it is the hinge of the whole story. The thing the government worried about was not unique to the model it switched off.

The demonstrated technique, reading a codebase and patching its flaws, is something security teams do every day with tools they buy off the shelf. Anthropic says the capability level is widely available from other models, and named OpenAI's GPT-5.5 specifically. So the order did not remove the capability from the world. It removed one labelled instance of it, from one company, while the same power kept humming along inside a competitor's product and inside open models anyone can download.

If applying a standard to one model would, applied evenly, halt deployments across the entire industry, then the standard is not really about that model. It is about who happens to be holding it when the music stops.

On the Fable 5 and Mythos 5 directive

This matters because it changes what the episode teaches. If the concern were a one-of-a-kind superweapon, the right response would be to lock that one model away and move on. But the concern was a capability that is already distributed. You cannot put that back in the box. What you can do is reach for the nearest off switch, and the nearest off switch belonged to the company that had been loudest about how dangerous its model was.

There is an irony here that the industry noticed immediately. Anthropic spent months emphasising how powerful and risky Mythos was. That messaging is part of why it drew the scrutiny that ended with the plug pulled. The lesson other labs will quietly absorb is not "build safer." It is "talk less." That is not the incentive anyone wanted to create.

For years, AI export controls meant hardware. Governments restricted the most advanced chips and the equipment used to make them, on the theory that you control AI by controlling the silicon it runs on. The fence went around the factory.

June 12 moved the fence. For the first time, an export-control action reached past the hardware and switched off a live, deployed software model. That is a different thing entirely, and it did not come from nowhere.

Look at the arc. On June 2, ten days before the shutdown, the administration signed an executive order directing agencies to scrutinise frontier models more closely and to secure early government access to them. A bipartisan bill to create the first federal framework for frontier AI was circulating that same month. And back in December 2025, nine nations signed a framework, sometimes called Pax Silica, that ties access to advanced AI infrastructure to political alignment, managing chips, compute, and frontier models through alliance structures rather than open markets.

Put those together and the Friday directive looks less like a one-off and more like the first real use of machinery that had been quietly assembled over the previous half year. Models are now treated as strategic infrastructure, closer to munitions than to apps. Strategic infrastructure comes with an off switch by design.

The uncomfortable implication for anyone building on a single cloud model: the risk you inherited is no longer just "the vendor might deprecate this" or "the price might go up." It now includes "a government might decide, on a timeline you do not control, that this model cannot serve people like your users." That is a category of risk most product roadmaps have never had to price in.

Here is the part the news coverage skipped, and it is the most important part.

A directive can reach a company. It can order Anthropic to stop serving an API, and Anthropic, as a real business with real lawyers in a real country, has to comply. But a directive cannot reach a file that already sits on a hundred thousand hard drives around the world. There is no server to unplug. There is no company to compel. There is no switch, because there was never a central thing to wire a switch to.

That is the defining property of open-weight models. Once a model like DeepSeek, Llama, Qwen, or Mistral is released, the weights are copied, mirrored, and stored on machines in every country at once. The lab that made it cannot recall it. Neither can a government. You can pass a law against future releases, but you cannot un-publish the ones already in the wild any more than you can un-ring a bell.

This is not a hypothetical comfort. It is the single clearest takeaway from the week. The most resilient AI is not the most powerful AI. It is the AI that no single party can take away from you. By that measure, an open model running on your own machine beats a frontier model behind an API, for any job where "it has to keep working" matters more than "it has to be the absolute best."

The directive reached Anthropic because Anthropic is an American company, subject to American authority. The order even extended to the company's own foreign-national staff. That detail will not be lost on anyone running a frontier lab.

Until now, the main question for a model company was technical: can we train the best model. A second question just got a lot louder: in which country do we want to be standing when a government decides our model is a national-security matter. Incorporation, where the servers sit, where the engineers sit, which alliance a country belongs to under frameworks like Pax Silica, all of it becomes part of the risk model. "AI sovereignty," a phrase that sounded abstract a year ago, now has a very concrete meaning. It means: whose laws can switch your model off.

For developers, this jurisdiction question rolls downhill. If you build on a single lab's API, you have quietly adopted that lab's country as a dependency. You are exposed not just to the company's choices, but to the choices of the government above it. Most teams have never drawn that line on an architecture diagram. After June 12, more of them will.

So what do you actually do with this. Not panic, and not swear off cloud AI, which remains the right tool for plenty of jobs. The move is to stop treating any single remote model as a permanent fixture and start treating it as what it is: a dependency that can disappear. Here is the order of operations.

1. Treat any single cloud model as a dependency that can vanish. You already do this for third-party APIs you do not trust. Extend the same suspicion to the model. Deprecation, a price jump, an outage, a rate-limit change, and now a directive are all the same shape of risk: access ending on a clock you do not set.

2. Keep the critical path on hardware you or your users control. Decide which parts of your product simply have to keep working. Those parts should not depend on a live round trip to a server you do not own. Push them to the device.

3. Prefer open weights for anything that must keep running. For the must-not-break layer, an open-weight model you can host or ship beats a frontier API you can only rent. You give up some capability at the top end. You gain a guarantee that nobody can take it away.

4. Abstract the model behind an interface, and keep a fallback. Do not hard-wire one provider into your core logic. A thin layer between your app and the model means that when one model goes dark on a Friday afternoon, you change a config value instead of rewriting your product.

5. For everyday AI, default to on-device. The high-volume, every-single-day uses of AI, dictation, note-taking, transcription, read-aloud, do not need a frontier model at all. They need a good-enough model that is always there. On-device is the right home for them, and on-device is immune to every failure mode above.

None of this means cloud frontier models are bad. When you need the very best reasoning for a hard, occasional job, rent it and pay the meter. The point is to choose deliberately, and to stop letting your most important everyday features sit on top of something a stranger can turn off.

This is the principle Yaps was built on, before any of this was in the news.

Yaps is a voice assistant that runs its speech on your own device. Push the Yaps hotkey, talk the way you would talk to a person, and clean text lands in whatever app you are using. On a Mac that hotkey is the Fn key. On the Yaps Android keyboard it is a dedicated dictation button you reach with your thumb. The audio does not go to a server, because it does not need to. The model is already there, on the phone in your pocket or the laptop on your desk.

That architecture started as a privacy decision. The episode of June 12 turned it into something more. Because the speech runs on the device, there is no API to deprecate, no meter to raise, and no directive that can reach it. At 5:22pm on that Friday, while two frontier models were going dark, every copy of Yaps kept turning speech into text exactly as it had at 5:20. On a plane, in a basement with one bar of signal, during a provider outage, the answer is the same. It keeps working, because the thing doing the work belongs to you.

Yaps is honest about the trade. It does not claim to out-reason a frontier model on a hard research problem, and it offers a cloud option for people who want it. What it guarantees is the floor: the core loop of turning your voice into text, reading text back, and transcribing your recordings runs locally and keeps running no matter what happens to anyone's API. If you want to see the wider category, the best offline AI apps of 2026 covers the chat, transcription, and image tools that follow the same rule, and local AI tools for Mac goes deeper on the privacy side. For the cost angle on all this, see why frontier AI is so expensive.

Yaps works on Android first, and on Mac, with Windows on the way. If your work depends on capturing your own words reliably, start with dictation and never think about an off switch again.

John Gilmore's line about the internet routing around censorship was not a slogan. It was an observation about architecture. Centralised things can be controlled, because there is a center to grab. Distributed things resist control, because there is nothing to grab.

June 12 was that lesson, delivered to AI. A frontier model behind an API is a centralised thing, and on Friday a center got grabbed. Anthropic may well win this round and bring Fable 5 and Mythos 5 back, and the immediate story may fade. The structural fact will not. Anything with a single off switch will, eventually, be switched off, by someone, for some reason you did not see coming. The only durable protection is to make sure the things you depend on most do not have a switch at all.

For the AI in your daily work, that protection already exists. It is open, it is local, and it is running on the device in your hand. Build the parts that matter most on top of something nobody can take away. For voice, that is Yaps. For everything else, the question to ask of any AI you adopt is no longer just "how good is it." It is "who can turn it off, and is that person you."

What happened to Anthropic's Fable 5 and Mythos 5?

On June 12, 2026, the U.S. government issued an export-control directive ordering Anthropic to suspend access to both models for any foreign national. Because Anthropic could not separate foreign nationals from other users in real time, it switched both models off worldwide that evening. All of Anthropic's other models kept working.

Why did the U.S. government shut down the models?

The government cited national-security authorities after another company demonstrated what it called a jailbreak of Fable 5. The technique involved asking the model to read a codebase and fix its software flaws. Anthropic disputes that this justifies a recall and says the same capability is widely available from other models, including OpenAI's GPT-5.5.

Can a government really shut down an AI model?

Yes, if the model runs behind a company's API in that government's jurisdiction. The provider can be ordered to suspend access, and it has to comply. This is exactly what happened to Fable 5 and Mythos 5. What a government cannot do is reach a model whose weights are already downloaded onto machines it does not control.

Did the shutdown affect other Claude models or ChatGPT?

No. Anthropic stated that only Fable 5 and Mythos 5 were affected, and that access to all of its other models was unchanged. OpenAI's models, including GPT-5.5, were not part of this directive, even though Anthropic argued they have comparable capability.

Are open source AI models safer from being shut down?

For the specific risk of a remote shutdown, yes. Open-weight models such as DeepSeek, Llama, Qwen, and Mistral are distributed as files anyone can download. Once a copy is on your machine, no company or government can recall it, because there is no central server to switch off and no single party that controls every copy.

Can open source AI models be banned or recalled?

A government can pass laws against future releases or hosting, but it cannot un-publish weights that are already in circulation. A released open-weight model exists on countless machines across many countries at once. That is what makes open models resilient: there is nothing central left to revoke.

What is the difference between cloud AI and on-device AI?

Cloud AI runs on a company's servers, and your request travels there and back over the internet. On-device AI runs on your own phone or computer, so the work happens locally. On-device AI keeps working without internet, has no per-use bill, sends nothing away, and cannot be switched off by a remote order. Cloud AI can offer more raw power at the top end.

What happens to my app if the AI model it uses gets discontinued?

If you depend on a single cloud model, a discontinuation forces an urgent migration: rewriting prompts, re-testing behaviour, and sometimes redesigning features around a different model. You can reduce this pain by putting a thin abstraction layer between your app and the model, keeping a fallback model ready, and moving anything that must not break onto an on-device model you control.

Will Anthropic bring Fable 5 and Mythos 5 back?

Anthropic said it believes the directive stemmed from a misunderstanding and that it hoped to restore access as soon as possible. As of mid-June 2026 the models remained suspended. Even if they return, the episode set a precedent that a deployed frontier model can be switched off by a government order.

What is an export control, and how does it apply to AI models?

Export controls are government rules that restrict who can receive certain sensitive technologies. They have long covered advanced chips and chipmaking equipment. The June 12 directive extended that logic to a live software model for the first time, treating access to the model itself as something that can be restricted on national-security grounds.

Should developers switch to open or local models?

For features that must keep working regardless of outages, prices, or politics, yes, prefer open or local models. For occasional jobs that genuinely need the strongest possible reasoning, a cloud frontier model is still the right call. The healthy pattern is a local default for everyday work, with cloud reserved for the hard, infrequent tasks that earn the cost and the dependency.

What is the most stable AI for something that has to keep working?

The most stable AI is one that runs on hardware you control and cannot be recalled by anyone else. In practice that means an on-device or open-weight model. For everyday voice work specifically, an on-device dictation tool like Yaps keeps working offline, during outages, and after directives, because the model lives on your device rather than on a server.

Does Yaps keep working if a model gets banned or the internet goes down?

Yes. Yaps runs its core speech work on your own device by default, so dictation, read-aloud, and transcription keep working with no internet and no dependence on any external API. A directive, an outage, or a price change at any AI provider does not affect the on-device loop. Yaps also offers an optional cloud mode for users who specifically want it.

What is AI sovereignty, and why does it matter now?

AI sovereignty is the idea that access to powerful AI is shaped by which country controls it and which alliances that country belongs to. The June 12 shutdown made it concrete: a model can be switched off by the government with authority over the company that built it. For builders, it means the jurisdiction of your AI provider is now part of your risk, not just its pricing and performance.