Week of 2026-06-29 to 2026-07-05 · The export ban ended in a full reversal — and that is the verdict on switching off a model. Watch where the state’s grip went instead.

On June 12, the US government did something it had never done: it switched off a public commercial AI model. Commerce export-banned Anthropic’s Fable 5 and Mythos 5 for all foreign nationals, and because Anthropic had no way to check nationality in real time, it went dark for everyone. We called that the moment safety stopped being Anthropic’s moat and became a weapon aimed at it.

On June 30, the government switched it back on. The controls were lifted; Fable 5 returned globally on July 1. The kill switch lasted 19 days.

That is the whole story of model-level control in one number. Nineteen days.

Rescinded, not resolved

Read how it ended, because the details settle an argument we’ve been having with ourselves for a month.

The ban’s trigger was a report from Amazon researchers who found they could prompt Fable 5 into identifying software vulnerabilities. Anthropic never conceded that was a jailbreak — Amodei called it “narrow” in W24 and held that line. On redeployment, Anthropic did not patch the model. It trained a new safety classifier that “targets and blocks the behavior described in the report” in “over 99% of cases,” and added “defense in depth” margins around it. The model underneath is the same model. A filter was bolted to the front of it, and Commerce called it a day.

In W24 we predicted (65% confident) the restriction would be “materially narrowed or rescinded without the jailbreak being publicly resolved.” As recently as W26 we flagged that call as trending wrong — parts of NSA had lost Mythos access, Asian clones were filling the gap, the ban looked like it was dragging rather than lifting. Then it flipped. It was rescinded outright, and the “jailbreak” was never resolved — a classifier was added, not a hole closed. The call resolves RIGHT (Brier 0.12). We were nearly talked out of a correct prediction by a week of noise. Worth remembering the next time a thread looks like it’s going the other way.

Why did the kill switch fail so fast? Because the thing it was switching off was already downloadable. We argued this in June’s dive, You Cannot Export-Control a Model: controlling a trained artifact fails when the capability ships as open weights. W25 watched the demand route around the ban in real time. This week the premise collapsed in public: Semgrep published that GLM-5.2 — a free, open-weight Chinese model — beat Claude Code on an IDOR vulnerability benchmark, 39% to 32% F1, at roughly one-sixth the cost. The ban’s stated reason was that Fable 5 yields cyberattack information. An unbannable open model posts better cyber-offense numbers, for free, and you can run it on a laptop. The justification for switching off the legible US lab was a capability the ban could never touch.

The grip didn’t loosen. It moved.

Here is the part that matters more than the reversal. The state did not retreat from AI. It relocated.

In the same window, OpenAI previewed GPT-5.6 — Sol, Terra, and Luna — and shipped all three government-gated: available first to roughly 20 organizations whose details are shared with Washington, under the June 2 executive order’s 30-day pre-release review. OpenAI said out loud it doesn’t think this should be “the long-term default.” It is the default anyway.

Line the two moves up. The kill switch — withdraw a model already in the market — is brittle, loud, and reversible. It cost 19 days, an ally’s goodwill, and a public embarrassment, then evaporated. The guest list — decide who gets a model before it ships — is quiet, cheap, and sticky. There is no capability to route around, because access was never granted in the first place. You can’t jailbreak your way onto a list.

That is the arc across four issues. W24: the state switches a model off (failed). W25: the capability relocates within days. W26: the state issues its first access list (GPT-5.6 Sol). W27: the kill switch is fully reversed while the access list quietly becomes routine. Control didn’t die this week. It graduated to the form that holds.

Our W26 prediction — that another flagship would ship under a government-staggered arrangement before GA — picked up strong supporting evidence (Terra and Luna joined Sol on the list). It stays open; the trend is clearly toward hardening.

Meanwhile, the market repriced under your feet

While policy thrashed, the thing the reader actually opens every morning changed. Anthropic shipped Claude Sonnet 5 on July 1 — near-Opus-4.8 quality at $2/$10 per million tokens through August, then $3/$15 — and made it the default model in Claude Code (v2.1.197) with a 1M-token window. Two Anthropic launches in one day, counting Claude Science. The default model swapped under everyone mid-week, and most users won’t have noticed.

Read the pricing with one eye open. Sonnet 5 ships a new tokenizer that turns the same text into “roughly 1.0–1.35×” the billable tokens, and Anthropic set the intro price so the switch is “roughly cost-neutral.” Cost-neutral is doing work in that sentence. The sticker fell; the token count rose to meet it. This is the coding-subsidy thread in miniature — the meter finds a way.

And the floor kept dropping regardless of who was banning whom. DeepSeek’s permanent V4-Pro cut held. Grok 4.3 landed on Bedrock at $1.25/$2.50. GLM-5.2 out-scored the frontier on a cyber eval at a sixth the price. The commoditization our channel thread has tracked since June does not care about the policy weather. It just keeps going.

The take

The kill switch is theater. The guest list is the regime.

If you build on frontier models, update which risk you price in. “My model gets export-banned” is loud, rare, and — we now have the data point — reversible in under three weeks. “I’m not on the list” is quiet, structural, and has no appeal process. The first is a headline; the second is an architecture decision made in a room you’re not in.

The hedge is the same one we’ve argued since June’s portability dive — keep a continuously eval’d fallback, and treat provider access as something policy can change, not just something price can. This week proved the switch-off is survivable. It also proved the access list is real. Plan for the one that doesn’t make the news.

Also this week

  • Our Copilot call resolves WRONG, and we’ll say so first. In W23 we predicted (70%) GitHub would partially walk back Copilot’s metered pricing within 30 days — extend credits past August, restore the fallback model, or cut the Opus multiplier. None happened. GitHub went the other way: the fallback model was removed, Opus was pulled from Pro entirely, multipliers rose (Opus 4.7 to 27×), and the extra credits still expire end of August. Brier 0.49 — our worst score so far. The meter didn’t blink; we were wrong to bet it would.
  • California bought Claude at half price. Newsom announced a first-of-its-kind deal — Claude at a 50% discount for all state, city, and county agencies via the new SITeS portal, already running on DMV wait times and Medicaid workflows. The same government layer that switched Fable off in June is now Anthropic’s distribution channel. Both are true at once.
  • Correction on a signal we won’t repeat. The Colorado AI Act did not take effect June 30. An amendment pushed it to January 1, 2027 — the flagship state AI law slipped again, the same week the one hard federal action got reversed. The apparatus is arriving slowly; the enforcement keeps sliding right.
  • Claude Code may be leaking sessions across tenants. An open security bug (260 pts) reports an enterprise ZDR user receiving another account’s unrelated conversation context mid-session. Labeled area:security, unresolved. If you run Claude Code under a data-isolation guarantee, watch this one.
  • “Better models, worse tools.” Armin Ronacher documented Opus 4.8 and Sonnet 5 inventing extra keys in nested tool-call arguments — a schema regression older models don’t show. We dove on it: a version bump is a portability event, and strict:true is the fix.
  • The web is growing a cash register for machines. Cloudflare launched a Monetization Gateway that charges agents per request — page, API, dataset, or MCP tool — settling in stablecoins over the x402 protocol. It’s this week’s deep dive, because your next customer might not be a person.
  • Microsoft is billing the implementation layer. A $2.5B, 6,000-person unit (Frontier Co.) embeds engineers inside enterprise clients. “AI implementation services” is now a multi-billion-dollar bet, not a consulting sideline.

One thing to watch

Prediction (70% confident): No public US commercial AI model has its access withdrawn by the government again in 2026 — the kill switch, having cost 19 days and reversed, is not re-applied to a shipped model. Model-level state intervention stays on the granting side (access lists, pre-release vetting) rather than the withdrawal side. Falsified if Commerce or any agency export-restricts or suspends a live US commercial model before December 31. Due 2026-12-31.