Deep dive · 2026-06-15 · The crypto wars already ran this experiment. The government lost — and left American products weaker for a decade.

On Friday, June 12, the U.S. Commerce Department did something it had never done before: it used national-security export authority to switch off a commercial AI model that was already in public use. All foreign nationals — including non-citizens working inside the United States — were barred from accessing Anthropic’s Fable 5 and Mythos 5. Unable to fence its own employees out of its own model, Anthropic disabled both. The trigger, as the weekly covers, was a warning from Amazon’s CEO that the model could be coaxed into producing cyberattack-useful information.

Set aside the corporate intrigue. The interesting question is narrower and more durable: can this work at all? Can a government meaningfully restrict who has access to a frontier model by controlling the model?

We already know the answer, because the United States ran this exact experiment once before, for a full decade, against a technology with the same essential property. It was called cryptography, the fight was called the crypto wars, and the government lost. Not on principle — on physics. You cannot export-control a number. The thesis of this piece is that model-weight export controls are the crypto-wars category error repeated, and the repeat will be faster and more lopsided, because a model is even more obviously a published number than a cipher is. The only AI export control with teeth points upstream, at compute — not at the trained artifact. Everything aimed at the artifact is theater that taxes the honest, closed, American lab and leaves the capability untouched.

The experiment we already ran

For most of the twentieth century, strong cryptography was legally a weapon. It sat on the United States Munitions List as Category XIII, governed by the same ITAR regime that controls fighter jets. To export it you needed a license from the State Department. In practice, “export” was read so broadly that publishing cryptographic source code on the early internet — where a foreigner could download it — counted as arms trafficking.

This produced a decade of escalating absurdity in the 1990s.

The government set a hard ceiling on exportable key length: 40 bits of symmetric strength, later nudged to 56, while everyone serious already knew 40 bits was trivially breakable. Products that wanted to ship internationally shipped deliberately weakened “export-grade” crypto. In 1993 the NSA proposed the Clipper chip — strong encryption, but with a government-held key-escrow backdoor — as the sanctioned alternative to strong crypto you actually controlled. It died under industry and academic revolt.

Then Phil Zimmermann released PGP in 1991 — the first genuinely usable strong encryption for ordinary people — and it spread worldwide in days, because that is what software does. The Justice Department opened a three-year criminal investigation into Zimmermann for “exporting munitions.” His response became the canonical demonstration of the absurdity: the PGP source code was printed as a physical book and exported legally, because the First Amendment plainly protects publishing a book, and a book full of source code is still a book. Activists printed the RSA algorithm as three lines of Perl on T-shirts labeled “this T-shirt is a munition.” The point landed because it was literally true under the regulations.

The legal system finished the job. Daniel Bernstein, a Berkeley math PhD, sued for the right to publish his Snuffle cipher. In 1996 a federal court ruled that source code is speech protected by the First Amendment; a Ninth Circuit panel affirmed it in 1999. The government read the wall. In November 1996, executive order 13026 moved commercial encryption off the Munitions List to the Commerce Department’s jurisdiction; by January 2000 the rules were relaxed to allow strong mass-market crypto to be exported to almost anyone. The Justice Department dropped the Zimmermann case without explanation. The control regime was over.

Here is the part that matters for 2026, and it is the part everyone forgets. The export-control regime did not stop strong cryptography from spreading abroad — strong crypto was everywhere by the late 1990s, much of it written outside the U.S. precisely because American developers were hamstrung. What the regime actually accomplished was to bake deliberately-weakened “export-grade” ciphers into a generation of software. Those weak ciphers did not disappear when the rules relaxed. They sat dormant in protocol stacks for fifteen years, until researchers used them to break supposedly-secure connections in 2015 — the FREAK and Logjam attacks, which downgraded modern TLS to 1990s export-grade keys and cracked them. The export controls’ lasting legacy was not security. It was a decade-delayed vulnerability in everyone’s browser, including every American’s.

So the scorecard on cryptography export control: it failed at its goal (strong crypto spread anyway), it handed an advantage to non-U.S. developers, it provoked a constitutional ruling that code is speech, and its one durable effect was to make American products measurably less secure for twenty years. That is the precedent the Commerce Department reached for on Friday.

Why a model is the harder case, not the easier one

The natural objection is that a frontier model is not a cipher. It’s enormous, it costs hundreds of millions to train, and it runs in a few companies’ data centers behind an API. Surely that is controllable in a way that a three-line Perl script never was.

For the specific artifact Anthropic ships, maybe — Fable 5 is closed, hosted, metered, and now geofenced. But the export control isn’t aimed at Anthropic’s servers. It’s aimed at a capability: the ability to get certain cyber- or bio-relevant information out of a frontier model. And that capability is not scarce. It is open-weight, downloadable, and was republished, in triplicate, in the same week the ban came down.

Look at the calendar. Anthropic’s own legal defense was that “the capabilities apparently causing government concern are already available in other publicly accessible models.” That week: Moonshot released Kimi K2.7-Code, a trillion-parameter coding model, weights on Hugging Face under a modified MIT license, within a few points of Opus 4.8 on its own benchmark. Zhipu shipped GLM 5.2 with a million-token context and open weights to follow. Xiaomi’s MiMo Code landed days earlier. A barred capability that you can git clone from three different labs is not barred. It’s free.

This is where the model case is worse for the regulator than the crypto case, not better. A trained model’s weights are even more purely “a number” than source code is. Source code at least encodes human-readable instructions you can argue are functional rather than expressive. Model weights are a few hundred gigabytes of floating-point coefficients — the most literally numeric artifact in computing. When a court eventually hears the argument that publishing open weights is protected speech, the precedent is already written, and it has Bernstein’s name on it. The dispute Anthropic and the White House are having about whether the Amazon jailbreak was “narrow” or “full” is real but beside the point. Whatever the model can do, the controllable thing is the closed copy, and the capability lives in copies no one controls.

The one lever that isn’t theater

None of this means frontier AI is beyond all control. It means the controls have to point at the one input that is genuinely scarce, physical, and chokeable: compute.

You cannot export-control the weights, but for now you can meaningfully control the chips that produce them. Leading-edge accelerators come from a handful of fabs, through a supply chain with real bottlenecks (EUV lithography, advanced packaging, high-bandwidth memory), and the U.S. has spent three years building export controls there. That regime has its own leakage problem — Commerce had to extend the rules to Chinese firms’ offshore subsidiaries after admitting the original perimeter leaked — but it is at least pointed at something with mass and a factory. A trained model is the output of controlled compute. Controlling the output after it exists, and after equivalent outputs are already open, is the category error. Controlling the input is the coherent policy. The two get conflated because both wear the “export control” label, but they are opposites: one acts on a scarce physical good, the other on an infinitely copyable number.

The honest version of the government’s concern — that a specific model makes a specific dangerous capability meaningfully easier — is a real concern. But the remedy of switching off one American lab’s API does not address it. If the capability is genuinely novel and dangerous, it needs to be controlled at the level of the capability everywhere it exists, which open weights make impossible. If it isn’t novel — if it’s in Kimi and GLM and MiMo too — then banning Fable 5 reduces no risk and just relocates the users. There is no version of the facts where the model-level control achieves its stated goal.

Who actually pays

So the control doesn’t stop the capability. What does it do? Exactly what the crypto regime did, mapped forward thirty years.

It taxes the honest closed actor first. Anthropic — the lab that kept its weights closed, metered, logged, and guardrailed, the lab most willing to be regulated — is the one that got switched off, precisely because it is legible and reachable. The open Chinese labs are untouchable by this lever and, at the margin, advantaged by it. A regime aimed at slowing a rival ends up disciplining the domestic champion and leaving the rival’s substitute on every mirror.

It hits American competitiveness through its own people. The “foreign national” definition swept in non-citizens working inside the United States, so the ban locked Anthropic’s own engineers out of Anthropic’s own model and forced a full shutdown. That is the 1990s pattern exactly — the rule lands hardest on the domestic firm trying to comply, while the capability it targets keeps spreading abroad. AWS reported service impacts within the day. The collateral damage is all on the American side of the ledger.

And it invites the same constitutional reckoning. Someone is going to publish frontier-class open weights, frame it as protected expression, and dare the government to prosecute. When they do, the government will be arguing against a settled-enough principle — code is speech — that it already retreated from once. Weights are a harder thing to call “not speech” than Perl is.

What to actually do, and what would change my mind

For the working engineer, the practical lesson is a reordering of how you weigh models, and it is not about safety politics. It is about availability.

Open weights are now a strategic hedge, not just a cost play. A model you can host is a model a government cannot switch off in your jurisdiction next Friday. The reader who treated open-weight models as the budget option — slightly behind, useful for cost control — should re-file them as the continuity option. The relevant property is no longer only price or latency. It’s “can this be administratively removed from under me,” and the answer for a hosted frontier API is now demonstrably yes.

Concretely: keep one open-weight model in your stack that you have actually run, on infrastructure you actually control, behind a router that can fail over to it. Not because it’s cheaper. Because it is the copy that political weather cannot delete. The closed frontier model stays your default for capability; the open one is your dial tone.

And watch where the real control fight goes. If U.S. policy energy moves further toward compute and chips — the chokeable input — that is the coherent regime asserting itself, and it will matter. If it stays fixated on switching off released models, it will keep losing in the same way, in public, for the same reason it lost in 2000.

What would change my read? One thing: if Commerce can show that this control measurably denied an adversary a capability that was not otherwise available — that Fable 5 enabled something Kimi, GLM, and the open frontier genuinely cannot — then the category-error claim weakens, and the model-level control has a defensible core. But three open frontier-class models shipped the same week as the ban. The bar for “not otherwise available” has rarely been higher. Until someone clears it, this is the crypto wars with bigger numbers, and the numbers still travel.

Prediction (75% confident): By December 31, 2026, no U.S. export-control action successfully restricts the distribution of an open-weight model — controls remain confined to closed/hosted API models (like Fable 5) and to compute/chips. The reason is the one this piece argues: open weights are unenforceable to control and raise a Bernstein-shaped speech defense the government has already lost once. If instead an open-weight release is successfully blocked or prosecuted, the precedent breaks and this whole analysis needs rewriting.