Join us for our summer classes!
TL;DR. On a Friday night, the U.S. switched off its two most capable AI models for every foreign national on Earth — by executive letter, on a pretext thin enough that the same trick runs on models it left untouched. We had been rationing this intelligence all along — free, then twenty dollars a month, then two hundred, then millions in API fees — but always by price; Friday was the first time we did it openly by nationality. Forget the jailbreak: this is what power does when it meets a technology it can’t control — seize the gate, and deny it to everyone else. The order is incoherent as security (chips to Beijing, a locked door for Britain) but perfectly consistent as nativism; it will push Europe and China to build their own; and it points down a spectrum from export bans through sabotage to the kind of preventive strikes we just flew against Iran — because a desert full of geniuses is more usable, and more tempting to deny, than a bomb that only sits in its silo. The real question is no longer what can these systems do but who gets to think with them — and it scales from nations to schools to the kitchen table, where, right now, almost none of us has a say.
At 5:21 on Friday evening, a letter reached Anthropic, and within hours its two most capable models — Fable 5 and the Mythos 5 model beneath it — went dark for every user on the planet. The order came from the Commerce Department, under Secretary Howard Lutnick, invoking national-security export authorities: no foreign national, anywhere — including Anthropic’s own non-citizen engineers — may use them. Since no company can sort citizens from non-citizens in real time, the only way to comply was to shut the models off for everyone. Every other Claude model, including the new Opus 4.8, stayed online.
The stated trigger is a jailbreak. Anthropic says it’s narrow rather than universal — little more than asking the model to read code and patch its flaws — and that the same trick works on other freely available models, including OpenAI’s GPT-5.5, which face no such order. Argue the technical merits if you like. What interests me is what’s left once you set the jailbreak aside — the questions the directive forces but cannot answer, and that will outlast this particular weekend:
Who may use the intelligence we are only at the beginning of building? Who decides? By what standard? Can any standard be enforced? What lengths will we go to in order to ration it at home — and to stop rivals from building their own?
And rationing this intelligence is not new — only the basis is. For two years it has been rationed quietly, by price. At first it was free: anyone who could open a browser had a genius on tap. Then twenty dollars a month, which most of the rich world could absorb. Then two or three hundred a month for the most capable tiers, and millions in API spend for the labs and companies at the very front. That is rationing; we just called it pricing — the way we have always sorted the best of everything by who can pay. What changed on Friday is the axis: for the first time, the frontier was rationed not by wealth but, openly, by nationality.
Sit for a moment with what’s at stake. A nuclear weapon can wait in its silo for fifty years and never once be used; millions of geniuses in a data center would be put to work every hour of every day for all kinds of ends that make us “insecure”. The most powerful thing humanity has ever built may also be the most tempting to keep from everyone else.
If that sounds like an exotic problem of statecraft, look again: it is, at bottom, one of the oldest problems in education, rewritten at a planetary scale. Schools have always been where a society quietly decides who gets access to added cognitive power and who doesn’t. Friday simply moved one of those walls to the border of the United States. We’ll come back to the classroom — but start with the gate.
Who holds the gate
Begin with the part that should unsettle you, regardless of your politics. If frontier models become what their makers keep promising — a general-purpose engine for cognition, available in effectively unlimited quantity — then access to them isn’t a consumer convenience. It’s a form of power. And on Friday we learned who controls that access inside the United States: not a court, not a statute, not a transparent licensing board, but the executive branch, acting by letter, overnight, without publishing the technical basis for the decision.
That answers who decides. It supplies no standard. As of this writing, the entire disclosed predicate for pulling a model used by hundreds of millions of people is one narrow jailbreak that — by the developer’s own account — produces nothing its free competitors won’t. If that clears the bar, there is no bar; there is only discretion. Anthropic named the problem even while obeying: it has argued that government should be able to block unsafe deployments, but through a process that is transparent, fair, clear, and grounded in technical facts — and that Friday’s action met none of those tests. The legitimate version of this power and the dangerous version look identical from the outside; process and accountability are what separate them.
This didn’t come from nowhere. The same administration told federal agencies to stop using Anthropic’s models in February, after the company refused Pentagon contract terms that would have let its AI be used “for any lawful purpose” — Anthropic wanted carve-outs against autonomous weapons and mass surveillance — and the Pentagon then branded it a “supply chain risk,” a designation it’s fighting in court. Against that backdrop, a Friday-night export order resting on a minor jailbreak reads, to many, less like a safety judgment than like leverage. Whatever you think of the current occupants, the durable question is whether you want this switch to exist at all — because it will be inherited by the next administration, and the one after that.
Friend and foe, treated alike
Here, the standard problem becomes a strategy problem. The line the order draws is nationality — not intent, not alliance, not risk. A graduate researcher in London is treated exactly like a state-directed lab in a rival capital; a Canadian hospital and a hostile intelligence service fall on the same side of the wall. A rule that can’t tell a friend from an adversary isn’t a security policy. It’s a blunt instrument that happens to point outward.
And the incoherence cuts deep, because this same government has been moving in the opposite direction on the hardware that actually trains these systems. In May it cleared advanced Nvidia H200 and AMD chips for sale to China — a policy the Council on Foreign Relations called strategically incoherent and unenforceable. So the posture, taken together, is this: sell the compute that builds frontier intelligence to your principal rival, but forbid your closest allies from logging into a chatbot. One analyst who briefly served in this administration called the result close to cartoonish — chips to Beijing, a locked door for Britain. When one week holds both moves, “national security” stops looking like a doctrine and starts looking like a label applied after the fact.
As security doctrine, the order is incoherent; as politics it is perfectly consistent. The instinct to sort the world by nationality — to read a foreign passport as a risk to be managed — is the same one now reshaping who may enter the country at all. Over the past year the administration has imposed a $100,000 fee on new H-1B visas, the main route for skilled foreign workers; reweighted the H-1B lottery against younger and lower-paid applicants; and moved to cap student and exchange visas — what Brookings calls an erosion of the immigrant talent pipeline.
The Fable directive is that same nativism pointed at cognition: if we restrict which foreigners may come and work, the logic runs, why not restrict which foreigners may think with our machines? The difficulty is that foreign-born researchers already make up roughly half of America’s doctoral-level scientists and engineers. Bar the world’s best minds at the border, then forbid the ones already here from using the best tools, and you have built an efficient machine for making somewhere else the better place to do the work.
It was never only about weapons
Notice what “security” quietly smuggles in. The directive speaks the language of military threat — jailbreaks, cyber capabilities. But the reason capitals outside Washington are frightened has little to do with weapons. It’s economic. Anthropic’s own CEO, Dario Amodei, describes where this is heading as “a country of geniuses in a datacenter” — a population of tireless, superhuman researchers available on tap. Picture one nation’s companies with such a country at their disposal and yours without. As the writer Alexander Kruel put it, that asymmetry would be the end of you: none of your firms would stay competitive, and the destination is not a lost edge but something nearer to economic collapse.
That reads like science fiction until you notice it has already begun. Fields Medalists — among the most accomplished mathematicians alive — are already folding these systems into their daily research, Terence Tao among them, co-discovering results with Google DeepMind’s systems. The frontier isn’t a future capability to be rationed someday; it’s a present-tense input into the highest-value work humans do. Which means the real question under Friday’s letter was never “could a foreigner misuse this model?” It’s “who gets to compound their economy with superhuman cognition, and who gets locked out?“
Why the rest of the world is taking notes
Widen the lens. The United States has just shown, in public, that it can deny the most capable cognitive tools on Earth to allies and adversaries alike — in an afternoon. If you run any other government, that lands two ways at once, and both push the same direction.
The first is vindication. Nine days before the letter, on June 3, the European Commission unveiled its European Technological Sovereignty Package — a Chips Act 2.0, a Cloud and AI Development Act — built on the premise that dependence on foreign technology is now a strategic vulnerability to be corrected by law. All 27 member states had already signed a Declaration for European Digital Sovereignty the previous November; Brussels is standing up “AI gigafactories” and aiming to triple its compute by 2030. The sovereigntists had long had a soft spot in their case: why spend hundreds of billions rebuilding a worse version of something you can rent from California? Washington just filled it. The argument for building your own model is never stronger than the moment someone proves they can take the borrowed one away.
China barely needs the encouragement. Years of U.S. chip controls already convinced Beijing that self-sufficiency was no longer optional: domestic AI-chip self-sufficiency has climbed from about 20% in 2023 to over 40% in 2026, with Morgan Stanley projecting ~85% by 2030 — the point at which export controls lose most of their bite — while Chinese open-weight models have overtaken U.S. models in global downloads. Friday merely confirms the thesis Beijing has run on for half a decade: reliance on American technology is a liability. The result, across both blocs, is fragmentation — and an administration whose stated goal is to win the AI race may have just taught every rival to run a separate one.
What Brussels and Beijing are reaching for already has a name: sovereign AI — the principle that a nation should own the production of its own intelligence the way it owns its power grid. The phrase is NVIDIA chief Jensen Huang’s, who has spent two years telling governments from Dubai to Copenhagen that a country’s data encodes its culture and history, and that no state should let someone else refine that raw material on its behalf. It comes with a stack to build — energy, chips, data centers, models, applications — and a global roster already building it: the UAE standing up its own large language models, Denmark funding a national supercomputer, South Korea, Singapore, India, Japan. Sovereign AI was booming well before Friday. What Friday added was the one argument no sales deck could: live proof that borrowed intelligence really can be switched off.
But the term hides the trap Friday sprang. For all but a handful of states, “sovereignty” means owning the data center and a capable-but-smaller domestic model while still renting the actual frontier from three or four American labs — and it’s worth noting that sovereign AI’s loudest evangelist is also the company selling the picks and shovels. Real sovereignty — a frontier-class model trained, owned, and governed at home — is within reach of maybe three powers on Earth. Everyone else is choosing not whether to depend on someone else’s intelligence but how much; one analysis of Europe’s position warns that walling yourself off in the name of independence can exile your economy to a lower tier of the technology. Friday clarified the dilemma without resolving it: even partial dependence is now a strategic risk, because the supplier can change the terms on a Friday afternoon, with no notice and no appeal.
To be fair to the other side, there’s a coherent hawk’s case, and Gary Marcus made it: if you truly believe the U.S. must stay ahead of China, denying rivals your best systems is what staying ahead looks like. The trouble is that the same move corrodes the two things that produce the lead. Talent: many of the country’s best researchers aren’t citizens, and told they can’t touch the frontier models, a good number will simply leave for Europe or China. Capital: if a frontier model can be switched off by letter on a Friday night, every investor in American AI just watched the sector’s political risk reprice in real time. You can protect a lead this way, or drive off the people and money that built it — probably not both.
Whether the gate even closes
Here’s what should give the gatekeepers pause: it isn’t clear the wall does anything. Four cracks run through it.
The capability isn’t unique. Anthropic’s own claim — that the cited jailbreak coaxes nothing from Fable that GPT-5.5 and other free models won’t also produce — cuts against the premise of the order. If it’s true, the government has grounded one aircraft and left the rest of the fleet in the air.
Talent doesn’t carry a flag. The people who design, train, and run frontier systems are disproportionately not U.S. citizens. You can wall a model off from foreigners and still not wall off the knowledge of how to build one — and the knowledge is what actually diffuses.
Citizenship is a poor proxy for intent. A U.S. passport doesn’t make a person safe, and a foreign one doesn’t make a person a threat. The history of serious misuse — of data, weapons, code — is crowded with trusted insiders holding exactly the credentials a rule like this waves through.
And the chokepoint is dissolving. Policing access by nationality assumes a single gate to guard — one company, one model, one login. But the frontier is increasingly built by labs that don’t disclose their work, by open-weight models anyone can download and run, and by training distributed across many hands. You can’t revoke access to a model living on ten thousand laptops, or serve a directive on a developer you can’t identify. That Chinese open models already lead the world in downloads is the tell: the most consequential systems may soon be the ones with no door to lock.
We’ve run this experiment before, as more than one observer noted this weekend. In the 1990s Washington decided strong encryption was so dangerous it should be treated as a munition and kept from foreign hands. The effort collapsed within the decade — math and source code don’t respect customs declarations — and the capability spread anyway; we built the secure internet on top of it. The lesson was never that capability can’t be governed. It’s that governing diffusion by nationality, after the thing is already deployed, is the leakiest method there is, and the one most likely to punish your own side first.
The one thing power can’t abide
Strip the geopolitics away and a plainer human fact sits underneath. Power, in the end, is the ability to control — to decide outcomes, to say who gets what, to make the world hold still long enough to bend it. Leaders who chase power are chasing control; the two are nearly the same appetite. And artificial intelligence presents that appetite with something intolerable: a technology its own builders can’t fully predict, that improves on a schedule no one sets, that slips past every border, and that may soon reason better than the people nominally in charge of it. AI researchers even have a name for one version of this — the control problem, the question of whether we can make a system smarter than us do what we want. Its political twin is whether the people who run things get to stay the ones who decide. To a leader whose authority rests on being in control, a tool that can’t be controlled isn’t an opportunity. It’s a threat to the self.
When you can’t control a thing, two moves remain — and we’re watching both. The first is to control what you can reach: not the intelligence, but the door to it — who enters, from which country, on whose say-so. Friday’s directive is precisely that, a grip on the one lever still attached to a hand, which is also why it arrived so abruptly and explained so little; a show of control is most convincing when it looks sudden and absolute. The second move is to deny control to everyone else — if the thing can’t be yours to command, it can at least be kept from your rivals, the instinct beneath every export ban and, taken to its end, beneath sabotage and even war. If I can’t have it under my thumb, you can’t have it at all is less a strategy than a reflex, the reflex of power meeting its own limit — and it scales with the stakes. The more capable and ungovernable the technology grows, the more unbearable the loss of control becomes, and the cruder the instruments a frightened leadership will reach for to counterfeit the feeling of having it.
If Iran can’t have a nuke?
Follow that to its darker conclusion. If the model itself can’t be contained, a state determined to stay ahead goes after what can be: the physical substrate beneath the software. And frontier AI has a very physical substrate — leading-edge chip fabs, vast compute clusters, and, above all, electricity. The binding constraint on training the next generation of models is power, which is why the countries with access to abundant next-generation electricity will leap ahead, and why a data center is, in the end, a building full of chips you can sanction, sabotage, or bomb.
This isn’t a hypothetical confined to a blogger’s whiteboard. In a 2025 paper, Dan Hendrycks, former Google CEO Eric Schmidt, and Alexandr Wang argued the world has already entered a regime they call Mutual Assured AI Malfunction — the AI-era cousin of nuclear deterrence, in which any state’s bid for runaway AI dominance is met by rivals with “covert cyberattacks to potential kinetic strikes on datacenters.” Their playbook is borrowed wholesale from the bomb: deterrence plus nonproliferation — treat advanced chips like fissile material, since a cutting-edge GPU, Hendrycks argues, is now harder to build than enriched uranium.
Accept that frame and the questions become the ones we already ask about nukes. Which states may develop frontier intelligence, and which may not? If Iran can’t have a bomb, can it have a frontier model — and the gigawatt of power to train it? What about North Korea, or Venezuela? Friday’s quiet export letter is the mildest instrument on a spectrum that runs through sanctions and sabotage to preventive war — and even the strategists who propose this logic concede that a credible power to disable a rival’s AI program manufactures the first-strike incentives that make war more likely, not less.
We have, in fact, just watched how far that logic will travel. A nuclear weapon is one of the hardest things on Earth to build and to hide — and still, in June 2025, to keep a single country from finishing one, the United States flew B-2 bombers halfway around the world and dropped bunker-busters on Iran’s enrichment sites at Fordow, Natanz, and Isfahan. And then we launched a major war.
So ask the question that follows. If we will bomb to stop a rival from enriching uranium — a weapon that, once built, mostly sits in a silo and threatens — what will we do to stop one from becoming as intelligent as we are: from running a country of geniuses in the desert that turns out goods and services for pennies on the dollar, across every industry at once? A bomb only ever threatened to destroy. This threatens to out-invent and out-produce — a far more usable power, and so a far more tempting one to deny by any means we have.
And then there are schools
I promised we’d come back to the classroom, and here’s where the argument comes home. The same four questions Washington couldn’t answer are being asked, quietly and badly, inside every school in the country: who gets to use this intelligence, who decides, by what standard, and can it be enforced?
The walls are everywhere. The district blocks a tool; the student opens it at home. One family pays for the frontier tier; another is on the free one, a generation behind. A teacher has institutional access a student doesn’t — or, increasingly, a student has access at home the school knows nothing about and can’t match. The gap that matters is no longer between schools with technology and schools without it. It’s between the intelligence a school grants you and the intelligence you can simply reach, and for most students those two numbers are wildly different.
Put that same image at a student’s desk. Some children will sit down each day beside a country of geniuses in a datacenter — an inexhaustible tutor and collaborator with superhuman range. Others won’t. We already have a name for a gap like this: the advantage children of educated, resourced parents have always carried — the dinner-table vocabulary, the help with the essay, the assumption that an adult who knows things is within reach. AI doesn’t erase that advantage; it stacks on top of it. The child with educated parents now also has the geniuses in the datacenter; the child with neither still has neither — and the distance widens at the speed of the technology. And here’s the part that should stop us cold: confronted with exactly that compounding gap, the decisions being made — federally on Friday, and in countless schools every week — are decisions to restrict access to the hyperintelligent “parents” in the datacenter. We aren’t, mostly, debating how to get the tutor to the children who lack one. We’re, in many cases, taking it away from them.
Faced with that, schools improvise the same incoherent posture as the federal government: no clear standard, no workable enforcement, a widening gap between policy and lived reality. Block the tools and you don’t eliminate the access — you push it off the books, widening the very gap you meant to close while forfeiting any chance to teach the students in front of you how to use these systems well. The geopolitics of who-controls-the-frontier comes home as a quiet equity crisis: who, in a single classroom, gets to think with the most powerful tools ever built — and whether the adults have any real say. At the moment, mostly they don’t.
Parents are already splitting along the same fault line. Some worried about cheating or about thinking that never gets exercised want their children kept clear of these tools altogether. Others, worried about the opposite — that restriction will leave their kids behind — are quietly assembling a kind of sovereign AI for the household: paid frontier subscriptions, custom tutors, models a child can use at home no matter what the school allows (and often in spite of it). The same calculation driving governments to build their own intelligence is running one family at a time, and it sorts, predictably, by who has the money and the knowledge to act on it.
What Friday was really about
Strip away the jailbreak, and Friday night was three things happening at once. Access to frontier intelligence has become a lever of state power, held by very few hands and “pullable” without warning. The rest of the world watched the lever move and will now spend enormous sums — in Brussels and Beijing and a dozen capitals besides — making sure it can’t be pulled on them, even when sovereignty means an intelligence a tier below the best. And the lever may not even grip, because what it’s trying to hold back isn’t a product but knowledge, talent, and arithmetic — none of which present a passport at the border, and increasingly none of which pass through any single door.
For three years the urgent question about this technology was what can these systems do? The one that matters now is who decides who gets to think with them? That isn’t a technical question. It’s a civic one, and it scales — from nations to schools to the kid with a subscription and the kid without one. Friday was a reminder that at every level, almost none of us has a say. The work ahead is figuring out how we get one.