Commerce Used an Export Letter to Pull Two Frontier Models. The Letter Isn't Public.

On June 2, the White House told frontier AI developers how pre-release review would work: a voluntary framework, up to 30 days of government access, and a sentence saying nothing in that section authorizes “a mandatory governmental licensing, preclearance, or permitting requirement” for new models [3].

On June 12, at 5:21 p.m. Eastern, the Commerce Department sent Anthropic a letter that imposed a license requirement on two of them [1].

Both things can be true at once, legally. The order’s carve-out covers its own section, and the letter came through export control law, a separate authority. But if you ship software that depends on a model API, the second date is the one that matters to you.

What actually happened

Anthropic released Claude Fable 5 and Claude Mythos 5 on June 9. Fable 5 was “available everywhere,” including the API; Mythos 5 was limited to partners in Anthropic’s Project Glasswing program until a broader trusted access program opens [2].

Three days later, the letter arrived. According to Anthropic, it suspends “all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees” [1].

Anthropic’s response was to turn both models off for every customer, citizen or not. Its statement says “the net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance,” and that access to its other models “will not be affected” [1]. It couldn’t do anything narrower, Tech Policy Press reports, because it had no reliable way to screen users by nationality [6].

The letter itself hasn’t been published [5, 6]. Anthropic says it “did not provide specific details of its national security concern” [1]. The company’s understanding is that the government believes it found a way to jailbreak Fable 5; Anthropic says it reviewed the technique and that it surfaced “a small number of previously known, minor vulnerabilities” that other public models can find too [1]. The evidence it got was verbal: one narrow technique, asking the model to read a codebase and fix its flaws, which Anthropic says GPT-5.5 and other models can also do [1]. CSIS cites reports that Amazon researchers identified methods that could bypass the guardrails [5]. Tech Policy Press also notes a single-sourced report that concern about a China-linked group’s access played a role, which Anthropic says was never raised [6].

Anthropic says it is complying, disagrees with the decision, and is “working to restore access as soon as possible” [1]. It isn’t against review as such: the statement says the government “should have the ability to block unsafe deployments” [1]. Since then, according to reports CSIS summarizes, the White House asked other companies for feedback on Fable 5’s safety on June 13, and Anthropic met White House officials on June 15 [5].

Is API access to a model an export now?

Since the letter is private, this part is secondhand. CSIS, working from reported accounts, says it leans on three pieces of law [5]:

• ECRA’s “interim controls.” The Export Control Reform Act lets Commerce control emerging and foundational technologies “through interim controls (such as by informing a person that a license is required for export)” [4]. That’s the “is informed” letter. The same section ties the identification of those technologies to an interagency process that must “include a notice and comment period” [4]. CSIS says the authority “has not been implemented by a regulation as required by ECRA” [5].
• EAR 744.22, a military-intelligence end-use provision. CSIS points out it only lets Commerce impose license requirements on “a small group of adversarial countries,” not the whole world [5].
• EAR 734.13, the definition of an export, which covers “deemed exports,” the release of technology or software to a foreign national, including inside the U.S. CSIS notes Commerce used “this exact section” in three earlier advisory opinions to conclude that “remote access transactions are not subject to the EAR” [5].

That last point is the one I keep rereading. The weights didn’t go anywhere. As CSIS puts it, “foreign nationals are instead accessing those models on servers operated by Anthropic” [5]. Treating API access as a release of controlled technology is a new reading, and it’s the reading that turns a model release into an export.

Washington has tried to control models once before, and it went after a different thing. BIS’s AI Diffusion Rule, published January 15, 2025, put license requirements on model weights, including weights produced abroad under the foreign direct product rule. BIS said in May 2025 that it would rescind that rule, and CSIS notes it isn’t being enforced [5]. That rule controlled a file. The June 12 letter controls a service. Tech Policy Press notes that export law was built for discrete transfers, so it’s unclear what gets exported when a model sits behind an endpoint: the weights, each inference call, or the capability itself [6].

What this means if you ship on a model API

Your model provider can disappear on a Friday evening. Not through an outage or a pricing change, but through a letter you can’t read. If Fable 5 sat behind one of your features, that feature went dark on June 12 with no notice period. A fallback to a second model, with prompts and evals already tested against it, used to be a reliability nice-to-have. It’s now part of your compliance posture.

The all-or-nothing outcome came from identity, not law. The letter reached foreign nationals; the shutdown reached everyone, because the provider couldn’t tell who was who in real time [1, 6]. Providers that can verify identity could end up able to keep serving U.S. persons while others can’t. I’d expect “can you verify nationality” to show up in enterprise procurement questions before long, and I could be wrong about how fast.

Deemed exports reach your team, too. The scope covers foreign nationals inside the United States, including at Anthropic [1]. If your engineers on visas used a controlled model day to day, that access would need a license under the same theory. Most startups have never had to map their workforce against the EAR. A software company could ignore that question as long as remote access wasn’t treated as an export [5]. That assumption is now in question.

Your fallback may share the same exposure. Tech Policy Press lays out two ways to decide what gets controlled [6]. Under an incremental-risk test, a model is restricted only if it gives adversaries something they can’t already get, which is essentially Anthropic’s defense. Under a capability test, having a sensitive capability is enough, and that could reach most frontier models. The author calls the choice between them “the actual policy decision” [6]. If the government lands on the second, a backup from another frontier lab is exposed to the same kind of letter. CSIS expects some buyers to drift toward open-weight models they run themselves [5].

My opinion: the process problem here is bigger than the outcome. I don’t know whether the jailbreak the government saw justified pulling the models, and nobody outside the room does either, because the evidence and the letter aren’t public. ECRA’s own interim-control power sits inside a section that expects identification through notice and comment [4]. A secret letter that rewrites how remote access works, ten days after an order promising a voluntary process, is the least legible way to set this policy. Big labs can absorb that. A team of eight shipping on top of them can’t. CSIS sums up the cost: “underlying assumptions on what BIS can and will control are now in question” [5].

To be fair to the other side: if the government believed a widely deployed model had a working jailbreak with cyber consequences, it needed a tool that worked within hours, and a Federal Register rule doesn’t. An anonymous senior White House official told Politico that “export controls were a last resort,” according to CSIS [5]. Whether there was a better tool is a fair question for Congress.

What I’m watching

• Whether Commerce explains itself, or Congress does it instead. A published letter, a Federal Register notice or a formal rule would tell everyone else what triggers this. So far there’s nothing on the record [5, 6]. Meanwhile the House has passed the Remote Access Security Act (H.R. 2683), which CSIS says exists because ECRA doesn’t clearly reach remote access [5].
• The EO 14409 framework, due about August 1. Section 3 gives Treasury, NSA and CISA, consulting with NIST and others, 60 days to build a classified benchmarking process and the voluntary pre-release framework [3]. How it fits beside an export letter is my biggest open question.
• Licenses or withdrawal. CSIS lays out the paths: Commerce withdraws the requirement, a legal challenge, or restored access under licenses and nationality checks [5].