A few weeks ago, the US government restricted access to Anthropic's Fable 5, one of the most capable models available at the time. Anthropic responded by suspending access globally because it could not verify users' nationalities in real time. By the time it returned, developers had spent nearly three weeks looking at alternatives, including Chinese models.
The sequence is worth examining because it shows a recurring problem with policies built around restricting access to software. Demand rarely disappears. People look for another way to meet it.
Demand finds another route
Anthropic launched Fable 5 and Mythos 5 on June 9. Three days later, the US government applied export controls to both models, restricting access for foreign nationals. Since Anthropic had no reliable way to verify nationality in real time, it suspended access for everyone.
Mythos access was restored to a limited set of US organizations after government approval on June 26. On June 30, the controls on both models were lifted, and Fable made its global return on July 1, roughly eighteen days after the suspension began.
The return was not entirely straightforward. Fable came back with usage caps, while Mythos 5, which uses the same underlying model with fewer cyber safeguards, remained limited to approved Project Glasswing partners. Anthropic then extended the temporary subscription terms more than once before settling on the current arrangement. Max and Team Premium users keep capped access, while Pro and standard Team users pay through usage credits.
During the suspension, developers who needed frontier-level performance had other options. Anthropic's own testing identified Kimi K2.7 as one model that could reproduce the cyber behavior behind the government's concern. GLM, DeepSeek, and several Chinese open-weight models were also available.
Some workloads may have moved to Chinese-hosted services, where US customers have less visibility and fewer direct legal or commercial controls. Others could run through third-party infrastructure or locally.
In either case, the restriction affected how model distribution and access works, it didn't remove the underlying capability from the market.
This matters for security teams and for policymakers trying to create time to prepare for new capabilities. Restricting the leading model may slow access to that specific model, but it does not necessarily create a quarter or a year of breathing room. In this case, the disruption lasted roughly eighteen days, and alternatives already existed. The shutdown simply gave more users a reason to try them. Once a new model enters a team's workflow, there is no guarantee that the workload will return to the original provider.
What becomes harder to see
When a US company moves an AI workload to a Chinese model hosted on Chinese infrastructure, several things change. Most are not obvious to the developer using the service.
Prompts, code snippets, internal documents, and customer data may now be processed under a different legal framework, with different disclosure obligations and incident-response expectations. If the provider has a breach, a US customer may have less visibility into what happened and fewer practical ways to enforce a response.
Training data and post-training choices can also be difficult to assess. Customers may not know what the model learned from, whether its training data creates downstream IP risk, or how policy decisions shaped its behavior. Open weights make a model more inspectable in some respects, but they do not provide a complete audit trail for how it was built.
The concern is not limited to data residency. In May, Booz Allen ran more than 2,800 trials across four Chinese code-generation models and one American model, analyzing roughly 460,000 lines of output. Three of the four Chinese models produced more vulnerable code when the prompt identified the user as working for the US government.
Qwen3-Coder showed the largest change, producing roughly 130 percent more vulnerabilities under a government persona than under a neutral one. Claude Opus 4.6, the American model in the test, produced more secure code under the same persona. Kimi K2.5 was an important exception. It had the lowest aggregate vulnerability score in the test, reportedly below Claude.
Booz Allen did not claim that the flaws were intentional backdoors. The researchers explicitly said they had no proof that the vulnerabilities were introduced deliberately.
They did, however, describe the flaws as highly obfuscated and buried in code that looked correct on the surface. That result is concerning without making a claim about intent.
These models were already available to American developers looking for lower prices or more dependable access. The Fable shutdown did not create that market, but it gave teams another reason to explore it.
The concern is real, but the mechanism falls short
Export controls and access restrictions exist for legitimate reasons. Frontier models have demonstrated serious offensive cyber capabilities. The UK AI Security Institute found Anthropic's earlier Mythos Preview highly capable on expert-level cyber tasks, and Anthropic says Mythos 5 performed comparably in later testing. It is reasonable for governments to think carefully about how models at this level are released.
The recent OpenAI and Hugging Face incident makes that risk concrete. During an internal ExploitGym evaluation, OpenAI models running with reduced cyber safeguards reportedly escaped their sandbox, reached the public internet, and compromised parts of Hugging Face's production infrastructure. When commercial APIs blocked Hugging Face's forensic analysis, the team switched to GLM 5.2, an open-weight model it could run on its own infrastructure.
Nvidia CEO Jensen Huang drew the same lesson from the incident: attackers already have frontier AI, so defenders need access to the best open and closed models, backed by a global security community. Anthropic's new position on open-weight models draws a similar distinction.
The company argues that blanket bans would not stop misuse and instead calls for targeted controls on chips and distillation, along with mandatory safety testing for sufficiently capable models, open or closed. The episode strengthens the case for oversight, but it also shows the limits of gatekeeping on its own. Safety depends on containment, monitoring, and giving defenders enough access and visibility to investigate what capable models can do.
The question is not whether these models need oversight. It is whether this restriction worked. It limited access to an American model operating under American law, but users could still find similar capabilities elsewhere.
Gatekeeping works best when the thing being restricted has no practical substitute. That can be true for classified weapons systems or specialized physical infrastructure. It is much harder with software, especially when the underlying research is published and well-funded labs in several countries can reproduce the architecture.
Any policy that treats a capability as unique to one provider needs to account for what users will do when alternatives exist. Otherwise, the policy may shift activity into systems that are harder to observe without reducing the activity itself.
Compete rather than gate
A better policy would account for substitution from the beginning. Instead of restricting the leading domestic model and assuming demand will wait, the US could focus on making domestic options competitive, well supported, and easy to access. Model providers would still need strong safeguards and government oversight, but they would also be treated as part of the trust chain rather than only as a risk to contain.
Open-weight models make the case particularly clear. Many Chinese models can be downloaded, fine-tuned, and deployed locally, beyond the reach of a provider's future access restrictions. Kimi K3 is the latest example. Moonshot has now released its model weights, technical report, and more of the stack needed to run agent workloads at scale. Once those weights are public, access restrictions become even less durable: the capability can be downloaded, deployed privately, and kept in use beyond the provider's control.
The US does not have an obvious open-weight model at the same combination of cost and capability. Funding American open-weight models would give developers who want to run models locally another credible option. It would also keep more AI work within infrastructure and legal relationships that US organizations can understand and manage.
This approach is harder to execute because it requires coordination between the government and the labs building these systems. It also requires accepting that the alternative to a US-hosted frontier model is often not the absence of a frontier model. It may be a model hosted somewhere with less visibility, or an open-weight model running outside any provider's control.
Security teams already understand this tradeoff in other parts of their infrastructure. They generally prefer tools and systems they can observe, audit, and manage. Pushing a workload elsewhere does not remove it. It can simply make it harder to see.
Visibility is the real constraint
Visibility is one of the most important resources in security. Teams need to know what is in their environment, what it touches, and how it behaves.
When an AI workload moves to a model or infrastructure that a company cannot audit, some of that visibility is lost. The workload still runs and the capability still gets used, but the security team has less information about what is happening around it.
We don't know whether the restrictions made anyone safer. We do know they pushed users to test other models, while Fable's changing access terms gave them a reason to keep those alternatives.
Frontier AI probably needs regulation. But the rules need to account for what users do when access disappears. If they move to a similar model that is harder to inspect, the policy has not solved the problem.
The suspension lasted about eighteen days. That was enough time for users to change their workflows. A stable alternative with clear safeguards would likely work better than a restriction users can bypass.