The Government Just Told Anthropic Who Can Use Its AI. This Is Bigger Than It Sounds.

The question now is whether AI export controls will follow a similar arc, or whether the technology moves fast enough that the policy framework gets permanently stuck playing catch-up.

What the Letter Actually Does

It's worth being precise about what Lutnick's letter represents legally and practically, because the coverage has been a little loose on this.

This isn't a new law. It's the Commerce Department asserting authority it believes it already has under existing export control frameworks, specifically the Export Administration Regulations, which give Commerce broad power over the export of items with national security implications. The question of whether frontier AI models fall under those frameworks has been, until recently, sort of an open question in practice. Companies have been operating under a degree of regulatory ambiguity, and frankly, Commerce hadn't pushed hard enough on the question to force a resolution.

This letter forces the resolution. By naming specific models and threatening specific penalties, Lutnick's team is essentially saying: we've decided these models are covered, act accordingly. Anthropic's decision to disable Mythos suggests the company's legal team agreed that arguing the point wasn't worth the risk.

What remains unclear is how broadly this authority will be applied going forward. Is this a one-off action targeting Anthropic's most powerful models, or the beginning of a systematic review of every frontier lab's export posture? We don't know yet. The Commerce Department hasn't published guidance that would tell other companies exactly where the line is. OpenAI, Google DeepMind, Meta, xAI, all of them presumably have lawyers asking the same question this week.

And there's a harder question underneath all of this: what does "foreign national" mean in practice for a cloud-based AI service? If a French researcher at MIT queries a model through an API, is that an export? If a multinational company with employees in forty countries buys an enterprise license, how does the company certify compliance for every query? The technical and legal complexity here is genuinely enormous, and it's too early to say whether the existing regulatory infrastructure is equipped to handle it.

The Geopolitics Are Real, But So Are the Costs

I want to be fair to the administration's position here, because I think some of the tech-press reaction has been a little naive about what's actually at stake.

Frontier AI models are not like previous generations of software. The gap between the best models and the second-best models has real strategic implications, and the gap between American frontier labs and their Chinese counterparts, while contested, is real enough that policymakers aren't crazy to worry about it. The Biden administration's chip export controls were, whatever you think of the execution, a recognition that hardware matters in this race. It's not a stretch to argue that the models themselves matter too.

If Fable 5 and Mythos 5 represent genuine capability jumps, and Anthropic's decision to pull Mythos rather than fight the letter suggests the company thinks they do, then there's a legitimate argument that uncontrolled global access creates risks. I'm not dismissing that argument.

But the costs are real too, and they're not just the obvious ones. The obvious cost is that American AI companies lose revenue and market share to competitors who aren't under the same restrictions. That's real, call me old-fashioned, but I still think companies need to be able to sell things to stay in business.

The less obvious cost is what this does to the research ecosystem. A huge amount of AI research happens at universities with international student populations. Postdocs and PhD students from China, India, Europe, everywhere, are doing foundational work at American institutions. If accessing frontier models requires export authorization based on citizenship or national origin, the administrative burden alone could reshape how that research gets done, and not in ways that obviously benefit American competitiveness.

There's also a precedent problem. Once the government establishes that it can require authorization for AI model access by foreign nationals, the scope of that authority is only going to grow. Today it's Fable 5 and Mythos 5. What's the threshold in two years? In five? These kids building the next generation of AI companies are going to be operating in a compliance environment that looks nothing like what they imagined when they started, and the rules are being written right now, in letters, not legislation.

So What

Here's my actual take, for whatever it's worth.

The Lutnick letter is probably legally defensible and probably strategically undercooked. The administration has the authority to assert export controls over advanced AI, and given the technology's capabilities, some version of that framework probably makes sense. But a letter to one company, naming two specific models, with no published guidance and no clear regulatory framework for the rest of the industry, is not a policy. It's a shot across the bow.

The shot-across-the-bow approach worked well enough in the semiconductor space, where the supply chain is physical and the chokepoints are identifiable. It's a lot messier with software. Models can be copied, fine-tuned, distilled, and replicated in ways that chips cannot. Export controls that successfully restrict access to Mythos 5 might simply accelerate the development of open-weight alternatives that are harder to control. This raises questions about... well, multiple things, including whether the entire framework is oriented toward the right problem.

What I'd like to see, and I'm not holding my breath, is a proper regulatory process: notice and comment, published criteria, clear thresholds for what triggers export control requirements, and some honest engagement with the research community about how to balance national security concerns with the realities of a globally distributed scientific enterprise. That's how you build a durable framework. Letters with penalty threats are how you get compliance from one company for six months while everyone else waits to see what happens next.

I've covered enough tech policy cycles to know that the gap between the first government letter and the actual regulatory framework is where the real damage happens, to companies, to researchers, to the broader ecosystem. We're in that gap right now.

Anthropics's decision to disable Mythos rather than push back is telling. These are not timid people, Dario Amodei has never struck me as someone who backs down from a fight easily. The fact that they pulled the product suggests the legal exposure felt real and immediate. That's worth paying attention to, regardless of where you come down on the underlying policy question.

Washington has decided it's in the AI export control business. The question now is whether it can actually do that job competently. Based on past performance, I'd say the over/under is not great. But what do I know.

Mark Kowalski · 4 days ago · 6 min