Not a Screwdriver or Uranium: Washington Invented a Third Label

How the reinstatement was negotiated, what Anthropic conceded, what OpenAI pre-conceded—and the open question every AI builder inherits.

EDITORIAL NOTE: The scheduled article for this week was pre-empted by this follow-up piece on the return of Fable 5 on 1 July 2026. Previous analysis of the shut down published on 15 June 2026 is linked below. Also, I’m trying out a different day for these long form research articles. Tell me in the notes if you prefer Tuesdays or Thursdays. Back to our regularly scheduled AI industry analysis next week!

Three weeks ago, the US government switched off the most capable AI model on the market with a label and a letter. I walked you through that in Screwdriver or Uranium: Why What We Call an AI Model Now Decides Who Can Use It. I made fifteen predictions about what the switch would set in motion. And I promised to keep score in public.

On July 1, Fable 5 came back on—for everyone, everywhere, at once (Anthropic). This edition is the update I promised: how the model came back, the scorecard on those fifteen calls, and the answers to the open questions the first article left unresolved. The headline is not that the model returned. It is what the return revealed.

Washington has invented a third label for AI—and it is based on letters no one outside the room has read.

How the models came back

Let’s start with the timeline, because the mechanism lives in it:

• June 12, 5:21pm ET. Commerce Secretary Howard Lutnick’s export-control letter lands. It orders Anthropic to block every foreign national worldwide, including the company’s own employees inside the US. Anthropic cannot sort users by citizenship in real time, so it shuts off Fable 5 and Mythos 5 for everyone (Anthropic).

• June 26. A second Lutnick letter carves out “certain trusted partners” and their foreign-national employees for Mythos 5. Anthropic confirms the government approved Mythos 5 for a set of US organizations that operate and defend critical infrastructure (Mayer Brown).

• June 30. The export controls on both models are lifted (Anthropic).

• July 1. Fable 5 is restored globally on every Anthropic surface, with cloud platforms to follow “as quickly as possible” (Anthropic).

Counting from the June 12 order, that is 18 days to the lift and 19 to restored access. You will see both numbers in coverage; the difference is only where you stop the clock.

What happened between those dates was not litigation or legislation. It was a negotiation. Anthropic’s own account itemizes what it conceded (Anthropic):

1. A new safety classifier. It blocks the specific reported technique in over 99% of cases. Blocked requests fall back to Claude Opus 4.8.

2. Government validation. CAISI—the Commerce Department’s Center for AI Standards and Innovation, housed at NIST—tested the old and new safeguards. Its researchers judged them “extraordinarily strong.”

3. Pre-release government access. For future models that push the frontier in national-security-relevant areas, designated government partners get early access. They can test the models and the guardrails before broad release.

4. Rapid information sharing. Significant jailbreaks and misuse patterns get investigated and reported to government counterparts. Anthropic also joins the interagency cyber-vulnerability clearinghouse created under the June 2 Executive Order.

5. Dedicated joint resources. Anthropic teams and a significant compute allocation now support government testing and research.

6. An industry jailbreak-severity framework. Co-developed with Amazon, Microsoft, Google, and other Glasswing partners. It scores any jailbreak on four criteria: capability gain, breadth, ease of weaponization, and discoverability. A new HackerOne submission program and a 24/7 monitoring team back it up.

No court and no new law brought Fable 5 back—a classifier, a concession list, and a handshake did.

The scorecard: what moved since June 15 and the consequences

I made fifteen predictions in the previous article. Here are the five that materially moved; the full list is in the June 15 edition.

1. “Your most powerful tool can be turned off overnight” (#1)—proven, then reversed the same way. The model was turned off by an unpublished letter and reinstated by an unpublished letter. Neither document has been released (Just Security).

2. “Will the model stay on?” (#6)—now a permanent planning criterion. The model that returned is not the model that left. Fable 5 is included on Pro, Max, Team, and select Enterprise plans only up to 50% of weekly usage limits through July 7, then moves to usage credits (Anthropic).

3. Investors price the switch-off risk (#8–9)—confirmed in kind, not in numbers. Anthropic and OpenAI are both still privately held, so there is no stock price to serve as a verifiable indicator of this episode’s cost. What needs no market data: a 19-day, government-ordered outage of a flagship product is no longer a hypothetical anyone can wave away.

4. A defender’s tool pulled because it might help attackers (#13)—confirmed, and answered. The resolution restored the cyberdefense model first, to critical-infrastructure defenders, one week before the general lift (Mayer Brown).

5. Unsettled law (#15)—now a docket number. A customer sued the government on June 23 (CourtListener). More below.

The other ten calls are trending the way I sketched them in the previous article, but none has resolved cleanly enough to score definitively.

The predictions that came true were not about the model—they were about who controls the switch that keeps it available.

The jailbreak question, answered in practice

The previous article’s sharpest dispute was whether the reported bypass was even a real jailbreak. The resolution answered it in practice without ever settling it in principle.

Anthropic ran the reported technique through the wider field—Claude Opus 4.8, GPT-5.5, Kimi K2.7, and five older systems (Anthropic). All of them matched the result. The technique exposed no capability unique to the Mythos class. By the company’s account, the behavior was a borderline case inside a deliberately oversized safety margin: routine defensive cybersecurity work, blocked for caution, unlocked by clever prompting.

And yet Anthropic built the fix anyway, and the government’s own testers validated it. That sequence also settles a June claim from a White House adviser that Anthropic had refused to fix the problem. The fix shipped, and CAISI signed off on it (Anthropic). One transparency note: the account of the new classifier and its validation comes from Anthropic’s own statement—the government has not published its own version of the testing (Just Security).

Two corrections of my own, because the scorecard cuts both ways. In June I described the UK AI Security Institute as having built a working jailbreak within hours. That was too strong. The institute’s published work documents capability evaluations of the Mythos-class model (UK AISI). The fact on the record is Anthropic’s own launch concession that UK AISI “has made progress towards” a universal jailbreak (Anthropic). And the June report of suspected foreign access to the model stays where I left it: unconfirmed, and out of the load-bearing story.

Here is what should hold your attention: nobody conceded a definition. The industry responded by starting to write one. The four-criteria severity framework is the field’s first attempt at an objective standard for when a jailbreak matters (Anthropic).

Every model Anthropic tested could produce the same demonstration that took Fable 5 offline.

The machinery now has a name

The previous article’s biggest unknown was that nobody had publicly named the legal authority behind the order. That is now half-answered, and the half matters.

The legal mechanisms used are now public. The letter invoked Section 4817(b)(1) of the Export Control Reform Act, which lets Commerce place interim controls on emerging technologies. It also invoked Section 744.22(b) of the Export Administration Regulations—the “is-informed” rule aimed at military-intelligence diversion risk in countries of concern, including China and Russia (Mayer Brown). The enforcement question was also resolved: the authority sits with the Commerce Department’s Bureau of Industry and Security (BIS), under Lutnick—not the State Department, and not the Pentagon, whose separate supply-chain fight with Anthropic is still live (Just Security).

What remains unpublished is everything else. The order itself has never been disclosed. No rule was issued. No classification number exists. Commerce has released no public guidance on the threat or the standard (Just Security).

And inside those unpublished letters sit two legal firsts (Mayer Brown):

1. The model itself became a controlled item. Commerce claimed jurisdiction over the model as such—every earlier action stopped at weights or source code.

2. Access became an export. It counted API access as an export. Under the “deemed export” doctrine, that reach extends to foreign nationals sitting inside the US.

The second move contradicts three standing advisory opinions from BIS—the same Commerce bureau now enforcing this order—issued in 2009, 2011, and 2014. Those opinions held that remote access to cloud software is not an export, and companies have relied on them for years (Mayer Brown). Congress is still debating the Remote Access Security Act, a bill that would grant BIS exactly this authority. The bill’s existence implies BIS may not have that authority today.

Step back and the shape comes into focus. The question in June was screwdriver or uranium: ordinary dual-use software, or weapon. Washington answered with neither. It created a third category that exists only in company-specific letters—unpublished, case-by-case, resting on contested authority, with no rule behind it and no court yet ruling on it. I call this: rule by letter. The most consequential AI policy of 2026 is, so far, a stack of private correspondence.

For the first time, Washington treated the model itself—not its code, not its weights—as controlled technology.

The courts get their turn

In June, no one had sued. That lasted eleven days.

On June 23, a San Jose legal-tech company called Legion LegalTech filed suit. Its developers in Canada had lost Fable 5 access. The case—Legion LegalTech, Corp. v. United States of America, No. 1:26-cv-02225, in federal court in Washington, DC—names Secretary Lutnick and BIS Under Secretary Jeffrey Kessler among the defendants (CourtListener). The company wants the directive vacated and blocked. Its core argument: the order exceeds the government’s statutory authority (Mayer Brown). The court has set a schedule: the government responds by July 14, and a hearing comes no earlier than the week of July 27 (CourtListener).

In June I told you about the 1990s encryption fight, when courts pushed back on treating code as a munition. That history is no longer an analogy. It is a live case—filed not by the company that was silenced, but by a customer who lost the tool.

The suit’s terrain is a sentence the government wrote itself. Executive Order 14409 is the policy backbone of this whole regime, signed June 2 and published June 5. It states that nothing in its frontier-model section “shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement” for releasing new AI models (Federal Register). Ten days after those words were signed, a mandatory license requirement arrived at Anthropic’s door by letter. The distance between that sentence and that letter is where this case will be fought.

The encryption fight took years to reach a courtroom; the AI version took eleven days.

What Washington wanted, what the labs gave, what they kept

Here is the full map: who demanded what, who conceded what, and which objections survive.

1. What the government stated it wants. Screening of frontier models for cyber-misuse risk before they reach the world. The letter’s own legal hooks frame the concern as military-intelligence diversion to countries of concern (Mayer Brown). The June 2 Executive Order builds the standing machinery: classified capability benchmarking, plus a voluntary framework that gives the government up to 30 days of pre-release access to “covered frontier models” (Federal Register).

2. What Anthropic gave. The classifier fix, CAISI validation, pre-release access, information sharing, joint teams and compute, the co-led severity framework (Anthropic)—on top of the 30-day data-retention policy it has run on Mythos-class traffic since launch (Anthropic).

3. What OpenAI gave, before it was ever ordered to. The regime generalized to a second lab before it finished resolving at the first. On June 26—four days before Anthropic’s lift—OpenAI previewed GPT-5.6 Sol, Terra, and Luna. At the government’s request, it released them first to “a small group of trusted partners whose participation has been shared with the government.” OpenAI calls this a “short-term step” while a “repeatable process for future model releases” gets built (OpenAI).

4. What the labs kept, verbatim. Anthropic: these rules should be “codified in strong regulation and applied equally across frontier model developers” (Anthropic). OpenAI: “We don’t believe this kind of government access process should become the long-term default” (OpenAI). Both companies complied; neither accepted the process as legitimate long-term law.

5. The actual state as of publication (July 6, 7am ET). The models are live. The letters remain unpublished. The framework is voluntary and in draft. The lawsuit is pending, with a hearing no earlier than the week of July 27 (CourtListener).

A truce was reached on process; the legal question underneath—can Commerce do this at all?—was conceded by no one and is now in court.

The labs got their models back by agreeing to show Washington the next ones first.

From the boardroom to the solo desk

In the previous article, the sharpest question at the solo desk was what a government shutdown does to the work that depends on the model. The access came back. The lesson got harder.

Fable 5 returned under new commercial terms, set while customers were locked out. Included plan access runs only through July 7, and only up to half of weekly usage limits; after that it shifts to paid usage credits, and cloud availability trails the direct platforms (Anthropic). Three weeks ago the lesson was that you rent the model you build on. Now the lesson is sharper: the rent can change while you are locked out.

If you lead a team, this forces the durability posture I laid out in Durability Is the New AI Advantage and, before that, in The AI Speed Trap. It now has three concrete line items:

1. A tested second-model fallback. Not a name on a slide—a workload you have actually run on the backup, because the 19-day outage was survivable exactly in proportion to how real your fallback was.

2. Session and work portability. Keep state, artifacts, and context exportable so your work outlives any one model’s availability—an outage you can walk away from is an inconvenience, and one you cannot walk away from is a stoppage.

3. Contract language for suspension and terms changes. Your agreements were written for outages measured in hours and prices that change with notice. Ask your vendor what happens to your terms during a government-ordered suspension, because now there is precedent.

I am keeping this cost qualitative on purpose: no verified figure exists yet for what those 19 days cost the ecosystem. The verified record—19 days dark, terms reset, a second lab gated—is heavy enough.

The model returned with new prices and new terms, and no user sat at the table where they were set.

What every release looks like now

Put the public record together and the forward picture is already visible. The Executive Order supplies classified benchmarking and a voluntary pre-release access framework (Federal Register). The industry supplies its own severity standard for jailbreaks (Anthropic). And the labs supply the posture: OpenAI is explicitly building a “repeatable process for future model releases” with the administration (OpenAI). Gated rollouts to vetted partners, with government visibility, are becoming the default shape of a frontier launch.

The fair pushback: one company, one scare, and the system arguably worked—flagged, fixed, validated, restored, in under three weeks. Why call that a regime? Because the pattern outran the incident. OpenAI gated its own launch at the government’s request before Anthropic’s case was even resolved. The Executive Order institutionalizes the review machinery on a standing basis. And the only thing that says this cannot happen again tomorrow, to any lab, on the same unpublished basis, is that nobody has written the rule that says when it can. A regime without a rulebook is still a regime—it is just one without transparency to the companies it regulates and the users they serve globally.

So the question every AI builder inherits is not whether frontier releases get reviewed. That is settled in practice. The open question is which of three forces writes the durable rule:

1. Congress, through something like the Remote Access Security Act (Mayer Brown).

2. The Legion court case, with a hearing no earlier than the week of July 27 (CourtListener).

3. The quiet accumulation of truces, one negotiated resolution at a time.

You are already living under whichever one wins.

Pre-release review is voluntary on paper and universal in practice—no frontier lab has yet tested the difference.

The bottom line

Three weeks ago I wrote that the label would be decided after the fact, in a courtroom or a committee room. Both rooms are now booked: the courtroom has a docket number and a July hearing window, and the committee room has a draft framework with four criteria in it. What I could not have told you three weeks ago is that a third room got there first—the one where an unpublished letter switched the model off, and a second unpublished letter switched it back on.

Screwdriver or uranium was the wrong question. Washington’s answer was rule by letter—and every release calendar in the industry has already adjusted to it. Watch three clocks:

• July 14—the government’s response to Legion’s injunction motion.

• The week of July 27—the first hearing on whether a letter can do what a rule never authorized.

• The framework’s first public draft—the industry’s attempt to write the standard before Washington writes it for them.

I will follow up with updates.

The label fight didn’t end; it moved into a courtroom, a framework, and every release calendar in the industry.

A note on sourcing: the June 15 edition was written in the hours after the shutdown and drew in part on early press coverage. Every claim in this update links to the original document or announcement it comes from.

Learn more: What Anthropic’s terms say when a model goes dark

Fable 5 came back with new prices, so I went looking for the contract language that governs the next shutdown. Two findings stand out:

1. The right to suspend was on the books before June 12. Anthropic’s Commercial Terms of Service (effective June 17, 2025) allow suspension when providing the service “is prohibited by applicable law,” with restoration “as soon as reasonably possible” once the cause “is cured, where curable”—and they state Anthropic “will have no liability for any damage, liabilities, losses (including any loss of data or profits)” from such a suspension. The Consumer Terms (effective October 8, 2025) go further: Anthropic may “modify, suspend, or discontinue” the services “at any time without notice.”

2. No clock, no meter, thin recourse. Neither document sets a maximum length for a suspension—days, months, or indefinite—and neither promises compensation when one ends. Consumers can cancel, without a refund for the elapsed term; commercial customers face a liability cap of their last 12 months of fees, and the terms disclaim uninterrupted service outright. The July usage-credit arrangement arrived by announcement, not by contract.

Neither document has been updated since the shutdown, because neither needed to be. The order tested language that was already there—and the language held. Review your own vendor agreements before the next letter is signed.

Additional Resources

• AI Strategic Radar: Decision-grade intelligence for the week ahead—Top 5 stories in AI to prepare you for the work week. Drops every Monday before your first coffee.

• humandividend.ai—where you’ll learn to build the workforce, leadership, and coaching bench that compounds as AI scales.

Sources

1. Anthropic, “Redeploying Fable 5,” June 30, 2026 (updated July 1, 2026). https://www.anthropic.com/news/redeploying-fable-5

2. Anthropic, “Statement on the US government directive to suspend access to Fable 5 and Mythos 5,” June 12, 2026. https://www.anthropic.com/news/fable-mythos-access

3. Anthropic, “Claude Fable 5 and Claude Mythos 5,” June 9, 2026. https://www.anthropic.com/news/claude-fable-5-mythos-5

4. Mayer Brown (Kendler, Hussain, Waltzman, Soliman, Hickey, Jebeyli), “Commerce Department Extends Export Controls to Advanced AI Models; Authorizes Release to Specific Trusted Partners,” June 30, 2026. https://www.mayerbrown.com/en/insights/publications/2026/06/commerce-department-extends-export-controls-to-advanced-ai-models-authorizes-release-to-specific-trusted-partners

5. Brian Egan, “Legal Considerations Related to the Anthropic ‘Export Controls Directive,’” Just Security, June 15, 2026. https://www.justsecurity.org/142745/law-anthropic-export-controls/

6. Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” 91 FR 34565 (signed June 2, 2026; published June 5, 2026). https://www.federalregister.gov/documents/2026/06/05/2026-11415/promoting-advanced-artificial-intelligence-innovation-and-security

7. OpenAI, “Previewing GPT-5.6 Sol: a next-generation model,” June 26, 2026. https://openai.com/index/previewing-gpt-5-6-sol/

8. UK AI Security Institute, “Our evaluation of Claude Mythos Preview’s cyber capabilities,” April 13, 2026. https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities

9. Legion LegalTech, Corp. v. United States of America, No. 1:26-cv-02225 (D.D.C., filed June 23, 2026), docket via CourtListener. https://www.courtlistener.com/docket/73520460/legion-legaltech-corp-v-united-states-of-america/

10. Paola Sanmiguel, “Screwdriver or Uranium: Why What We Call an AI Model Now Decides Who Can Use It,” Strategic AI Radar, June 15, 2026. https://www.linkedin.com/pulse/screwdriver-uranium-why-what-we-call-ai-model-now-who-paola-ghdpc

11. Paola Sanmiguel, “Durability Is the New AI Advantage,” Strategic AI Radar, June 22, 2026. https://www.linkedin.com/pulse/durability-new-ai-advantage-paola-sanmiguel-m-s--gbhfc/

12. Paola Sanmiguel, “The AI Speed Trap,” The AI Playbook: The Weekly Call, April 22, 2026. https://cognivalab.blog/p/the-speed-trap?r=272kkc

13. Anthropic, “Commercial Terms of Service,” effective June 17, 2025. https://www.anthropic.com/legal/commercial-terms

14. Anthropic, “Consumer Terms of Service,” effective October 8, 2025. https://www.anthropic.com/legal/consumer-terms