Why AI export controls on Anthropic's Mythos echo decades of failed crypto crackdowns

The White House last week ordered Anthropic to block exports of its frontier models Fable and Mythos to anyone outside the U.S., including foreign nationals on American soil, citing vague national security concerns. Rather than build geographic restrictions on the fly, Anthropic pulled both models entirely, leaving them unavailable to all users for a week. Two triggers reportedly drove the Commerce Department directive: Anthropic granting a South Korean telecom (widely reported as SK Telecom, which denies the link) access to Mythos despite U.S. suspicions of China ties, and Amazon CEO Andy Jassy flagging that Amazon researchers had bypassed Fable 5’s safeguards—a characterization Anthropic disputes as a narrow, already-patched issue. Mythos had been tightly held since April, available to only about 150 vetted organizations because of its potential for large-scale cyber abuse.

The piece frames this as the first real test of whether export controls can contain frontier AI, and the historical precedents are not encouraging. In the 1990s, U.S. attempts to treat PGP encryption as a munition collapsed when creator Phil Zimmermann published the source code as a book, kicking off the Crypto Wars and ultimately clearing the path for the end-to-end encryption now used by billions on Signal and WhatsApp. The 2010s effort to fold spyware into the Wassenaar Arrangement fared little better: key spyware-producing nations like Israel never signed on, enforcement is left to each country’s discretion, and vendors such as Intellexa simply relocated to friendlier jurisdictions. Wins like the 2022 shutdown of FinFisher have been the exception, not the rule.

The standoff between Anthropic and the administration remains unresolved, and the outcome could set the compliance template every U.S. AI lab must follow. Washington may back down to keep American labs competitive—an implicit admission that Chinese and other foreign labs will reach comparable capabilities regardless—or it may force labs to seek government approval before serving any foreign customer, a costly burden. Either way, the author argues, history suggests export controls are a poor tool for stopping malicious actors from exploiting dual-use technology.