The Department of Commerce Restricted Access to Anthropic’s Latest Models. What Comes Next?

Late Friday, June 12, the Department of Commerce sent a letter to Anthropic informing the AI developer that it was imposing export controls on its latest models, Fable 5 and Mythos 5. An approved export license from the Bureau of Industry and Security (BIS), the Commerce component responsible for implementing major aspects of the U.S. export control regime, is now required for any foreign persons, whether inside or outside of the United States, to access the models. The requirement includes Anthropic’s foreign national employees. According to Anthropic, “The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.”

The letter, which has not been made public, reportedly cited national security concerns. Mediareports over the weekend say that the White House requested feedback from other companies on the safety of Fable 5, a version of Anthropic’s most powerful model, Mythos. Anthropic had initially restricted access to Mythos to trusted partners, eventually releasing Fable 5 with guardrails in place that limit its ability to respond to questions asking to identify cyber vulnerabilities. Amazon’s researchers reportedly identified methods that could bypass the guardrails, an attack known as “jailbreaking,” prompting fears that Fable 5 users could identify and exploit cyber vulnerabilities.

The following analysis examines the regulatory issues of export controls on AI models, the impacts on industry, and the potential paths forward.

Q1: What authorities does BIS have to control access to AI models?

A1: The Export Control Reform Act of 2018 (ECRA) authorizes Commerce to regulate, via the Export Administration Regulations (EAR), the export, reexport, or in-country transfer of certain military, dual-use, and commercial commodities, software, and technology. This includes the deemed export or reexport of certain technology (i.e., release or transfer of software or technology) to a foreign national in the United States or abroad. In limited circumstances, ECRA authorizes the implementation of controls over the activities of U.S. persons involved in the “support” of weapons of mass destruction (WMD) programs, or military, intelligence, or foreign security end uses or end users, including activities involving items outside the scope of the EAR. The EAR currently only regulates a limited, defined set of support activities related to WMD and military-intelligence end uses/users.

The EAR imposes controls based on the destination of the item, end use, or end user, and it can tailor controls to specified items and technology worldwide or to country groups. The Entity List also allows Commerce to control all items subject to the EAR to parties identified as acting contrary to U.S. national security or foreign policy interests. These types of controls are imposed through regulation and impact any person involved in activities subject to the EAR. 

Additional “catch-all” controls impose a license requirement under the EAR when an exporter knows an item will be used directly or indirectly for WMD-related activities or certain military end uses/users (including military-intelligence), or when a U.S. person knowingly supports, for example, WMD or military-intelligence activity. Commerce can also inform individual companies or persons of additional licensing requirements for items or U.S. persons’ activities related to these same end use/user controls. When Commerce informs a company, the company is considered informed that the export or activity will be used in a manner that requires a license.

However, the EAR, at times, restricts the ability of the U.S. government to issue “is informed” license requirements to activities involving specific country groups. The ability to issue a letter imposing a worldwide license requirement currently only applies to exports, reexports, or in-country transfers for WMD activities, U.S. persons activities related to chemical or biological weapons, or exports to a party involved in activities contrary to U.S. national security or foreign policy interests.

ECRA also directs Commerce to establish controls on emerging and foundational technologies, including by informing a person that a license is required. The “is informed” mechanism here is not limited by country scope, but this authority has not been implemented by a regulation as required by ECRA.

In terms of AI models, this means that Commerce has authority to impose a license requirement on:

• any item subject to the EAR through publication of a new regulation, thus setting up a construct applicable to all exporters; or
• a company’s export, reexport, or in-country transfer of such models (e.g., in the form of software or technology), including to foreign nationals, to address WMD or military end-use/user concerns; or
• a U.S. person’s support to certain foreign activities (i.e., WMD and military-intelligence end uses/users), including performing any contract or service, such as model training.

The EAR controls AI model weights—including those produced overseas from controlled U.S. software and technology under the foreign direct product rule—through the AI diffusion rule, which was published in January 2025. The rule, however, is not currently being enforced pursuant to a May 2025 announcement by BIS, and therefore license requirements on AI model weights are not in effect. Commerce does not have the authority to reinstate enforcement on specific provisions of the AI diffusion rule, including model weight controls, to an individual company.

Q2: What authorities did BIS use to impose controls on foreign national access to Anthropic’s Fable 5 and Mythos 5?

A2: While the letter has not been made public, media reports and discussions with people who have seen the letter indicate it cites the authority in ECRA to establish interim controls on emerging and foundational technologies, including by informing a person a license is required. As noted above, there is no regulatory framework in the EAR for this statutory authority, which is why it has never been used before as the basis for issuing a control.

The statute does not explicitly allow for a worldwide “is informed” control but does not exclude it either. By design, the statutory language is brief and nonspecific, as the details are intended to be developed in a more fulsome regulation through the federal rulemaking process. Commerce has yet to develop a regulation laying out the details and implementing this authority.

The letter reportedly also cites Section 744.22 of the EAR, which allows Commerce to use “is informed” controls when there is an unacceptable risk of use in or diversion to a military- intelligence end use/user. However, this section of the EAR only allows Commerce to impose license requirements on a small group of adversarial countries, not a worldwide control.

Furthermore, for Section 744.22 military-intelligence controls (or any other item-based controls) to apply, foreign national access to an AI model must be subject to the EAR. The letter reportedly cites Section 734.13, which defines the regulatory scope for an export, as how AI model access is controlled. However, this exact section was used by Commerce in threepreviousAdvisory Opinions as the reason why remote access transactions are not subject to the EAR.

Q3: Why is Commerce’s authority to control model access under item-based controls uncertain?

A3: It is unclear how user access to models equates to a release of EAR software or technology to any foreign nationals except those working at Anthropic. The models or model weights are not being exported. Foreign nationals are instead accessing those models on servers operated by Anthropic. It is also unclear if the exchange of information or outputs from an AI model could be considered an export under the EAR unless it was released as software or technology as defined in the EAR.

This is precisely why the House of Representatives passed the Remote Access Security Act—because ECRA does not authorize regulating remote access. The act defines “remote access” as

access on a purposeful, knowing, reckless, or negligent basis to an item subject to the jurisdiction of the United States . . . by a foreign person through a network connection, including the internet or a cloud computing service, from a location other than where the item is physically located if . . . the use of the item could pose a serious risk to the national security or foreign policy of the United States.

Additionally, as discussed in Q1 above, the EAR only gives Commerce the authority to issue a letter imposing a worldwide license requirement in specific circumstances, which do not include military-intelligence end uses/users.

Q4: Why is Commerce’s authority to control model access worldwide under U.S. person’s controls uncertain?

A4: Anthropic is performing a service by allowing access to Fable 5 and Mythos 5, and service controls on U.S. persons are clearly within the scope of the EAR when they pertain to either WMD or military-intelligence end uses/users. However, the EAR only allows Commerce to impose a worldwide license requirement on U.S. persons’ activities when support enables chemical and biological weapons end uses. While cyber-attacks could conceivably relate to military-intelligence activities, such service controls apply to only a small number of adversarial nations.

Commerce could, through the federal rulemaking process, issue a regulation implementing its authority in ECRA to impose worldwide “is informed” controls for emerging technologies in a manner that includes U.S. persons controls, but no such regulation currently exists.

Q5: How can Anthropic restore access to Fable 5 and Mythos 5?

A5: From a regulatory perspective, Anthropic has three options. The first involves Commerce’s retraction of the license requirement based upon negotiations demonstrating that the identified vulnerability has been resolved. This is the most likely path, and Anthropic has reportedly already met with White House officials to find a way forward.

The second involves legal action contesting the regulatory action on either (1) the basis for action or (2) the scope of countries covered. A legal action would seek to ensure that the imposition of the license requirement is consistent with Commerce’s ability to impose a worldwide license requirement on an individual company. As noted above, Commerce has wide latitude to impose license requirements on individual companies, but the basis for such action is tied to rationale that can constrain the scope of countries impacted. Otherwise, Commerce worldwide license requirements must be imposed through regulatory action.

Finally, Anthropic could seek to restore access within the bounds of the June 12 action, though it is unlikely to do so. This would require conducting identity and citizenship verification for all users seeking access. While burdensome, the real difficulty would be obtaining deemed export licenses for Anthropic’s foreign national staff and for global end users.

Q6: What are the implications of the controls on Anthropic for other companies, and for U.S. AI innovation?

A6: While the export control at issue only applies to Anthropic, the confusion over BIS’s authority to impose it raises uncertainty for all of U.S. industry. Underlying assumptions on what BIS can and will control are now in question. A senior White House official quoted anonymously in Politico said that “export controls were a last resort” to resolve security concerns, but now that export controls have been used to control model access, every company must consider the possibility of such controls being used again.

This action by BIS is likely to broadly undermine goals for global adoption of U.S. models. Fable/Mythos outperforms other existing models on a wide variety of standard AI benchmarks, likely making it the most powerful AI model ever released, with independent verification of its ability to identify complex multistage attacks. Yet by all accounts, the vulnerability driving BIS action is not restricted to Fable and is inherent to all modern language models. In the short term, this action is likely to drive some portion of Anthropic’s customers to other AI labs with models more powerful than Anthropic’s currently accessible technology. In the long term, however, the uncertainty over durable access to any specific U.S. AI model is likely to drive potential foreign customers to consider options they deem more reliable, including use of small, open-weight models that can run on locally owned and operated hardware.

For example, European politicians have cited the controls as further evidence of the need for sovereign AI, with dependency on U.S. AI seen as a supply chain vulnerability. The lack of process and standards for U.S. companies risks creating an impossible bar—that the U.S. government will only allow the public release of models that cannot be jailbroken, even in theory. Furthermore, the inaccessibility of the most powerful AI models provides an opportunity for China to make inroads on international adoption of its models, which lag the U.S. by 7 months on average.

Q7: What other paths could the U.S. government take to address security concerns with AI models?

A7: Export controls have a role to play in controlling access to certain physical components in the AI supply chain, most notably the computing capacity needed to train and operate advanced models. But export controls, at least on their own, are not a clear fit for resolving national security concerns for how models are being accessed and used. New legislation could open more effective approaches to addressing security risks, including expanded roles for other agencies or even creation of a new body with entirely new authorities.

Prior to last week’s events, the U.S. government’s regulatory approach to AI had focused on the development of voluntary guidelines and best practices. The most recent example of this is President Trump’s June 2 executive order on “Promoting Advanced Artificial Intelligence Innovation and Security.” This EO, which was also largely a response to the fears raised by Mythos for U.S. cybersecurity, establishes a strictly voluntary framework for AI developers to collaborate with the government prior to releasing new models, which largely mirrors a practice that U.S. AI developers had already agreed to.

Analysts and industry representatives have recommended the formation of a new government agency to oversee the most advanced AI models as well as some form of licensing regime. At a 2023 congressional hearing, for example, OpenAI CEO Sam Altman recommended that Congress should form a new agency to issue (and deny and revoke) licenses for the development of frontier AI models to ensure compliance with safety standards. This idea has largely been dormant since then; the Trump administration briefly reconsidered this idea when putting together its June 2 executive order before ultimately scrapping it for an approach more in line with their broadly deregulatory posture toward the AI industry.

In the absence of binding federal action, states may offer a blueprint for addressing AI safety and security. Last year, California and New York passed landmark AI laws that, while they differ in many fine details, both require AI developers to publish safety and governance frameworks and report critical safety incidents; a similar bill is now headed to the Illinois governor’s desk. While these bills lack mechanisms for blocking release of models, their focus on transparency into development practices incentivizes robust safety practices and signals emerging consensus on core best practices that can inform a federal approach. State AI legislation has been contentious at the federal level, prompting both legislative and executive attempts at preempting or blocking state laws, but key elements from these bills have also appeared in Congressional proposals, including a recent discussion draft of the Great American AI Act from Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA).

Kate Koren is deputy director of the Economics Program and Scholl Chair in International Business at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Kevin Kurland is a senior technical expert (non-resident) with the CSIS Economics Program and Scholl Chair in International Business. Aalok Mehta is the director of the Wadhwani AI Center at CSIS.