The cage Anthropic asked for

Posted on: 17 June 2026

For most of the past year the British state has been trying to reach inside Apple's encryption. The Home Office served the company a secret technical capability notice under the Investigatory Powers Act, the law the press long ago nicknamed the snoopers' charter, demanding a way into the end-to-end encrypted iCloud backups Apple sells as Advanced Data Protection. Apple chose to withdraw the feature from British users rather than build the door, the matter went to the Investigatory Powers Tribunal, and Washington pressed London until the global reach of the order was quietly narrowed. Anyone who followed that saga will recognise the manoeuvre that played out on 12 June, when the United States switched off Anthropic's two most capable models across the entire world. The same instrument, at a different scale.

It was done not by an act of Congress and not by a court, but by a letter, delivered at twenty-one minutes past five on a Friday afternoon and signed by the Commerce Department. The instrument is an export control directive. Within hours Fable 5 and Mythos 5 became unreachable for anyone without an American passport, inside the United States and beyond it, including Anthropic's own foreign staff. The company complied and, in the same statement, recorded its dissent. Every other model stayed online. The episode looks new because it concerns artificial intelligence. It is not new at all.

In the 1990s the technology too dangerous to leave the country was not a language model but cryptography, the software that let anyone scramble a message beyond the reach of any government. Washington classified strong encryption as a munition and filed it alongside missiles. When Phil Zimmermann released PGP in 1991, a free encryption programme, he was placed under federal investigation for exporting weapons without a licence. The reasoning was the reasoning of last week: a capability this powerful must not cross the border, and above all must not fall into the hands of a foreign national. The doctrine even had a name for the loophole, the deemed export, under which showing the controlled code to a foreigner standing on American soil counted as shipping it abroad. That is precisely the mechanism now cutting Anthropic's non-American employees off from their work while they sit at their desks in California.

What should give pause to anyone who lived through that fight is that Anthropic's defence today is, almost word for word, the argument the technologists made then. Anthropic says the same capability is available elsewhere, that OpenAI's GPT-5.5 does the same things and faces no such control. In the 1990s the line was that strong cryptography was already published worldwide, so blocking its export from the United States protected no one and merely punished the law-abiding. That argument eventually won. An American appeals court found that source code was expression protected by the First Amendment, and by around 2000 the controls were dismantled. The technology the state had treated as a weapon became the invisible plumbing beneath every bank transfer and every message now sent.

Here the resemblance ends and the part that matters begins. The cypherpunks of the 1990s fought the classification. They took it to court and wore it down until it collapsed. Anthropic has done the opposite. For years it has argued in public that the state ought to be able to halt systems it judges dangerous, and it has asked for rules and oversight. Its statement on 12 June repeats the position: it believes government should be able to stop unsafe deployments, provided it does so through a process that is transparent, fair, clear and grounded in technical facts. The difficulty is that whoever grants the principle forfeits the standing to contest it, and is left contesting only the procedure. Anthropic cannot argue that the state should not hold this power, having spent years arguing that it should. It can only complain that the power was used badly. It asked for the cage, and is now discovering that the cage is built to the specifications of whoever holds the keys, not of whoever requested it.

The most conforming actor, as a rule, is disciplined first, not the most reckless, because a new authority is tested where it meets least resistance. Anthropic red-teamed its own models for thousands of hours alongside the American government and the British AI Safety Institute, the body Britain stood up after gathering the world at Bletchley Park to position itself as the responsible convener of this technology. That collaboration is the point. Having woven itself so far into the national security apparatus on both sides of the Atlantic, the company made itself available to be switched off by it. This is not antagonism. It is the price of entanglement: you become so internal to the system that the system acquires a hold over you it could never have over an outsider. Britain should find this particularly uncomfortable, since its own safety institute lent its name to vetting a model Washington then disabled by decree.

Nor is it the first use of that hold. In March, according to reporting, the Pentagon had already labelled Anthropic a supply chain risk after the company declined to let its models be used for mass domestic surveillance and autonomous weapons. Taken on its own, the June directive looks like an overreaction to a jailbreak. Set beside March, it is the second strike along the same line. Call it not revenge, which is too human and too imprecise, but the management of a supplier that will not be commanded. A state that depends for a critical technology on a firm willing to refuse it on the highest-priority uses responds in the most rational way available, by reducing the dependence and increasing the leverage. The directive does both at once.

There is a difference from the 1990s that makes matters worse rather than better. Cryptography was a fixed algorithm, a defined object: you either exported it or you did not. A language model is not. Its dangerous capability exists or fails to exist depending on the safeguards, and surfaces only when someone finds a way around them. The object of control is therefore undefinable by nature, and a control over an undefinable object is not a rule but a discretion. Today it is Mythos, over a jailbreak. Tomorrow it could be any model, for any reason, because the threshold is written down nowhere. The instrument does not distinguish the dangerous from the merely inconvenient, and that is exactly what makes it valuable to the hand that wields it.

The technical pretext, for what it is worth, is not even as slight as the statement implies. On 10 June a well-known jailbreaker published a method that, by his account, made Fable produce instructions for explosives and chemical synthesis. The government moved two days later. Yet whether that bypass was grave or trivial changes little. The structural fact, the one not to lose sight of, is that the law of a single country switched off a service for the whole planet, allies included, in an evening, and the firm's only recourse is to argue about procedure. The strength of the skeleton key does not redraw the shape of the lock.

A figure is worth holding in mind. Anthropic has just filed confidentially to go public, at a valuation of around $965bn. The market is pricing these companies as technology monopolies, on software multiples. 12 June suggested they look rather more like defence contractors whose central asset can be impounded by decree overnight. Whoever buys that stock is buying not only a technology but a relationship with a state that has just reserved the right to pull the plug.

Which returns the matter to London, where the asymmetry is felt from both ends at once. Britain has played the part of the state reaching into a global encrypted product, and was made to retreat when Washington, citing the cross-border data arrangement between the two governments, treated the Apple order as an intrusion on American citizens. Britain has also played the part of the junior partner whose safety institute helped vet a model Washington then disabled without explanation. It wields the instrument against a Californian company one week and is subject to the same logic from across the Atlantic the next, sovereign in neither direction. For a country that staked a distinctive post-Brexit role on being the trusted convener of artificial intelligence, that is an awkward seat to occupy.

Anthropic, it should be said, is among the more scrupulous firms in the field, and Fable will almost certainly be back before long. But the question was never whether it returns. The question is what it means that hundreds of millions of people learned, without asking, what their access to the tool actually rests on, and that the one actor with the standing to object is the one that argued hardest for the power to exist. In the 1990s the cage was taken apart by those who never wanted it. This time it would fall to those who designed it. It is not obvious how.