Something fundamental shifted in the AI industry over the past two weeks, and it has nothing to do with a new benchmark. For the first time, the U.S. government demonstrated — three separate times, against two different companies — that it can decide who is allowed to use a frontier AI model, switch one off mid-deployment, and gate the next one’s release customer by customer. The era of “ship it to everyone and iterate” is over for the most capable models. What replaces it is government gatekeeping, and the strategic logic is already eating itself.

Three events tell the story. The Commerce Department forced Anthropic to disable Fable 5 and Mythos 5 days after launch. The Trump administration pushed OpenAI into a government-vetted limited release of GPT-5.6. And Anthropic sent the White House a letter accusing Alibaba of running the largest distillation attack on its models to date. Read together, they describe a new regime in which the most powerful AI is treated like a munition — and a competitor that is winning the open-source race by ignoring the entire premise.

Act One: The Government Switched Off Fable 5

On June 12, 2026, Anthropic launched Fable 5 and the underlying Mythos 5 model. Three days later, they were gone — not because of a bug or a recall, but because the Commerce Department ordered their suspension under export-control authority, citing national security.

The trigger, according to reporting, was a jailbreak. Officials acted after Amazon researchers demonstrated a technique to bypass Fable 5’s safeguards and reach the potent cybersecurity capabilities of Mythos, the model beneath it. The government’s directive was sweeping: suspend access for all foreign nationals, including foreign nationals inside the United States — which extended to Anthropic’s own non-citizen employees. Faced with a rule it could not selectively enforce, Anthropic concluded it had no choice but to disable the models for everyone.

Anthropic pushed back on the substance. It argued the jailbreak in question was narrow — unlocking Mythos’s cyber capabilities in one specific instance rather than universally — and, pointedly, that the same jailbreak would work against other publicly available models, including OpenAI’s GPT-5.5, which faced no equivalent restriction. In other words: you have switched off our model for a flaw our competitors share and are not being punished for.

This was not Anthropic’s first collision with the state over Mythos. We have tracked the model’s fraught trajectory through the leak of Mythos via the Discord/Mercor breach chain, through Anthropic’s “week from hell” of Pentagon threats and abandoned safety pledges, and through the surreal episode in which the U.S. used Anthropic’s Claude in the Iran strikes hours after the administration banned it. The Fable 5 shutdown is the moment the pattern hardened into precedent: a sitting government has shown it can turn off a widely deployed AI product, mid-flight, on the basis of a security assessment the maker disputes.

Act Two: GPT-5.6 Ships Only to Whom the Government Approves

Two weeks later, on June 26, OpenAI previewed the GPT-5.6 family — Sol, Terra, and Luna — and the same hand was visible. At the U.S. government’s request, OpenAI did not ship broadly. It started with a limited preview for roughly 20 government-approved organizations, with the participant list shared with the government in advance and access reportedly cleared customer by customer.

The vetted roster is telling: Fortune 500 enterprises, government agencies, and “trusted infrastructure partners” including Microsoft, Accenture, Palantir, and the UK’s AI Safety Institute. No public beta. No ChatGPT Plus rollout. Capability rationed to the cleared.

OpenAI complied but drew a line in public. “We don’t believe this kind of government access process should become the long-term default,” the company said. “It keeps the best tools from users, developers, enterprises, cyber defenders and global partners who need them.” That is the crux of the tension: the same gate that keeps a model from an adversary keeps it from the defenders racing that adversary. We examine the GPT-5.6 rollout and its precedent in depth in our companion piece on OpenAI’s government-gated launch of Sol, Terra, and Luna.

Within a fortnight, government pre-release review went from an unprecedented intervention to a recurring feature of frontier launches. That is not a coincidence. It is a policy taking shape in real time.

Act Three: Anthropic Says Alibaba Stole the Capability Anyway

Then came the letter. On June 24, Anthropic wrote to U.S. officials accusing Alibaba of “brazenly” and “illicitly” attempting to extract its AI capabilities through what it called the largest known distillation attack against its models to date.

The specifics are striking. Anthropic alleges that operators affiliated with Alibaba and its AI lab conducted 28.8 million exchanges with Anthropic’s models between April 22 and June 5, using roughly 25,000 fraudulent accounts. The goal, per the accusation, was distillation: repeatedly prompting an advanced model to harvest its reasoning patterns and outputs, then using that harvest to train a competing model — skipping the hundreds of millions of dollars in primary R&D the original required. Anthropic further charged that in doing so, Alibaba “ignored the Trump Administration’s warnings.”

These remain allegations. Alibaba did not immediately respond to requests for comment, and distillation-via-API is notoriously hard to prove definitively versus ordinary heavy usage. The claim should be read as Anthropic’s framing of contested events, not an established finding. But the strategic anxiety behind it is real, and it connects directly to a pattern we have documented before — from Chinese AI companies circumventing U.S. export controls via “the digital Silk Road in suitcases” to Anthropic exposing the first AI-orchestrated cyber-espionage campaign run on Claude by Chinese operators.

The Paradox: A Vault on One Side, a Giveaway on the Other

Put the three acts side by side and the contradiction is glaring.

The United States is treating its frontier models as controlled technology — disabling Fable 5, gating GPT-5.6, and policing distillation by foreign labs. The entire apparatus assumes that capability is scarce and exclusivity is defensible: keep the best models away from adversaries, and you preserve an edge.

But on the other side of the board, China is winning by doing the opposite. Alibaba’s Qwen family has surpassed one billion cumulative downloads on Hugging Face, overtaking Meta’s Llama as the most-downloaded open model, anchoring more than 200,000 derivative models. By mid-2026, Chinese open models held five of the top ten trending slots, and by May, Chinese open-weight models accounted for roughly 61% of all tokens consumed on OpenRouter, the largest neutral model router. Qwen3.5-class models now sit alongside GPT-5 and Claude Opus in capability rankings. China is not hoarding the frontier — it is giving comparable models away, optimizing for ubiquity and developer mindshare rather than control.

That is the paradox American gatekeeping has to answer. If the best closed model is locked behind an export order and a 20-customer allowlist, while an open-weight model of similar strength is one git clone away on a Chinese lab’s repository, then the control regime protects exclusivity that the market has already routed around. You cannot embargo a capability that your rival is publishing for free. And every restriction that slows a U.S. lab’s deployment hands the open-weight ecosystem more time, more adoption, and more of the defender community that OpenAI warned would be cut off.

What This Means Going Forward

For security teams and enterprises, three practical realities now apply. First, frontier-model availability is no longer guaranteed — a model you build on can be switched off by regulatory order, as Fable 5’s users learned three days in. Build with portability and fallback in mind. Second, access is becoming a credential, gated by vetting and nationality; plan for the possibility that your best tooling depends on clearance, not just a credit card. Third, the open-weight alternative is real and improving fast, which means the strategic question is no longer “can we keep the best models exclusive” but “what do we do when the second-best model is open, ubiquitous, and good enough.”

The U.S. has established that it can control the frontier. The harder question — the one Fable 5, GPT-5.6, and the Alibaba letter pose together — is whether controlling the frontier still matters when the frontier is being given away. America has built a vault. China is running a bazaar. Two weeks in June suggest the bazaar is winning.

Sources