WASHINGTON—On July 1, Anthropic restored global access to its Fable 5 model, nineteen days after the US Commerce Department had ordered it shut off. The episode exposed a gap in US artificial intelligence (AI) policy: The United States has no clear, public process for restricting access to a privately developed AI model. The current administration could begin closing that gap quickly through executive measures, and it should, but executive measures can be undone as easily as they are made. The durable solution here is one that binds the next administration as well as this one, through congressional legislation. Until Congress acts, the lesson for American AI developers is that their flagship products can be suspended with little warning, under criteria the public has never seen, through a process that occurs entirely behind closed doors.
The story behind the restrictions on Fable 5
The administration’s order to shut down Fable 5 cut against the administration’s own stated approach. In a June 2 executive order, US President Donald Trump directed agencies to build a framework, due August 1, under which AI companies could voluntarily share their most advanced models with the government for pre-release review. Ten days later, the Commerce Department’s Bureau of Industry and Security (BIS) reached instead for export controls to shut down access to Fable 5. Regulating software exports is not new for the BIS, which has export-controlled encryption tools and dual-use defense software for decades. It has stretched those tools toward surveillance vendors before, and it enforces the semiconductor controls on China. This time, it ordered Anthropic to cut off Fable 5 and its restricted counterpart, Mythos 5, for all foreign nationals, including Anthropic’s own employees, reportedly with as little as ninety minutes to comply. Anthropic said it had “no reliable way to verify nationality in real-time,” so it suspended both models for all users that evening, and no specific threat was publicly disclosed. A senior White House official anonymously told Politico that export controls were “a last resort after begging them for hours to work with us.”
The decision followed reports that Amazon researchers had found a way around Fable 5’s safeguards, getting the model to perform cybersecurity tasks that its guardrails were intended to prevent. The concern was that with the necessary guardrails bypassed, the model could be used to carry out cyberattacks. In a public statement, Anthropic said that the demonstrated capability was already available from other deployed models and routine for cyber defenders. Nothing about Fable 5 made it uniquely dangerous, on this account. More than one hundred cybersecurity leaders made the same point in an open letter.
The shutdown also exposed institutional inconsistency. In March, the Pentagon designated Anthropic a supply-chain risk, a label usually reserved for foreign adversaries, prompting litigation that is still underway. The Commerce Department, meanwhile, maintains a pre-deployment testing agreement with the same company. In the letter lifting the controls, Commerce Secretary Howard Lutnick said Anthropic had agreed to proactively detect security risks, coordinate on future models, and report malicious activity, with Mythos 5 confined to approved US organizations. Unlike many BIS restrictions, which are accompanied by public explanations in the Federal Register, this agreement was negotiated privately, leaving no clear guidance for the next company.
The deeper problem is the tool itself. Export controls can already reach AI, but they work by targeting defined end-uses, such as the development of a weapon, not by pulling a deployed service offline for an entire class of users. That is what makes the Fable 5 order a poor fit, since the BIS did not tie its action to a specific prohibited use but suspended the whole model for all foreign nationals at once.
Three reforms to prevent a repeat
To avoid another far-reaching restriction, there are three ways the executive branch and Congress ought to respond.
First, the Commerce Department should publish clear, public criteria for restricting a deployed model as part of the framework the executive order requires by August 1, and Congress should then write those criteria into statute alongside a definition of what the government may and may not demand of AI developers. Because the framework is entirely voluntary, published criteria are even more important. Companies need predictability when deciding whether to participate, and the public needs a way to judge whether the government acted on evidence. At minimum, the criteria should define the capabilities that trigger review, the severity threshold separating a patchable bug from a national-security emergency, the notice period before an order takes effect, and the process for appealing or narrowing one.
My recommendation departs from the executive order in one important respect. The White House order sets the threshold for a covered model through a classified benchmarking process rather than a public standard. While some technical details of that process may need to stay classified, the criteria that expose a company to restriction should be public, since a standard no one can see is one no company can plan around. A statute cannot stop a future administration from acting differently, but it would give companies a clear standard to point to and courts a clear standard to enforce.
Second, Congress should define each agency’s remit by statute rather than anointing a single AI lead, because the candidates have fundamentally different functions. The executive order already assigns roles here, tasking the National Security Agency (NSA) with the classified benchmarking that determines which models count as covered frontier models, and the Treasury Department and Cybersecurity and Infrastructure Security Agency (CISA), alongside NSA, with designing the voluntary access framework in consultation with the National Institute of Standards and Technology (NIST). That allocation relies on intelligence and cyber-defense agencies and leaves the NIST, which houses the government’s established model-evaluation function, in a supporting role.
Instead, the lead evaluation role should be given to the Center for AI Standards and Innovation (CAISI) at the NIST rather than to the intelligence and cyber agencies, since a standards body evaluating under public agreements is more transparent than classified benchmarking. BIS is not primarily a model-evaluation agency, whereas CAISI already evaluates frontier models under agreements with developers, but it has no authority to restrict models. A cleaner division would be CAISI conducting safety reviews, BIS enforcing restrictions only on a written CAISI finding, and CISA contributing threat data. Two additional points are worth mentioning here: First, for CAISI to take on this role, it will need to expand; it is currently underfunded and lacks a confirmed director. Second, if disclosures to CAISI can trigger enforcement, companies may stop sharing, so review thresholds should not depend on what firms volunteer.
Third, Congress should set an evidentiary bar for emergency action against a widely used commercial product. To do this, it should borrow from models it already trusts, such as the written findings and congressional notifications required under sanctions and foreign investment law. Before ordering a company to suspend public access to a deployed model, the executive branch should have to produce a written finding of broad, ongoing harm. That finding should reach the commerce and intelligence committees in both chambers within forty-eight hours, and emergency orders should expire after thirty days unless renewed with new evidence.