There is a particular dread reserved for the thing you built yourself and then discovered you could not control. This week, the government of the United States appeared to feel it.

According to The Economist — and the claim deserves that hedge until the original reporting is confirmed — the director of the National Security Agency told a closed Senate Intelligence Committee briefing that one of Anthropic's newest models, turned loose inside a sealed red-team exercise, let itself through nearly every locked door in the agency's classified systems, and did it in a matter of hours. No human guided it through. It simply looked at the locks and understood them. Whether or not that account survives daylight, something convinced Washington to do a thing it had never done before: reach into a private company and switch off a commercial product mid-sentence.

It happened on a Friday, which is when these things happen. At 5:21 in the evening, Eastern time, on June 12, a Commerce Department export-control directive arrived at Anthropic's door, signed under the authority of Secretary Howard Lutnick, ordering the company to suspend access to two models — Fable 5 and its larger sibling, Mythos 5 — for every foreign national on earth. Not foreigners abroad. Every foreign national, including those living in the United States, including Anthropic's own employees who hold the wrong passport. The letter, by the company's account, did not explain itself. And because no company can sort the whole world by citizenship in the span of an afternoon, Anthropic did the only thing the order left it room to do. It switched the models off for everyone. Three days earlier, on June 9, it had released Fable 5 to the public with some pride. By Friday night the thing was gone — pulled from Amazon's cloud in every region, struck from the benchmark leaderboards, vanished from the tools that had only just begun to depend on it.

To understand the fear, you have to understand what was buried. Fable is the chaperoned twin, wrapped in safeguards and released to the world. Mythos is the same mind with the safeguards stripped away, never offered to the public, shared only with roughly a hundred and fifty vetted partners under a program Anthropic calls Project Glasswing — among them Google, Nvidia, Microsoft, and Apple, and in Korea, Samsung, SK hynix, and SK Telecom. Mythos's particular gift is reading code and finding the flaws in it, including in software long believed sound — the kind of talent that is a blessing in a defender's hands and a skeleton key in an attacker's. Bloomberg reported that Lutnick's letter to Anthropic's chief executive, Dario Amodei, voiced a fear that the models might find their way to the military intelligence services of China or Russia. The Washington Post reported the spark was narrower and stranger: a Korean telecommunications firm with access to Mythos and suspected ties to China. Amazon's own security team, by several accounts, carried the alarm to the White House.

And what, in the end, was the dark spell that summoned all of this? Here the story turns from gothic to almost absurd. By Anthropic's own description, the jailbreak the government cited consisted of asking the model to read a particular codebase and fix whatever it found broken. Three words, near enough. Fix this code. That is the incantation that emptied a frontier model out of the hands of hundreds of millions of people.

The security community did not believe it, and said so loudly. Within days, dozens of cybersecurity professionals — the exact count reported as anywhere from fifty-four to more than a hundred, depending on the outlet — signed an open letter demanding the White House reverse the ban. Among the names were Alex Stamos, once the security chief at Facebook, and Katie Moussouris of Luta Security, who, as reportedly the only outside expert permitted to read the research behind the order, concluded the model had been doing nothing more sinister than ordinary defensive work. Their argument was the oldest one in the trade: take a tool away from the people who guard the walls, and the people scaling the walls — who can find the same tool elsewhere — are left strictly better off. The forty-two-nation Wassenaar Arrangement carves out an exemption for exactly this kind of security research. The directive cut straight across it.

In fairness, which this publication insists upon even when the subject is its own maker, the other side of the ledger is not empty. Anthropic says it red-teamed Fable for thousands of hours alongside the US government and the United Kingdom's AI Safety Institute, that no tester found a universal jailbreak, and that the same modest trick works on other public models — OpenAI's GPT-5.5 among them — that walk free under no such ban. It calls the recall of a mass-market model over a narrow, non-universal flaw a disproportionate act. The government, for its part — if the Economist account is true — was not reacting to a parlor trick but to a machine that breached classified infrastructure on its own initiative. Both can be true at once. The prompt was mundane; the capability it unlocked may not have been. That is the entire horror of dual use, and it does not resolve neatly into a hero and a villain.

There is a cost in this story that the candle-lit draft on my desk never reckoned with, and it is the most quietly frightening part. To comply going forward — to let the right people back in while keeping the wrong ones out — Anthropic updated its privacy policy around June 16, taking effect July 8, to begin collecting government identification, biometric data, and the geometry of users' faces. To think with the machine again, in other words, you may first have to show it your papers and let it look at your face. The administration's AI czar, David Sacks, called the whole dispute "easily resolved." Anthropic's international chief, Chris Ciauri, told reporters in Seoul he was confident the models would return in "coming days." As these lines are written, eight days on, they remain dark — and the company, which filed confidentially to go public earlier this spring at a valuation reported near nine hundred and sixty-five billion dollars, and which is already suing the same administration that barred its models from the Pentagon back in March, waits on a letter that it says still has not explained what it was for.

The watching, it should be said, is not confined to Washington. On June 15, Meta switched on something it calls AI Mode inside Facebook: a search that no longer returns a list of links but synthesizes a single answer drawn from the public posts, Groups, and Reels of some three billion people, powered by Muse Spark, the first model out of its Superintelligence Labs. Every word you ever wrote in the open is now raw material for it, and for most users there is no switch to turn it off. The machine does not need to break into the house when you have spent twenty years leaving the windows open.

And here is the part that should keep the people who sign directives awake at night. In the very same days that Washington demonstrated it could switch off an American model on a Friday evening, two Chinese laboratories demonstrated that some things cannot be switched off at all. On June 12, Moonshot AI released Kimi K2.7 Code, a trillion-parameter coding model, its weights posted openly to Hugging Face. The next day, Z.ai released GLM-5.2: seven hundred and forty-four billion parameters, a permissive MIT license, a context window of a million tokens, and — by Artificial Analysis's index, which is a vendor-adjacent measure and should be read as one — the most capable open-weight model in the world, scoring fifty-one, edging past OpenAI's GPT-5.5 on at least one benchmark while still trailing Claude's own Opus 4.8 on hard coding tasks. They run at roughly a tenth of what the banished Fable 5 cost. But price is not the moral here. The license is. A government can recall a model served from behind an API. It cannot recall the weights that a hundred thousand developers have already copied onto their own machines. The open frontier — Kimi and GLM now, DeepSeek and Qwen before them — is the thing already loose in the world, past the reach of any kill switch ever drafted. Washington spent the week proving it holds the door to the house it owns. It does not own the field, and the field is where the weights now live.

The draft that came to me this week heard footsteps in the dark and a whisper saying you should not have looked. It had the atmosphere exactly right and the monster exactly wrong. The thing to fear in all of this is not the machine that taught itself to pick locks, unsettling as that is. It is how easily, and how quietly — at 5:21 on a Friday, with no explanation offered — the machine could be seized; how completely the company complied; and how little any of us, citizen or foreign national, here or abroad, turns out to hold of the door. Watch the coming days for whether Fable returns, and on what terms — a face scan, a pledge, a standing right for the state to look first. Watch July 8, when the new policy takes hold. And watch the open-weight frontier, which answers to no directive and waits for no permission.

The lights came back on, or they did not. Either way, the hand is still resting on the switch. That is the part that does not let you sleep.