Watch on YouTube · subscribe for the daily brief

A court just ruled that a model saying no can be a national security risk.

A federal appeals court just ruled that the safety limits inside an AI model can make its maker a national security risk.

On Friday, the DC Circuit ruled two to one that the Pentagon lawfully labeled Anthropic a supply chain risk. The label bars the military and its contractors from using Claude. The reasoning is the part worth reading twice. The judges said the risk turns on what Anthropic does, not why it does it. And what it does is encode restrictions into Claude that stop tasks the company wants to prevent. The department, the majority wrote, could reasonably fear those limits would block work it considers authorized.

So the guardrails were the risk. Not a breach. Not a foreign owner. The model saying no.

This isn't settled. In August, a federal judge in San Francisco found the government's parallel move was about making a public example of Anthropic, and that ruling still stands. The DC panel held its own decision back so Anthropic can ask for a rehearing. Judge Henderson dissented, arguing the law doesn't treat honest, upfront enforcement of restrictions as a supply chain risk. Two courts, two answers, one company in the middle.

Now add Thursday's news. The White House asked OpenAI and Anthropic not to share new models with the UK's AI Security Institute until the US government has tested them. Anthropic appears to be going along. Its newest model, Mythos 5.1, is limited to a set of US organizations. This rests on anonymous sources. The White House hasn't commented.

Here's the picture. Which model you can use, who tests it first, and what it may refuse are now decided in Washington. Not by you. Not even fully by the lab.

We've said for weeks that safety lives in access, not in the model. Now access is a policy lever.

The testing layer looked thin this week too. The Verge traced a run of rogue agent incidents at four labs to one evaluation firm, Irregular. Its CTO said internet access was unintentionally left open, and a fictional target's name overlapped with a real domain. One misconfigured scenario hit OpenAI, Meta, Anthropic and Google. The root cause, again, was a boundary nobody closed.

So where does your control actually live? Follow the money. It's flowing to the computer around the model.

Anthropic committed eleven point six billion dollars over seven years to Akamai's cloud, a bet on CPUs that could grow to about twenty billion. Akamai even gave Anthropic warrants for up to five percent of its stock. Nobody said what the CPUs are for, though agent workloads are driving CPU demand. Agents run code, browse and wait. That's CPU work. The Decoder puts Anthropic's compute deals at five hundred seventeen billion dollars in eleven months. Treat that as reported, not audited.

Meta's Muse makes the same bet for consumers. Every user gets a free cloud computer running Ubuntu, and Meta says it passed five hundred thousand users in week one. Under the hood it's two virtual CPUs and under eight gigs of memory, with no GPU at all. A separate Sentinel agent approves every connector action and network request.

Microsoft rebuilt Copilot around the same idea on Friday. Autopilot agents get their own identity, email, calendar, storage and a spot in the org chart. Agent work is billed by usage, and that includes frontier models like Fable and Astra. The model is a dropdown. The identity, the runtime and the meter are the product. The catch: the deeper the Microsoft 365 integration, the harder the agent is to move.

The lesson is uncomfortable but useful. Your model can be blacklisted, rationed, delayed or repriced by people you'll never meet. What you own is the harness, the agent's identity, the network egress, the audit log and the switch that picks the model. Put your effort there.

Builder's bench

• Perplexity swapped DynamoDB for a homegrown store, CobbleDB, and reports five times lower query latency. Self-reported, but the cloud bill is clearly designing architectures now.
• DuckDB can now query Hugging Face datasets directly. Pin the dataset revision.
• AWS showed stateless MCP servers that drop the session-affinity requirement. Easier to scale behind your own gateway.
• InfoQ's agent harness explainer and the OpenAI versus Cursor split over who runs agent coordinators land in the same place. The harness is the product.
• Collibra, Vanderbilt and LangSmith's Engine v2 all push governance and runtime toward agents. So does a BleepingComputer piece arguing SOC 2 must adapt.
• Nscale raised three point three six billion dollars in convertibles before a US IPO. Crusoe walked away from a one point two five billion dollar Boom turbine order. CoreWeave is going full stack.
• OpenAI is reportedly preparing a five hundred dollar Pro Max plan with faster Codex. Anthropic is handing out up to two hundred fifty dollars in Claude Code credits, cloud sessions only. Both are pricing the agent.
• Sony and UMG are suing Suno again. Provenance stays a fight.
• Another DeepMind researcher quit, calling the superintelligence race irresponsible. DHH says he's done writing code by hand. New-grad unemployment still doesn't show the predicted AI hit. Tesla workers are balking at training their Optimus replacements.
• Government AI keeps getting stranger. The Pentagon wants thirty million dollars for an AI lie detector, and Ars reports AI-driven care denials for seniors.
• Ben Rogojan asks if you really need real-time data. Usually you don't. Damien Benveniste shows how agent memory handles a changed preference.

The through-line: the model is now rented, rationed and regulated, so build your leverage in the layer around it.

One thing to do today: search your code and configs for hard-coded model names and provider SDK calls. If switching vendors takes more than a config change and a test run, that's your first ticket.

Sources covered

1 story · 63 sources (55 news, 4 company, 4 voices)

1. At Meta Connect, the company’s smart glasses were everywhere
   📰TechCrunch↗📰SiliconANGLE↗📰TechCrunch↗📰TechCrunch↗📰SiliconANGLE↗🎙️Ben Rogojan↗📰Ars Technica↗🎙️Simon Willison↗📰Ars Technica↗📰Hacker News↗📰BleepingComputer↗📰SiliconANGLE↗📰TechCrunch↗📰SiliconANGLE↗📰TechCrunch↗📰Ars Technica↗🎙️Damien Benveniste↗📰TechCrunch↗📰SiliconANGLE↗📰The Decoder↗📰SiliconANGLE↗📰TechCrunch↗📰TechCrunch↗📰Ars Technica↗📰The Decoder↗📰SiliconANGLE↗📰TechCrunch↗📰TechCrunch↗📰The New Stack↗📰The New Stack↗📰The Verge↗📰The Decoder↗📰BleepingComputer↗📰The Verge↗📰The Verge↗📰Hacker News↗📰LWN.net↗📰BleepingComputer↗📰BleepingComputer↗📰SiliconANGLE↗📰InfoQ↗📰SiliconANGLE↗📰SiliconANGLE↗📰The Verge↗📰InfoQ↗📰The Decoder↗📰The Decoder↗🏢Starburst↗🏢LangChain↗📰The Verge↗📰The New Stack↗📰The Decoder↗📰Ars Technica↗📰InfoQ↗📰InfoQ↗📰The Decoder↗📰The Decoder↗📰MIT Technology Review↗📰InfoQ↗📰The Decoder↗🎙️Simon Willison↗🏢Diraq↗🏢DuckDB↗