The Trump administration's shifting export controls on Anthropic's Mythos 5 have left foreign governments and critical infrastructure providers in limbo, underscoring how dependent global cybersecurity is on U.S. policy. Anthropic restricted access to Mythos 5—a powerful AI model designed to hunt cybersecurity vulnerabilities—to a select group of vetted U.S. organizations after initially previewing it in April. The Commerce Department imposed export controls on June 12, requiring Anthropic to seek U.S. permission before allowing any foreign national to access the model or its broader-release sibling, Fable 5. While the U.S. eased some restrictions and dropped export controls on Fable 5 this week, access to Mythos 5 remains limited to domestic partners with no timeline for international inclusion.
Global users can now access Fable 5, a similar but less restricted model, starting Wednesday, but talks over expanded access to Mythos 5 via Project Glasswing continue. Project Glasswing, the program granting access to Mythos, was upended by the June export controls, which forced Anthropic to halt international partnerships. The company is restoring access to its original U.S.-based Glasswing partners but has not set a timeline for when partners in over 15 countries—including critical infrastructure providers—will be reinstated. The UK's AI Security Institute and the EU's cybersecurity body ENISA were among the few international entities permitted to test the model, while Japanese banks were set for access and European banks were excluded.
The saga highlights a strategic vulnerability: the digital security of many U.S. allies now hinges on American regulatory decisions, creating uncertainty for global cybersecurity cooperation. Anthropic never released Mythos publicly, initially limiting it to U.S. tech firms, cybersecurity companies, and banks to patch vulnerabilities before bad actors exploit them. The abrupt policy shifts have left foreign governments and financial institutions unable to plan around access to a tool that could be critical for defending against cyber threats. What to watch next: Whether the U.S. establishes a clear, predictable framework for AI export controls, and how allies respond by accelerating domestic AI security capabilities to reduce reliance on American technology.
Key Takeaways
- U.S. export controls on Anthropic's Mythos 5 have left foreign governments and critical infrastructure providers without access to a key cybersecurity tool.
- Fable 5, a less powerful alternative, is now available globally, but Mythos 5 remains restricted to U.S. partners with no timeline for international expansion.
- The policy flip-flop underscores how dependent global cybersecurity is on unpredictable U.S. regulatory decisions.
- Allies like the UK and EU had limited access to Mythos, while Japan was prioritized over European banks, revealing geopolitical favoritism.
Insights & Analysis
- The U.S. is using AI export controls as a geopolitical lever, potentially straining alliances as foreign partners seek more autonomous cybersecurity solutions.
- This case sets a precedent that future powerful AI models may face similar access restrictions, forcing global firms to diversify their AI security suppliers or develop domestic alternatives.