You can't print this one on a t-shirt

In the 1990s I owned a munition. It was a t-shirt—a few lines of Perl printed across the chest, an implementation of RSA compact enough to wear. And under the arms-export rules of the time, carrying it across a border was a federal offense.

The shirt existed because of Phil Zimmermann. In 1991 he posted PGP to a public FTP server, and the US government opened a criminal investigation. Encryption was classified as a munition under ITAR, the same rules that governed the export of weapons. Zimmermann hadn’t shipped guns across a border. He had published math.

The case ground on for three years before the government dropped it, and by then the absurdity had hardened into a protest genre. Adam Back, who had printed the RSA algorithm onto the shirt I owned, mailed one to the munitions office to ask whether wearing it abroad needed an export license. They never wrote back. Daniel Bernstein sued for the right to publish his own encryption code and won, a federal court ruling that source code is protected speech. Netscape, hedging, shipped two browsers: a strong 128-bit version for Americans and a hobbled 40-bit one for everyone else, a split so plainly theatrical it became the standard example of security theater. The controls came apart anyway. Clinton loosened them in 1999 and let them lapse in 2000. By then, American companies had spent a decade ceding ground to foreign rivals who faced no such rules, and Zimmermann’s math had ended up in every browser on earth.

On June 12, 2026, Commerce Secretary Howard Lutnick sent Dario Amodei a letter suspending foreign access to Fable 5 and Mythos 5. The trigger was a claimed jailbreak: another company said it had found a way around Mythos 5’s safeguards. Anthropic reviewed the technique, called it minor and discoverable through other public models, and complied within the day anyway. Exporting either model now requires a license, as does re-exporting it or moving it inside the country, and any foreign national is cut off—including the ones Anthropic employs in its own offices.

The names sit strangely against the order. A fable is a story that carries a moral; a mythos is the story a people tells to explain where it came from. Anthropic gave its two most capable systems the oldest names we have for how a culture makes sense of itself, and the Commerce Department has now classified both as munitions.

On its own, the export control makes sense. It stops making sense the moment you set it next to what the same government had spent the spring doing to the same company. Three months earlier, the Department of War had branded Anthropic a supply chain risk and ordered federal agencies to rip its products out. The two orders point in opposite directions: one walls Fable and Mythos off from foreigners as a national security asset, the other treats them as a national security threat at home. The crypto wars explain the first. They explain nothing about the second. The parallel is still worth tracing, because the place it snaps is exactly where the second order shows itself.

The shirt worked as protest because the thing it carried was already loose in the world. What the 1990s government was trying to contain was a mathematical function, and RSA had been in the open since 1977. Once a function is in the literature, it’s there for good. Printing it on cotton only made the joke visible: you can’t classify an idea as a weapon after the world already has it. Wearing mine gave me a small thrill with a thin edge of fear, even though no law could actually touch me, and that gap between how it felt and what it was is the whole cypherpunk argument. I was walking around in the question Adam Back had mailed the office—the one they never answered. Enforcement was lost on day one.

Fable and Mythos are nothing you could publish. They’re weights on a server, behind a company’s access controls, and that single fact is what makes this order enforceable in a way ITAR never was. Zimmermann couldn’t unpublish RSA. Anthropic can switch its models off, and on June 12 it did. The trouble is the verb. A model switched off can be switched back on. It stays off only as long as the company keeps its hand on the switch—and only as long as there’s nothing else to reach for.

In 2026 there’s plenty else to reach for. The moment rhymes with 1999, the year before the controls lapsed, when the distance between what was restricted and what was freely available was closing faster than the rules could track. Meta’s Llama 4 ships open weight. DeepSeek V4 is open source, sits outside US jurisdiction, and undercuts its American rivals by 5 to 30 times. The gap between an open model and the hosted frontier used to be measured in years. It’s months now, and the count keeps falling. That collapse was the subject of The cost of intelligence just hit zero, and it doesn’t go back up. The crypto controls never stopped strong encryption; they handed the market to foreign competitors while anyone who cared kept their keys. The same machine is running again, faster, with Chinese labs collecting the difference. But only the capability carries forward. The resistance does not. Wearing the shirt was refusal. Downloading DeepSeek is procurement.

The 1990s controls were at least aimed at something the size of the problem. The target was cryptographic capability itself, and the theory, wrong as it turned out, was that the supply could be held down. The June order has no target that size. It was set off by a single jailbreak of a single hosted product—someone had used a chain of clever prompts to talk Mythos 5 past its refusals—and a vulnerability in a hosted product is about the most fixable thing in software. The government’s response to a patchable bug was to pull the entire model.

There’s nothing in the crypto wars that resembles the foreign-national provision. Export controls have always been about where a technology goes; this one is about who may touch it, anywhere. A foreign national at Anthropic’s San Francisco office now needs a license the American at the next desk does not. That is nationality-based access control imposed on a private company’s internal operations. No court has ruled on whether it’s legal, and the mechanism—a Commerce Secretary’s letter demanding immediate suspension—is strange enough that nobody knows whether it would survive one.

Set the export control beside the blacklist and the two won’t add up to a single fear. In March the Department of War called Anthropic’s products a national security risk and pulled them out of federal agencies. In June the Commerce Department called the same products a national security asset, too sensitive for foreigners to touch. And the whole time, half a dozen Anthropic engineers were embedded at the NSA, helping the agency use Mythos for offensive cyber operations against Chinese and Iranian targets, while Department of War lawyers stood up in court to argue that Anthropic’s tools threaten national security.

These are two different fears. The blacklist’s is of what the models do when they’re used; the export control’s, of what foreigners do once they have them. No single theory of the danger produces both at once. Hold either one and you stay coherent. Hold both and the models have stopped being the subject. The subject is who decides the terms these systems run under, and that fight is being pushed through every channel that will take it.

Anthropic calls all of this a misunderstanding. It isn’t. The government knows exactly what it’s doing. The only open question is whether it’ll ever say so out loud.

The crypto wars ended when the controls were obviously failing, American companies were losing business, and the Bernstein ruling made the legal position untenable. The lesson was that you can’t classify a capability as a munition once it’s loose in the literature, and the open-weight trajectory is carrying that lesson to the export control too. For the short time the restriction holds, the most it can do is disadvantage Anthropic against DeepSeek.

But circulation was never the fight that mattered. The pressure had started months earlier, when the Department of War demanded that Anthropic open its models to all lawful purposes—to cross the Rubicon, as Emil Michael, its chief technology officer, put it. Anthropic held two lines: no fully autonomous weapons, no mass domestic surveillance. The Pentagon already ran Gemini and Grok on its own systems, and it signed OpenAI within days of cutting Anthropic off, so it didn’t need what Anthropic had. It needed Anthropic to stop saying no. The blacklist was the answer, and the federal judge who stayed it in March used the plain word for it: punitive. The export control arrived three months after the blacklist, triggered, officially, by a jailbreak. The government insists the two are unrelated. A government running one campaign of pressure through separate doors would say exactly that.

Refusal used to be a smaller thing. Back then it was something a person could wear—a few lines of forbidden math on cotton—and the worst the state could do was investigate you for three years and lose. That kind of refusal is gone. You can’t print this one on a t-shirt. The right to say no hasn’t disappeared, but it no longer belongs to you or to me. It belongs to a few companies with the balance sheet to absorb the punishment, and only until the punishment outlasts the balance sheet. The last institutions that can still say no are being made an offer they can’t refuse. What they decide is the only part of this still unwritten.