Chip embargo "enthusiast" faces model ban

Author: Su Yang, Tencent Technology

From EUV lithography machines to advanced DUV lithography machines, and then to H100 chips, Silicon Valley is divided into two camps on semiconductor export bans.

Huang Renxun and Su Zifeng have been advocating for easing controls, believing that excessive regulation amounts to handing the market over to others, while Anthropic CEO Amodei is a "fanatic" of regulation, once comparing advanced chips to nuclear weapons.

Huang Renxun has repeatedly subtly mocked Amodei, suggesting he has a "God complex." "Comparing AI to nuclear weapons and uranium enrichment is madness. We’re not refining uranium; we’re just making a small chip," Huang said on the podcast "Dwarkesh Patel."

The "fanatic" Amodei probably never expected that the strict regulation he emphasized would someday be applied to Anthropic—specifically, the two frontier models Mythos and Fable 5 being banned from providing services to any "foreign nationals" worldwide by the U.S. government.

Yang Likun comments on Facebook about the ban on Fable 5

"Amodei’s absurd fear-mongering about Mythos/Fable (and the entire AI field) has finally paid off: the U.S. government has banned non-Americans from using them, including foreign employees working within the U.S. It’s karma—what you sow is what you reap," wrote Turing Award winner Yang Likun on Facebook.

The phrase "what you sow is what you reap" in the Chinese context can be seen as "reaping what you sow." Later, in the comments, Yang also sarcastically suggested that Amodei might use the regulation to boast about how powerful his models are.

From some U.S. policy signals, the ban on Mythos and Fable models likely won’t last long. White House AI advisor David Sacks, dubbed the "AI czar," said this is only a temporary restriction, hoping Anthropic will quickly patch security vulnerabilities.

Therefore, at this point, we want to clarify the background, core controversies, existing issues, the potential for long-term export controls, and the possible impact on Anthropic and the entire AI industry.

"72 Hours of Crisis"

Many American movies like to use "hours" in their titles to emphasize rapid, intense changes within a short time frame. Anthropic’s new models, from launch to delisting, such as Fable 5, lasted only 72 hours—fitting neatly into this narrative.

On June 9, Anthropic launched its most powerful model since inception, Claude Fable 5 and Claude Mythos 5, marking Anthropic’s first "Mythos-class" model. Fable 5 is the public version, equipped with a safety classifier: queries in highly sensitive fields like cybersecurity, biology, and chemistry are automatically routed to a weaker capability model, Opus 4.8. Mythos 5 is based on the same underlying model but with safety restrictions lifted, accessible only through Project Glasswing to about 150 vetted organizations.

By this time, two months had passed since Mythos’s first preview.

Anthropic’s official blog stated, "The Fable 5 series has the strictest safety protections among all tested models."

Pliny the Liberator discloses jailbreak risks for Fable 5

Just one day later, famous AI jailbreaker Pliny the Liberator posted in all caps: "JAILBREAK ALERT, ANTHROPIC PWNED, FABLE-5 LIBERATED." He claimed to have bypassed Fable 5’s safety classifier using Unicode replacements, homoglyphs, long context dilution, and decomposition-reassembly techniques.

At that moment, Amodei was probably still basking in the joy of Fable 5’s "instant kill" capabilities, unaware of the risks Pliny had warned about. He published a lengthy article titled "Policy Responses to Exponential Growth in AI" on his personal blog, advocating that governments should have the authority to block unsafe AI models.

Like Pliny, Amazon researcher also identified jailbreak risks but handled it differently.

Amazon CEO Andy Jassy directly bypassed Anthropic—an Amazon-backed company—and sent a "jailbreak" report to the White House and U.S. Commerce Department.

Multiple foreign media outlets disclosed that, the day after Amazon’s "report" (June 12), Anthropic received a final warning from the U.S. government, instructing it to shut down access to two models within 90 minutes. Amodei tried to salvage the situation via a phone call but ultimately received an "export control" order.

On the evening of June 12, Anthropic complied. Interestingly, Amodei and his team responded by "doubling down," cutting off internet access for Fable 5 and Mythos 5 worldwide—regardless of whether users were American or not.

From the release on June 9 to the emergency shutdown on June 12, this was the "72 hours of crisis" for Anthropic.

When I shared this news on social media, I quoted a classic line from Hong Kong cinema: "Impossible to handle, then just don’t do it."

This raises a point worth exploring—if the U.S. government only demanded disconnecting "non-U.S. users," why did Anthropic choose to cut off all access across the board? After all, Anthropic has never been a "obedient good boy." In Q1, Amodei even published a "Constitutional AI" service agreement, attempting to defend the principle that "AI should not be used for military or surveillance purposes," even at the cost of abandoning U.S. government contracts.

Regarding the "all-or-nothing" approach, some analysts believe Anthropic lacked the response time to filter users immediately, especially since many access models via API, including some intermediary APIs, making engineering difficult.

This explanation has some validity, but if you look at their official policy page, you’ll find that Anthropic has been preparing in this area. Their latest privacy policy hints at requiring users to submit age and identity information, which many interpret as a potential future addition of face recognition to Claude models. From this perspective, identifying whether a user is "American" or "non-American" is not a difficult task.

Irresistible Belief

"Many people analyzing the legal basis are actually relying on the 'Informed Letter' mechanism," said a researcher who has long tracked export control policies.

In the U.S. export control system, an Informed Letter is a common, non-public, rapid enforcement tool used by the Bureau of Industry and Security (BIS) of the Department of Commerce. It allows regulators to notify target companies about specific items or technologies that require export licenses without legislative amendments to the Export Administration Regulations (EAR).

At the end of 2023, Nvidia launched a special H20 product for the Chinese market to circumvent restrictions on GPU compute power and bandwidth in the EAR. Subsequently, BIS issued Informed Letters to Nvidia, AMD, and others, requiring additional licenses for exporting certain chips, and in the process, updating the EAR.

Back to Anthropic: before receiving the notice to restrict "non-U.S. users," the U.S. government explicitly ordered a "90-minute delisting." Multiple foreign media outlets, including Politico, reported that the two sides had multiple rounds of negotiations involving officials from the Treasury, Commerce, and the White House AI policy team. However, Anthropic refused this order.

Initially refusing to delist, then abruptly cutting off all access, is hard to explain as merely "technical impossibility."

Informed Letters are usually a prelude to formal export controls, but some analysts believe this time the regulations will not be updated. "Basically, they’re just stopping Anthropic first," they say.

They argue that in the context of large models, it’s unclear what exactly should be controlled—model weights, API access, inference services, or some abstract "model capability."

Historically, export controls focused more on physical goods, even technology—ultimately tangible commodities. But once model weights are generated and digital, they can spread in cyberspace, making absolute "embargoes" physically impossible.

Thus, "stopping Anthropic first" is a reasonable speculation. After that, discussing better governance and alignment makes sense, based on this assumption. It also explains why Mythos and Fable might soon return, which is why David Sacks, the "AI czar," emphasizes that "banning" is only a temporary restriction.

Why would the U.S. government use administrative measures to intervene in the release of cutting-edge AI models?

Because of the models’ "vulnerability-breaking" capabilities.

In March, during a discussion with Zhou Hongyi, chairman of Qihoo 360, he specifically mentioned Anthropic’s ability to "discover vulnerabilities through models." "Anthropic uses AI to program and find vulnerabilities, solving many previously unsolvable security problems. So I suggested focusing on AI (security) agents."

The researcher also emphasized that Mythos involves not just general chatbot capabilities but highly specific vulnerability discovery, attack path analysis, and offensive cyber capabilities.

Uncertain Security

Anthropic not only chose to "double down" on the ban but also issued a public statement.

"To ensure compliance, we must immediately halt all user programs," Anthropic wrote, adding that this was a misunderstanding. They believe the U.S. government and third-party reports of "jailbreak" methods only involved a few known minor vulnerabilities, which appeared relatively simple.

Looking back, Amodei’s personal blog advocating that the government should have the authority to block unsafe AI deployment, and Anthropic’s claim that Fable 5 is the safest model, both reveal a high level of confidence in their product’s safety.

However, Anthropic also added a caveat: "Currently, no model provider can achieve complete jailbreak prevention." This statement contradicts the idea of absolute security and even contains some sophistry.

The gist is: "Our models are the safest, so regulators should only intervene with unsafe models; most of our vulnerabilities are known and lightweight; we’ve done our best to limit jailbreaks, but no one can guarantee to block them entirely."

But why would a supposedly "safest" model go live with known vulnerabilities? Isn’t that risking damage? If jailbreaks cannot be fully prevented, why call for suppression of other models?

Familiar users of Anthropic know that the company not only excels in model and product capabilities but also adopts a very aggressive stance on AI safety and governance—almost like a "rule-maker" in the AI era, constantly branding itself as "safe."

On September 19, 2023, Anthropic released RSP 1.0 (Responsible Scaling Policy), calling for stronger safety guarantees as model capabilities grow. Until safety is proven, no more powerful models should be released. The document mentions an AI Safety Level (ASL) grading mechanism: ASL-1 (no catastrophic risk), ASL-2 (early warning signals but no catastrophic risk), and ASL-3 (significantly increased risk of catastrophic misuse).

"If AI scaling exceeds our ability to follow necessary safety procedures, the ASL framework will require us to temporarily halt training more powerful models," Anthropic wrote.

A week before Fable 5’s launch, on June 4, Anthropic published an article titled "When AI Shapes Itself," calling for "proactive pauses" to avoid recursive AI improvements.

Soon after, the Fable 5 series models were released.

Looking at this timeline, it’s quite ironic—like a top student claiming, "I never review for exams," while secretly cramming intensely.

If there were real concerns, why release the "most powerful model" after calling for a pause? That’s one explanation. In fact, the Mythos-level model preview had already appeared two months earlier. Given its groundbreaking capabilities, why not advocate for a pause then?

Anthropic’s safety stance appears aggressive, but this safety call and action seem more aimed at constraining competitors. They advocate regulation of unsafe models, call for a pause on frontier model training, while themselves iterating and advancing.

If in 2023 they were still idealists with RSP 1.0, by 2025 with RSP 2.2, they had become realists.

The changelog for RSP 2.2 mentions a modification: "Exclude sophisticated insiders and state-compromised insiders from the ASL-3 security standard," and "Remove the ASL-2 promise to protect against distillation attacks."

I checked this change—meaning that future defenses against insider attacks and state-level threats are no longer considered strict security standards. In other words, Anthropic quietly "lowered" its security bar, no longer promising to defend against the most advanced, hardest-to-defend threats.

On February 9, 2026, Anthropic’s Chief Security Officer Mrinank Sharma resigned. In his open letter, he wrote: "The world is in danger. During my tenure, I repeatedly saw how difficult it is to truly align organizational actions with core values... We are under constant pressure to abandon what matters most."

A few days later, on February 24, Anthropic released RSP 3.0, completely rewriting its safety policies and removing all references to "pausing."

Essentially, as previously mentioned, Anthropic has never triggered a training pause. This is similar to the well-known open letter in March 2023 calling for a six-month pause on training models above GPT-4, signed by Elon Musk—who then announced the founding of xAI in November and released Grok-1 in the same year.

Thus, large model labs have no real "safety consensus." The so-called pauses are mostly business strategies.

Driven by Capital

When Fable 5 launched, its input and output pricing were $10 and $50 per million tokens, respectively—twice Opus 4.8’s price, though with a 90% cache hit discount.

Talking with an AI researcher, he commented, "It’s useful, but really expensive." This sparked various jokes, short videos, and GIFs about the rising costs of large models, reflecting a trend: as capabilities grow, even at high prices, many will still use them.

This is also why domestic models are trying to "speed up" recently—offering faster inference and higher TPS (tokens per second), along with some price increases.

Back to Anthropic: In May 2021, Amodei left OpenAI with his sister and 14 researchers to found Anthropic, raising $124 million in Series A, with a valuation of $550 million. Five years later, in 2025, their Series H funding ballooned to $6.5 billion, with a valuation of $965 billion—over 1700 times growth in five years.

More rapid than valuation expansion is revenue.

In early 2024, Anthropic’s annual revenue was less than $1 billion, but by the end of 2025, it reached about $9 billion (ARR). In Q1 2026, revenue was $4.8 billion, and according to documents obtained by The Wall Street Journal, they projected Q2 revenue to hit $10.9 billion.

Public filings show that on June 1, Anthropic secretly submitted an IPO registration to the SEC. The goal is to beat OpenAI to go public in Q4 this year, raising $60 billion. With quarterly revenue of $10 billion, the annualized revenue (ARR) could exceed $40 billion, and with a valuation of $965 billion, investors are paying a 24x ARR valuation—implying they expect exponential revenue growth.

In this context, every safety promise—like "pause training if capabilities exceed safety thresholds"—becomes a brake on revenue growth. At a 24x ARR valuation, any "pause" could cause catastrophic valuation drops.

Therefore, the removal of the "pause" requirement in RSP 3.0 isn’t coincidental; it appears to be capitulation to capital pressure—at the IPO’s critical stage, any potential "brakes" are being eliminated. This is also reflected in the IPO prospectus’s compliance considerations.

If they insisted on a rigid "pause" indicator, the prospectus would need to explicitly state: "Our company commits to pausing deployment if model capabilities trigger unknown safety red lines," which would be a risk warning implying revenues could suddenly plummet.

At a $9.65 trillion valuation and IPO pressure, Anthropic faces the dilemma that shareholder interests might override public safety.

When OpenAI restructured, the most debated topic was PBC—Public Benefit Corporation, which Anthropic also adopts. Under this governance structure, a Long-Term Benefit Trust (LTBT) can appoint 2-3 directors, but until late 2024, only one was appointed; in 2025, one more was added. As IPO approached, Novartis former CEO Vas Narasimhan joined the board, increasing LTBT’s seats to 4 out of 7.

Unexpectedly, among the LTBT-appointed directors, Jay Kreps (co-founder and CEO of Confluent), who had served less than a year, announced his resignation.

The "trust faction" and "management + investors" voting power are now tied at 3-3. Before the next LTBT appointee joins, any major disagreement could lead to a "governance vacuum."

Will the "7th person" arrive before the IPO?