What happened
On June 12, 2026, the US Commerce Department's Bureau of Industry and Security (BIS) issued a binding export control directive under the Export Administration Regulations (EAR) requiring Anthropic to suspend access to its Claude Fable 5 and Claude Mythos 5 models for 'any foreign national, whether inside or outside the United States.' Anthropic received the directive at 5:21 PM ET and disabled both models globally for all customers to ensure compliance. The directive cited a jailbreak that could expose Mythos 5's cybersecurity capabilities. Anthropic disputed the severity. On June 18, a bipartisan group of House members (Liccardo, Obernolte, Lieu, Franklin) sent a formal letter demanding Commerce explain the legal basis and analytical methodology, with a June 26 deadline. On June 23, legal-tech startup Legion LegalTech Corp filed suit in DC federal court seeking to vacate the directive. As of June 24–25, the directive remained in force; Anthropic added ID verification requirements for users. Separate reporting confirmed Alibaba had conducted a large-scale 'distillation' attack on Claude between April 22 and June 5 — a development that informed the government's national-security posture.
Why it matters
This is the first known use of EAR export control authority to restrict the mere *use* (not transfer) of a commercial AI model by foreign nationals — including within the US. It establishes a precedent that any frontier AI lab offering models to foreign nationals may face similar directives with no prior notice. The directive forced global service interruption for all of Anthropic's customers, not just foreign nationals, creating immediate operational and contractual risk. Bloomberg noted Commerce Secretary Lutnick 'expanded the boundaries of laws governing transfers of sensitive technology to target the mere usage of cutting-edge AI models.' It also signals that governments can invoke national-security grounds to compel AI labs to gate model access by nationality, with immediate legal effect.
Action needed
AI labs and API-dependent businesses must: (1) assess whether their models could be deemed to have dangerous capabilities warranting a similar directive; (2) implement nationality-verification and access-gating mechanisms now, before any directive arrives; (3) monitor the Legion v. US litigation and the June 26 Congressional deadline for Commerce's response, which may clarify the legal boundaries of EAR applied to AI usage.