Anthropic Ban Rekindles Cyber Export Debate: History Shows Controls

The White House last Friday ordered AI giant Anthropic to immediately restrict the export of its powerful AI models, Fable and Mythos, citing unspecified national security concerns. This directive led Anthropic to hastily pull both models from availability, marking the first significant test of whether the U.S. government can effectively use export controls to contain frontier AI technology.

This move echoes past governmental attempts to control the proliferation of encryption software and spyware. However, history suggests that such efforts have largely proven ineffective, raising questions about the long-term viability of controlling advanced AI through similar means.

The Mythos Controversy and the Ban's Triggers

Since its launch in April, Anthropic marketed Mythos as a formidable cybersecurity tool, designed to help defenders secure software against sophisticated threats. Access was initially limited to about 150 vetted companies and government organizations, highlighting the company's own concerns about its potential impact if widely distributed.

The recent ban was reportedly triggered by two events. First, U.S. officials became alarmed after Anthropic granted a South Korean telecom — identified by some reports as SK Telecom, which denies any China connection — access to Mythos through its partner program, due to suspicions of ties to China. Second, Amazon CEO Andy Jassy reportedly alerted the administration after Amazon researchers claimed to have found a way to bypass Fable 5’s safeguards, though Anthropic disputes this as a minor, patched issue rather than a full “jailbreak.”

Within approximately 90 minutes of notification, the Commerce Department issued an export control directive, forcing Anthropic to quickly limit access to its models.

Lessons from the Crypto Wars

For decades, governments have tried to impose export controls on sensitive cyber technologies, often with limited success. A prime example is the “Crypto Wars” of the early to mid-1990s, when the U.S. government viewed strong encryption as a threat to national security.

At the time, computer scientists developed encryption tools like Pretty Good Privacy (PGP) to secure internet data. Fearing PGP would hinder intelligence agencies, the U.S. Customs Service launched a criminal investigation against PGP creator Phil Zimmermann for allegedly violating arms export controls. Zimmermann famously fought back by publishing PGP's source code as a printed book, effectively making it freely available and demonstrating the difficulty of controlling information in an open society. The investigation was eventually closed, paving the way for the widespread adoption of end-to-end encryption used by billions today.

Spyware's Unchecked Spread

A more recent example involves export controls on surveillance and hacking software. In the early 2010s, following discoveries of Western-made spyware used against dissidents, several governments expanded the Wassenaar Arrangement. This international treaty aimed to classify surveillance and hacking software as dual-use technologies, requiring export licenses for their sale abroad.

However, the Wassenaar Arrangement has faced significant challenges. Many countries, including Israel, home to prominent spyware makers, do not adhere to the agreement. Furthermore, its effectiveness relies on member states' discretion in applying controls to companies within their borders. For instance, the Italian government permitted Hacking Team, a major spyware provider, to export its tools globally despite its track record of selling to oppressive regimes that targeted journalists and human rights activists.

Other European countries have similarly been lax, leading to a continued flow of spyware to authoritarian states. Some sanctioned spyware consortiums, like Intellexa, have simply relocated their operations to countries with more lenient export controls, highlighting a critical loophole. While there have been minor victories, such as the 2022 shutdown of German spyware maker FinFisher after an investigation into its illegal exports to Turkey, these instances remain exceptions rather than the norm in a largely unregulated global market.

The Unclear Path Forward for AI

The current impasse between Anthropic and the Trump administration presents a pivotal moment for AI policy. The administration may eventually lift restrictions to ensure American AI companies remain competitive globally, tacitly acknowledging that other nations, including China, are likely to develop similar AI capabilities regardless of U.S. restrictions. Alternatively, American AI companies could face extensive government approval processes for foreign clients, significantly impacting their business and innovation.

Considering the historical failures to control encryption and spyware, government-mandated export controls appear to be an unlikely solution for preventing malicious actors from misusing powerful, dual-use cyber technologies like advanced AI models. The inherent nature of software, its global accessibility, and the rapid pace of technological development make traditional export control mechanisms largely unsuitable for the digital age.

FAQ

Q: What are Anthropic's Fable and Mythos models?

A: Fable and Mythos are powerful artificial intelligence models developed by Anthropic. Mythos, in particular, has been marketed as a significant cybersecurity tool designed to help protect software and services, with Anthropic initially limiting its access to a select group of vetted organizations due to its advanced capabilities.

Q: Why did the U.S. government impose export controls on these models?

A: The White House cited national security concerns, reportedly triggered by Anthropic providing Mythos access to a South Korean telecom suspected of having ties to China, and an alert from Amazon's CEO regarding a potential bypass of Fable 5's safeguards. These events prompted the Commerce Department to issue an immediate export control directive.

Q: What are some historical precedents for cyber export controls and their effectiveness?

A: Historically, the U.S. government attempted to control the export of strong encryption software like PGP in the 1990s, an effort that largely failed and led to the widespread adoption of encryption. More recently, the Wassenaar Arrangement aimed to control the export of dual-use spyware, but its effectiveness has been hampered by non-adherence from certain countries and a lack of consistent enforcement by member states.