They Said the Quiet Part in June
The Battle Between Anthropic and the Administration Takes a New Turn as Fable is Taken offline — For Now.
The order reached Anthropic at 5:21 p.m. Eastern on Friday, June 12. By that evening the company had disabled its two most capable AI models, Fable 5 and Mythos 5, released three days earlier, for every customer on earth.
Commerce Secretary Howard Lutnick had signed an export-control order designating both AI models as barred from foreign-national access. Under the Export Administration Regulations, letting a foreign national use a controlled product counts as a “deemed export,” the same legal category as shipping it abroad. Anthropic cannot tell, in real time, which of its users are foreign nationals and which are US citizens. So the only way to comply was to shut the models off for everyone. A federal letter went out at 5:21 p.m.; a worldwide product went dark the same night.
If this looks like a sudden escalation, it isn’t. It is the second use of a lever I wrote about in February — and the first time the lever’s real purpose became impossible to misread.
What February was
Back in February, the Pentagon designated Anthropic a “supply chain risk” — a label normally reserved for companies like Huawei and ZTE, firms treated as hostile to national security. The trigger was not a technical failure or a security breach. It was defiance: Anthropic had refused a Pentagon demand to remove safety guardrails from its models. Hours after the blacklist, the government used Claude inside the Maven Smart System to help identify targets in the Iran strikes — and signed OpenAI to a deal nearly identical to the one Anthropic had just been punished for hesitating over. I laid out the sequence in “The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran.”
The safety objection was never the point. The punishment was for saying no in public.
The same month produced the other half of the mechanism. The Defense Production Act — a 1950 statute written to make factories build tanks and ships in wartime — was turned inside out. I called that piece “The Hammer and the Guardrail”: the power to compel production had become the power to compel recklessness.
In February, all of this read like a fight about one company’s safety politics. You could squint and call it a contract dispute with an unusually stubborn vendor.
June removed the squint.
What June confirmed
The Friday order rests on the same foundation as February — designate, assert a threat, enforce — but the trigger this time complicates the picture before it confirms it.
The government’s action followed a private warning. According to the Wall Street Journal, confirmed by The Information and Reuters, Amazon CEO Andy Jassy told Treasury Secretary Scott Bessent and other officials that Amazon’s own security researchers had found Fable 5 could be prompted — by feeding it a codebase and asking it to hunt for flaws — into producing information useful for cyberattacks. Within a day, the White House convened, had researchers test the claim, and Lutnick’s letter went out.
Amazon is not a rival. It is Anthropic’s largest investor, hosts Anthropic’s infrastructure, and is owed a $100 billion cloud commitment. The company that bankrolls Anthropic is the company that told the government Anthropic’s flagship was dangerous — and the government reached for an export-control off-switch inside twenty-four hours. Amazon also sells a competing model line, Nova.
What’s being kept secret is narrower than it first looked, and the narrowing matters. The mechanism of the jailbreak has been reported — the codebase trick, the vulnerability-hunting. What remains classified is the government’s formal assessment and the letter itself.
So the order doesn’t rest on evidence no one can see; it rests on a demonstrated weakness anyone can describe, wrapped in a determination no one can examine. Anthropic’s answer was that the weakness isn’t its own: rival models, GPT-5.5 among them, surface the same behavior without any bypass at all, and within a day developers had restored Fable 5’s behavior on another model using leaked system prompts and roughly one line of code. If the containment came undone that fast, the containment was never the point.
Hold the structure up to February’s and the family resemblance survives the new facts. A bare national-security assertion. A formal finding the public never sees. And underneath it, a government that — per the Journal — had “long felt that Anthropic couldn’t be trusted to manage the security risks its new model presented,” that tried to stop Fable 5 from shipping at all and failed, and that issued its order three days after the launch it couldn’t prevent. The guardrail-removal demand in February and the suspension in June are two uses of one tool: a national-security designation, aimed at the firm that has fallen out of favor, with the proof held back. What changed in June is that the tip came from inside the cap table.
The part worth keeping you up at night
Wendy, who writes at wendy664.substack.com, put the through-line plainly: the precedent isn’t really about AI. The claim that pulled Fable and Mythos offline could pull any platform offline — a social network, a search engine, a news app. The mechanism doesn’t care what it’s aimed at.
That’s the part the record now confirms, even as it complicates the rest of her read. The trigger wasn’t a faceless rival; it was Anthropic’s own investor — and the precedent is worse for it. An off-switch a competitor can throw is dangerous. An off-switch your own largest investor can throw is a different category of exposure, and it is available against any company whose backers have a phone number at Treasury.
Two worlds, one diagnosis
What makes Friday hard to wave off is that two people who share almost no priors read it the same way. Wendy comes at it from the accountability side. Nate B. Jones comes at it from the builder’s — he writes for the people who use these tools, and posted his analysis, “The End of Unrestricted AI: Why Claude Fable 5 Was Just Forced Offline”, filmed urgently from a plane by a man who likes the product and expects it back soon.
Jones doesn’t dismiss the safety worry; he grants that a jailbreak against one frontier model is plausibly directionally right as evidence about the whole class. That concession makes his bottom line land harder. He reads the foreign-national “deemed export” language as a shutdown button in export-control wrapping, and then, having granted the concern, refuses the process: “That’s not safety governance. That’s simply the exercise of discretionary power.”
What Jones wants instead is a transparent statutory path, a clear technical standard, and a way for the company to answer the evidence — because otherwise, he warns, any frontier model can be frozen “on the basis of a claim the public cannot see, from a process no one can audit.”
His demand next to Wendy’s warning is the same sentence said twice: neither rests the case on the model being unsafe, both argue the process is the danger, both name the same fix. And they are not only agreeing about AI. Each has seen this lever aimed somewhere else first.
This is not, finally, an AI story. It is one move, and the move has grammar — five parts that repeat, agency to agency, whatever the subject. Once you can read the grammar you can recognize the next instance on sight, in a room you’ve never looked at, before the cover story arrives. It runs like this: the power is designated by discretion, so no statute fences it. A wrong is asserted that no one outside the room can see. The wrong is enforced selectively, against some and not others. The punishment is delivered through the process itself — the investigation, the indictment, the credential pulled, the switch thrown — so the harm lands whether or not anything is ever proven. And under every pretext, the real offense is defiance. Discretionary designation, unseeable predicate, selective enforcement, punishment-as-process, defiance as the true offense. That is the shape, and I’ve traced it across domains.
Watch it hold across four rooms that share nothing else. When the false-statements case against James Comey fell apart, the Justice Department re-indicted him in April 2026 over a year-old deleted Instagram photo of seashells spelling out 86/47— the defendant was fixed; the charge was swapped. Bill Pulte’s FHFA aimed identical mortgage-fraud referrals at Lisa Cook, Letitia James, Adam Schiff, and Eric Swalwell — all Democrats Trump had publicly threatened with retribution before each referral — after Fannie Mae’s own fraud staff doubted the evidence; a Senate letter naming all four called them “political enemies of President Donald Trump,” and James’s court filing, brought by Abbe Lowell, argued Pulte had turned the agency into a “political weapon” aimed at “Trump’s enemies,” while the Government Accounting Office, the GAO, reviews Pulte’s referrals and Cook’s firing sits before the Supreme Court in Trump v. Cook, argued January 21, 2026. A federal judge, Paul Friedman, found the Pentagon’s press policy built to weed out “disfavored journalists” and keep the ones “on board and willing to serve.” And the White House stood up a Media Bias Portal at whitehouse.gov/mediabias — with a tip line at whitehouse.gov/biastips soliciting public reports against named journalists — anchored by an “Offender Hall of Shame” and a leaderboard the site itself calls a “race to the bottom,” with the coverage tagged “lie” and “left-wing lunacy.” Prosecution, finance, press credential, a denunciation portal — one grammar, four dialects.
Fable isn’t the worst of these. It’s the clearest. Every other case leaves you arguing about the conduct: maybe Comey did lie, maybe the mortgages were irregular, maybe the reporters really were a problem. Fable is the one instance with a control condition. OpenAI was rewarded on the exact terms that condemned Anthropic — the same Pentagon, the same guardrail question, the same week — with everything else held constant. That isolates the two steps that matter: the enforcement was selective, and the offense was defiance. The informant was the only variable. The target was the constant. The OpenAI contrast is what proves the target was chosen, not the conduct.
So the close holds, just wider. A national-security assertion, backed by a classified finding and a tip from whatever quarter supplies one, can take a major platform off the internet overnight: and the machinery that does it has an off-switch that keeps getting thrown at the people who criticize the people holding it. The one demand that would make any of this legitimate — transparency, a process you can audit, evidence a company can answer — is the exact thing a discretionary off-switch is built to avoid. The off-switch was always the point. It just took until June for two people from opposite worlds to look at it and say, in one voice, that the only answer is to make it something the public can see.
The RAMM documents the connections that beat reporting can’t see:
4,776+ sourced events at capturecascade.org.
1,988 Counties with signals of potential detention center expansion (Federal contracts, 287(g), real estate traces, etc) at detention-pipeline.transparencycascade.org my site that tracks signals of potential cooperation with ICE and Border Patrol.
129 Community fights over detention capacity built out tracked.
All of this is self-funded, and paid subscriptions are the the way the stories stay free for everyone.
Sources: primary reporting is the Wall Street Journal (Jassy–Bessent contact; that Bessent “long felt Anthropic couldn’t be trusted”), with Axios reconstructing the Thursday-night sequence and the failed attempt to block Fable 5’s release and the 90-minute takedown window, and The Information and Reuters corroborating. Confirming secondary coverage includes NBC News, Quartz, Benzinga, and The Next Web. Named-person anchors in the close are wire-sourced: Comey re-indictment (NBC News, Apr 28 2026); Pulte/Cook referrals (Senate Banking GAO-referral letter Nov 17 2025 naming all four; CNN Business GAO probe Dec 4 2025; CNBC Trump v. Cook Jan 21 2026 argument). GAO clause carries the CNN Business inline link.