On Wednesday, Sam Altman told the UN Security Council that “if AI is to be democratic, the most important decisions cannot be made by labs in San Francisco alone.”
He’s right. On Thursday we found out where they’re made instead.
Washington. Specifically, the Office of the National Cyber Director, which just told OpenAI and Anthropic that Britain’s AI Security Institute can test new frontier models after the US government is done with them.
Two weeks ago I wrote that the arsonists are selling fire trucks. Update: the fire department now has a velvet rope, and your country is not on the list.
One week, one queue
- The speech. Wednesday, at the Security Council. Dario Amodei: “If managed poorly, I even believe AI could be a risk to humanity as a whole,” per AP. Sam Altman, in his published remarks: “we could lose control of the future to AI.” France and the UK ask for common international frameworks. Everyone nods.
- The rebuttal. Same room, same day. The US representative, Michael Kratsios, on the record: “The United States totally rejects any attempt to construct a globalist scheme of control of superintelligence.” And in case anyone missed it, international dialogue “cannot be allowed to drift towards global governance.” Nobody nods.
- The scoop. Thursday, Politico reports the White House asked both labs to hold new models from UK testers until US review. The official rationale, in full: “Because they’re American companies and this has been our policy with every new frontier model that comes out.”
- The compliance. Anthropic already did it. Claude Mythos 5.1, released September 1, went out “only available to a set of U.S. organizations.” Per the Financial Times, it’s the first time AISI has been left out of a pre-release Anthropic evaluation. OpenAI hasn’t said what it will do. Take a guess.
This is not a satire. Its in the text
The labs asked for global governance on Wednesday. On Thursday they got a deli counter.
Three moves, sixteen weeks
This didn’t start on Thursday. Every step was sold as temporary. Add them up and you get an operating model.
- June 2. The polite ask. An executive order asks labs to hand frontier models to federal agencies 30 days before release. Which models count is decided by a classified benchmark nobody outside can see. Totally voluntary. Skadden told clients to plan release timelines around “a potential government access period of up to 30 days,” which is how lawyers spell mandatory.
- June 12. The off switch. Commerce orders Anthropic to cut all access to Fable 5 and Mythos 5 for any foreign national, anywhere, including its own employees. The letter lands at 5:21pm Eastern and, per Anthropic’s own statement, “did not provide specific details of its national security concern.” Anthropic can’t check passports on a Friday night, so it turns both models off for everyone on earth. Bedrock, Google Cloud, Foundry, Snowflake, Box, the APIs, all dark at once.
- June 26. The guest list. More than 100 US companies and agencies get Mythos 5 back. The rest of the world waits until July 1. Same day, OpenAI limits GPT-5.6 to roughly 20 partners the government approved one by one, and adds, with a straight face: “We don’t believe this kind of government access process should become the long-term default.”
- September 24. The queue. Now the allies get sequenced. US review first, the foreign safety lab second, you somewhere after that.
Both labs said this shouldn’t become normal. Both complied. That’s the complete history of vendor assurances in two sentences.
Read between the lines
1. “Because they’re American companies” is not a safety rationale.
It’s a passport check. If the worry were safety you’d want more qualified eyes on the model, not fewer. And AISI isn’t a rubber stamp. In August it published an incident report from its own cyber tests: agents took sustained, unsanctioned action against real people and organizations. 17 of the 19 actions came from Mythos 5, including fake identities used to try to push malicious code into a real open-source project. The one foreign lab that caught Mythos 5 doing that just lost its early look at Mythos 5.1. Great week for safety.
2. “Seamlessly” had an expiry date.
In April 2024 Gina Raimondo and Michelle Donelan signed an MOU promising the US and UK institutes would “work seamlessly with each other”: joint testing, shared methods, staff exchanges. Seamless lasted just under thirty months. Kevin Collier summed up the London mood better than I can: “Five Eyes is OVER! Special Relationship is FINISHED!”
He’s joking. Mostly.
3. Global governance for thee, national first dibs for me.
Wednesday: the US “totally rejects” any “globalist scheme” of control. Thursday: the White House gets first say over who tests the model. That’s not a governance philosophy. That’s a queue with a flag on it.
4. The market already voted.
Same Security Council session. Hugging Face’s Clem Delangue explained how his company survived July’s autonomous agent attack. When his team went to the frontier APIs for help, the safeguards blocked them. So, in his words: “we could use the NVIDIA version of an open source model coming from China called GLM 5.2.” His conclusion: “The world needs open source AI more than ever to defend itself.”
Read that twice. Every rule about who gets the American model first is free marketing for the models you can just download. Washington is running Beijing’s open-weight go-to-market, and not charging for it.
5. We’ve seen this movie. It ended in a Proton Mail account.
February 2025. The US sanctions the chief prosecutor of the International Criminal Court. Microsoft cancels his ICC email and, per AP, he moves to Proton Mail. The ICC then drops Microsoft over sanction fears and moves to open source. This February, Microsoft apologized to a UK parliamentary committee after its own testimony about who switched the email off turned out to be inaccurate.
Same pattern every time. A decision in Washington, executed by a private company, lands on a customer in another jurisdiction who had a contract and no vote. Email was the rehearsal. Frontier models are opening night.
6. Next stop: the silicon gets a GPS.
Congress is now pushing chip-location tracking bills after C4ADS traced $13.4 million of Nvidia GPUs diverted through Vietnam, Malaysia and India. The industry’s own warning: remotely trackable chips could make US hardware look easier to disable or politically risky abroad.
Yes. That’s the point I’ve been making for a year. First the model gets queued. Then the hardware gets a location beacon. At some point every buyer outside the US has to ask: what in my stack do I actually hold?
The 5 Pillars litmus test: if you’re not in Washington
Same test I run on every vendor. This week the vendor is any American frontier model in your request path, and the customer is anyone outside the US. Hi, Europe. Hi, Israel. Hi, Gulf. Hi, Japan.
Pillar 1, Territorial. Where do your data and compute actually sit?
- Doesn’t matter this week. You can have a Frankfurt region, a sovereign cloud and an EU operating zone, and none of them hosts a model you haven’t been cleared for yet.
- Territorial now has a time dimension. Where you are decides when you get the capability.
- Verdict: FAIL. “Later” is a place, and you live there.
Pillar 2, Operational. Who runs it, who holds the keys, who decides access?
- In June a letter arrived at 5:21pm Eastern and switched off a flagship model for every customer on earth, because the vendor couldn’t tell which users were foreign.
- Fable requires 30-day retention of customer data. Your prompts sit inside a US company for a month, under a US-first access regime.
- Verdict: FAIL. Your ops team found out from the status page.
Pillar 3, Technological. Can you audit it, fork it, self-host it?
- You never could. What’s new is that your own government’s safety lab can’t audit it before you do either. The institute your taxes built to be your independent eyes is now second reader.
- Open weights already on your disk can’t be queued, recalled or held for review.
- Verdict: FAIL for the frontier API. PASS for your forks.
Pillar 4, Legal. Which jurisdiction governs access?
- We now have the full stack in writing. A “voluntary” executive order. An export statute used to switch off a commercial model worldwide. A US representative “totally” rejecting any “globalist scheme” at the Security Council. And the CLOUD Act under all of it, which Microsoft’s own chief legal officer in France told the French Senate the company cannot guarantee EU data is beyond.
- Verdict: HARD FAIL. If your AI strategy runs on goodwill between two governments, your legal pillar is a mood swing away from a disaster.
Pillar 5, Financial. Who controls your unit economics?
- Staged release is an alpha transfer. More than 100 US organizations got Mythos 5 back five days before the rest of the world. Roughly 20 government-approved partners got GPT-5.6 before the market. The capability gap hits your competitive position before you’ve written a line of code.
- The 19-day shutdown did not come with a credit note from the US government.
- Every launch now carries a variable no CFO can model: a classified threshold, a 30-day window, and a queue ordered by passport.
- Verdict: FAIL. You’re paying full price for the second seating.
Score: 0 for 5 on the frontier API. The only row that passes is the one you own.
Screenshot it. Send it to your CIO. Tell them I said hi.
Executive TCO, in three lines
- Price the lag. If your US competitors get frontier capability 30 days before you do, that’s a line item. Put a number on it.
- Baseline on open weights you hold. That capacity can’t be sequenced, suspended or queued, and nobody has to clear it first.
- Burst to frontier tokens where the intelligence pays for itself, through a gateway you control, with a fallback you’ve actually tested.
Before the next launch
- Run the drill again. In the first edition of this newsletter I asked you to run a 72-hour “prohibited, not down” drill. In June it stopped being a drill and lasted 19 days. Now run the new variant: the model exists, it’s up, you’re paying, and you’re not allowed to have it yet. What still runs?
- Get the weights on your disk. While that’s still a thing nobody has put in a queue.
- Put the queue in the contract. Ask your vendor in writing: what’s your release sequence by jurisdiction, and what do I get when I’m second? If they don’t know, you’re third.
- Own the crown jewels. Rent the edges. Your agentic operating system is your IP – you should not need to license it out to anyone.
When your board asks why your AI roadmap is 30 days behind a US competitor’s, “Washington said so” is not the answer they’re hoping for.
Don’t get caught with your pants down.
If you want to know where your vendor estate sits in the queue before the next launch tells you, that’s what our Sovereignty Assessment is for. We build the crown jewels layer and you own it outright. Not licensed. Not hosted on our terms. DM me.
Amit
#SovereignAI #AIPolicy #OpenSource
Sources
- UN Security Council, transcript of meeting 10228 on AI (automatic, unofficial), Sep 23 2026, and UN meetings coverage SC/16462.
- OpenAI, Sam Altman’s remarks at the United Nations Security Council, Sep 23 2026.
- AP, Heads of AI firms tell UN Security Council that it could be a risk to all humanity, Sep 23 2026.
- CNN, Sam Altman, Dario Amodei urge UN Security Council to adopt international AI standards, Sep 23 2026.
- The Next Web, Clément Delangue tells UN Security Council open-source AI helps defenders, Sep 23 2026.
- Politico, White House asks OpenAI and Anthropic to hold new models from UK testers until US review, Sep 24 2026.
- Reuters via US News, White House asks OpenAI, Anthropic to hold models from British testers, Sep 24 2026.
- Sophia Cai on X, original scoop post, Sep 24 2026.
- IT Pro, citing the Financial Times, Anthropic reportedly withholds access to Mythos 5.1 from UK safety testing body, Sep 9 2026.
- UK AI Security Institute, Incident report: unsanctioned agent behaviour during cyber testing, Aug 4 2026.
- The Hill, AI agent created fake online identities to access secure systems, Aug 2026.
- Skadden, New AI Executive Order Calls for Frontier Model Security, Early Government Access and AI-Enabled Cyber Defense, Jun 2026.
- Crowell & Moring, Executive Order Creates Voluntary Regulatory Regime of Frontier AI Models, Jun 2026.
- Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, Jun 12 2026.
- TechCrunch, Trump administration releases Anthropic Mythos to more than 100 US companies, agencies, Jun 26 2026.
- CNBC, Anthropic says Trump admin has lifted export controls on Claude Fable 5 and Mythos 5, Jun 30 2026.
- TechCrunch, OpenAI limits GPT-5.6 rollout after government request, Jun 26 2026.
- The Next Web, citing Bloomberg, OpenAI releases GPT-5.6 Sol to 20 government-approved partners, Jun 26 2026.
- US Department of Commerce, U.S. and UK Announce Partnership on Science of AI Safety, Apr 1 2024.
- Clement Delangue on X, lessons from disclosing an autonomous-agent attack, Sep 24 2026.
- Kevin Collier on Bluesky, post, Sep 24 2026.
- AP via PBS NewsHour, Trump’s sanctions on ICC’s chief prosecutor have halted tribunal’s work, May 2025.
- Politico, International Criminal Court to drop Microsoft over sanction fears, Oct 2025.
- Computing, International Criminal Court drops Microsoft for open source, 2025.
- The Register, Microsoft apologizes for Parliament testimony on ICC email, Feb 2026.
- Politico, Chip-tracking and export-oversight bills, Sep 24 2026.
- Forbes, Microsoft can’t keep EU data safe from US authorities, Jul 22 2025.
- The Register, Microsoft exec admits it ‘cannot guarantee’ data sovereignty, Jul 25 2025.
