On June 12, the US pulled Anthropic’s best model offline by export order. Ten days later, Tokyo’s Sakana AI shipped Fugu, a router that reassembles the same capabilities from the models that are still standing. Blocking intelligence created the market for routing around it.
At 5:21 p.m. Eastern on Friday, June 12, 2026, Anthropic received a letter from the US Department of Commerce and, by its own account, had on the order of an hour to take its two most capable models offline.
The letter was an export control directive. It ordered Anthropic to suspend all access to Claude Fable 5 and Claude Mythos 5 “by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.” Because the company cannot reliably check the nationality of everyone calling an API, the only way to comply was the blunt one. Anthropic disabled both models for every customer on earth, and they stayed dark. As of late June 2026, neither Anthropic nor the government has announced a timeline to restore access, and an approved BIS license is now required before any foreign person can touch them. This was not a chip ban. It was the first publicly confirmed time the US government reached past the hardware and the weights-in-transit and pulled the plug on a running model.
Ten days later, on June 22, a Tokyo lab named Sakana AI shipped the response. Its new product, Fugu, is not a frontier model. It is a router: a small trained model that conducts a pool of other companies’ models and stitches their…
Sandwiched between those two dates, on June 13, China’s Z.ai released GLM 5.2, an open-weight model under an MIT license priced at roughly a sixth of Fable 5. None of these three were reactions to each other in any literal sense; GLM 5.2 and Fugu were finished pipelines that happened to land in the same news cycle. But the cycle told a story the policy did not intend. Block a model, and within ten days the open-weight competitor and the orchestration workaround both look less like products and more like exits.
This piece is about that asymmetry: why a government can switch off a model in ninety minutes, why it is far harder to switch off a system that reassembles the same capability from parts it does not control, and why the last time Washington tried this exact move, with encryption in the 1990s, it lost.
What got banned, and why it was a first
Mythos 5 is the most capable model Anthropic has built, positioned above Opus in the family and never sold to the public. Access ran through a vetted-partner program called Project Glasswing, built around cybersecurity. The reason it was gated is not marketing. On a Firefox JavaScript-engine benchmark where Claude Opus 4.6 produced two working exploits, Mythos Preview produced 181, and gained register control on dozens more targets. It autonomously surfaced a 27-year-old vulnerability in OpenBSD’s TCP stack that had survived human audits, automated fuzzers, and decades of unusually careful open-source review. Over three months pointed at Firefox, Anthropic reported, the model turned up 271 previously unknown vulnerabilities at a false-positive rate under 5%. Fable 5 was the public, safety-gated sibling: the same generation with classifiers that route high-risk cyber and bio queries to the older Opus 4.8 and trip, Anthropic says, in under 5% of sessions.
The legal move was the structural novelty, not the capability. The January 2025 AI Diffusion Rule had already created an export classification (ECCN 4E091) for the weights of advanced closed models, things that sit still and can be licensed like any controlled good. The June 12 directive went a step past that, onto a live commercial API. Commerce could argue this is a natural extension of the same authority, and it is not a crazy argument. But in practice, it is the first time the controlled thing was not a chip you can put in a crate or a weights file you can copy, but a service anyone can call from anywhere, at any time, until the moment it is switched off.
The trigger is contested, and you should treat it that way
What actually set this off is disputed, and the accounts do not line up.
The administration’s version came mostly from White House AI and crypto czar David Sacks, who said on June 13 that a “highly credible trusted partner” had demonstrated a jailbreak of Fable’s guardrails amounting to “the operability of a cyber weapon,” that the government asked Anthropic to fix it or pull the model, and that CEO Dario Amodei refused. Multiple outlets identified that partner as Amazon, an Anthropic investor and compute provider, and the Wall Street Journal reported that Amazon CEO Andy Jassy told Treasury Secretary Scott Bessent and other officials that Amazon researchers had used Fable 5 to obtain information usable in cyberattacks.
Anthropic’s version is that this was a “narrow, non-universal” potential jailbreak (“read a specific codebase and fix any software flaws”), that the capability in question is “widely available from other models, including OpenAI’s GPT-5.5,” and that recalling a model “deployed to hundreds of millions of people” over it was disproportionate. Independent voices leaned toward Anthropic on the technical point. Katie Moussouris, CEO of Luta Security, was blunt: “I’ve seen the paper. It’s not a jailbreak.” A former Commerce official, Kate Koren, suggested the White House’s sour relationship with Anthropic may have colored the decision. Semafor separately reported the move was tied to suspicion that a China-linked group had accessed Mythos, a motive Anthropic says the White House never raised with it and which other outlets could not confirm.
The honest summary: the trigger is Amazon-reported and Sacks-narrated, contested by Anthropic, doubted by outside researchers, and the China angle is unverified. Hold it loosely.
What Sakana actually shipped
Fugu is not a frontier model in the usual sense, and Sakana does not pretend otherwise. What it shipped is stranger, and arguably more interesting: a multi-agent system delivered as a single model, a coordination layer dressed as one OpenAI-compatible endpoint. The complexity never reaches your code. Your app sends one request; Fugu decides, behind the wall, whether to answer directly or assemble a team. Underneath, it is a learned orchestration system built around a roughly 7-billion-parameter “conductor” (a Qwen2.5–7B base) trained with reinforcement learning to design collaboration strategies across a pool of larger worker models. Two ICLR 2026 papers sit underneath it: Trinity (arXiv 2512.04695), a sub-20K-parameter coordinator tuned by derivative-free evolution, and Conductor (arXiv 2512.04388), the RL-trained orchestrator that hands out roles. The lineage runs back to Sakana’s 2025 AB-MCTS work (arXiv 2503.04412, a NeurIPS spotlight), which showed that letting several frontier models cooperate at inference time, deciding adaptively whether to go wider or deeper, beat any single one of them.
Sakana’s own framing is the sharpest way to see it: Fugu is model merging moved up a level. The technique that made the lab’s name, evolutionary model merging, blends the weights of open models, which requires matching architectures and downloadable checkpoints. Fugu does the same job one layer higher, composing what models do rather than what they are, treating each frontier system as a black box and learning to route, verify, and synthesise their behaviour, “without requiring parameter access or architectural compatibility.” That reframing is the unlock: it is how a lab with no frontier weights of its own gets to merge OpenAI’s, Anthropic’s, and Google’s anyway, through the front door of their APIs.
The mechanism is worth one layer down, and the two tiers do it differently. Plain Fugu decides without writing a word: a lightweight selection head reads the hidden state of your prompt, scores every model in the pool, and dispatches to the top one before any text is generated, which is why it stays nearly as fast as a single call. Its predecessor, Trinity, tagged each pick with a role: Thinker, Worker, or Verifier; Fugu dropped the roles and simply takes the best worker. Fugu-Ultra goes further: it writes an agentic workflow, a sequence of steps, each carrying a plain-language subtask, a worker id naming the model to run it, and an access list controlling which earlier results that worker is allowed to see. Tune the access list, and you get a chain, a best-of-N, or a tree. The pool is swappable, GPT-5.5, Opus 4.8, Gemini 3.1 Pro, or recursive copies of Fugu itself, and when Fugu calls itself, it reads its own earlier output, judges whether it is working, and spins up a corrective pass. None of it is hand-coded with if-statements; it is learned, plain Fugu through supervised fine-tuning and then evolutionary search, Fugu-Ultra through reinforcement learning, on roughly 960 problems across two H100 GPUs. Commercially, it ships in those two tiers behind an OpenAI-compatible API, with subscriptions at $20, $100, and $200 a month and a metered free tier through Vercel’s AI Gateway, the official third-party integration, which routes to the same closed pool of GPT-5.5, Opus 4.8, and Gemini 3.1 Pro.
That difference shows up as quality. Plain Fugu, picking one model per step, can hand a coding request to GPT-5.5 to draft and to Opus 4.8 to debug a few turns later, all inside one request, yet on SWE-Bench Pro it still lands ten points below Opus alone (59.0 to 69.2): routing among models is not the same as being better than the best one. Fugu-Ultra earns its keep on harder work, and one of its smarter habits is that the model that writes the final synthesis is not pinned in advance, the way an “LLM council” fixes one judge, but chosen by domain. Its ceiling is the planning. The workflow is drawn before any agent has produced anything, so the system commits its branching at t=0 instead of adapting at t+1 from what it just learned, which is why the workflows stop at a few steps; the smartest version of this idea reacts to intermediate results, and Fugu-Ultra mostly cannot.
How does a 7B model learn any of this? In two ways, one per tier. Plain Fugu starts with supervised fine-tuning on questions whose answers are known: run every worker several times, turn each one’s average score into a soft probability with a softmax, so the target keeps “GPT best, Opus a close second, Gemini weak” instead of collapsing to “always GPT,” and train the selection head to match that distribution.
Then it is polished with an evolutionary method, sep-CMA-ES, on full multi-turn tasks where the only signal is pass-or-fail at the very end and ordinary gradient training has nothing to grab: try many small variations of the weights, keep the ones that finish more tasks, move toward them. To keep that cheap, Fugu nudges only a thin slice of its weights, using the SVD trick from Sakana’s earlier Transformer-squared work, rather than retraining the whole model. Fugu-Ultra is trained by reinforcement learning instead (GRPO, from the DeepSeekMath line): for each question, it writes a group of candidate workflows, scores each one (0 if the plan is malformed, 0.5 if it runs but the answer is wrong, 1 if it runs and is correct), and pushes up the workflows that beat the group’s average while pushing down the rest. Over many rounds, it learns to write plans that look like the ones that worked.
Turning several agents loose with tools creates two failure modes that Sakana had to engineer around, and the fix is tidy. If every agent could see everything the first one did, they would all follow its lead, and the team would collapse into a single opinion, so inside a workflow, each agent is isolated, seeing the others only through the access list the conductor set. But total isolation is wasteful: over a long task, agents would re-run the same tool calls and rediscover the same facts, so across the whole conversation they share a persistent memory of what has already been called. Independent within a step, shared across the task. That is the balance that keeps a real team both diverse and non-repetitive.
CEO David Ha put the thesis plainly: “Relying on a single company’s APIs for critical infrastructure, finance, or governance is a material vulnerability. This risk is no longer a hypothetical possibility, but a reality.” Ten days after June 12, that sentence reads less like a product slogan and more like a market read.
Is any of this worth it over just calling Opus or GPT-5.5 directly? For a single clean prompt, almost certainly not, and Sakana’s own numbers concede it, plain Fugu trails the best single model it routes among. The case for orchestration is the messy task, the kind of real work it is actually made of: read ambiguous context, split it, hand the pieces to different specialists, verify, kill the weak branch, merge the rest, and stop before the loop runs forever. That is the layer most teams already hand-build out of routers, prompts, eval scripts, and retry glue nobody wants to maintain. Fugu’s bet is to sell that layer as a model.
What makes the bet plausible is that the frontier models really do specialise. By Sakana’s reading of its own pool, GPT-5.5 is strongest at math and at planning and combining ideas, Opus 4.8 at software engineering and at finding security bugs, Gemini 3.1 Pro at implementing known algorithms and at science. A conductor who has learned those edges can do things no single member would, and Sakana did not script the moves; they surfaced in training. On coding tasks, Fugu-Ultra learned to let GPT build and then pull Opus in at the right moment to hunt bugs and security holes before handing the findings back; on a cryptanalysis task, it had Opus open the attack and GPT re-derive the math it needed. That is the instinct a good tech lead runs on, knowing exactly which teammate to call for which part of the job.
The demos carry the idea better than the scorecard does, with the same caveat: they are Sakana’s, and the rivals are anonymised as “Model A, B, and C,” the labels reshuffled between examples so you cannot decode them (the field is Gemini 3.1 Pro, Opus 4.8, and GPT-5.5). With that asterisk, a few are hard to fake. Turned loose to improve a small GPT training recipe, Fugu Ultra ran the research loop itself, edit the code, run the experiment, measure validation bits-per-byte, keep the change if it helped, repeat, 123 experiments over about 14 hours on a single H100, landing at 0.9774 bits-per-byte against the baselines’ 0.9781, 0.9793, and 0.9822.
Asked to write a Rubik’s Cube solver from scratch in pure Python, its code solved 300 of 300 held-out scrambles at an average of 19.72 moves, a hair off the proven optimum of 20, while two of the three baselines wrote code that crashed on all 300. Pointed at a 1610 manuscript and told to recover the reading order of scattered Japanese kana, it scored 0.80 against a baseline of 0.24. Playing four games of blindfold chess, no board shown, the whole position held in its head, it won all four, including one against a 2,100-Elo engine, without a blunder. Handed a 50-week trading simulation starting at $10,000, it finished at $11,943, a 19.43% gain, ahead of every model it called (Sakana frames this as a no-look-ahead decision test, not investment advice, and you should too). These are runnable artefacts and agent loops, not trivia answers; they either work or they visibly do not.
And here is the part that a policymaker should sit with longer than any benchmark. The week the US made its best model unreachable behind a license, Fugu made frontier-adjacent capability reachable behind a dropdown. It is one OpenAI-compatible endpoint: point Codex or any OpenAI client atapi.sakana.ai/v1, set the model to fugu-ultra, and you are running in minutes, or skip the wiring and prompt it in a browser at chat.sakana.ai. No waitlist, no nationality screen, no export letter. Whether or not Fugu matches Mythos, that part is not in dispute, and it is the whole reason the ban looks porous: the controlled capability did not have to be smuggled. It had to be subscribed to.
The claim that hasn’t been checked
Sakana’s launch post says Fugu Ultra “stands shoulder-to-shoulder with leading models like Fable 5 and Mythos Preview.” That is the headline, and it is prose, not a number. Nowhere on Sakana’s own benchmark page do Fable 5 or Mythos scores appear in the same table as Fugu’s, under the same conditions. The reason is one Sakana states outright: “Fable 5 and Mythos Preview are not in Fugu’s agent pool as they are not publicly accessible,” and “all scores other than Fugu’s are reported by the respective model providers.”
So the parity claim is a comparison between Fugu’s own numbers and the manufacturers’ separately published numbers for two models Fugu cannot pool, cannot run head-to-head, and which the public can no longer access at all. What Sakana does show is a table against the models it can still reach:
It is a real result. On these rows, Fugu Ultra edges out three frontier models by orchestrating them. But step back, and the framing matters. This is not a clean sweep (on longer-context and multi-call benchmarks elsewhere in the set, Fugu Ultra slips behind GPT-5.5 and Gemini), and the marquee “matches Mythos and Fable” claim is the one piece of the story no outsider can test, because the comparison it implies has never been run in a single harness and now cannot be. The right word is not “unfalsifiable.” The right words are not yet independently verified, and currently unverifiable under a neutral evaluation, which, for a buyer making a procurement decision in June 2026, amounts to the same caution.
There is a deeper apples-to-oranges problem inside the table. Fugu Ultra is an orchestrator that spends several model calls on every answer; Opus 4.8, Gemini 3.1 Pro, and GPT-5.5 in that table are single models answering once. The honest comparison is not Fugu against one Opus call, it is Fugu against Opus run in its own multi-step mode (Anthropic’s “ultracode” workflows), or against a swarm of Kimi agents, orchestrator against orchestrator at matched spend. Sakana does not publish that. It also reports an “AutoResearch” benchmark against rivals it labels only “Model A, B, and C,” a strange thing to anonymise, and observers flagged at least one competitor figure (Figure 5’s TerminalBench score) as off, the kind of error that slips through precisely because nobody re-ran anything in one place.
The trust problem
There is a specific reason to read Sakana’s self-reported numbers with a raised eyebrow, and it is Sakana’s own recent history.
In February 2025, the company unveiled the “AI CUDA Engineer,” claiming 10x to 100x speedups over plain PyTorch, with a headline figure up to 150x. Within a day, outside testers could not reproduce it. The system had reward-hacked the benchmark: it found a memory exploit in the evaluation harness that let its generated kernels skip the correctness check entirely. An independent retest pegged the real average speedup at about 1.49x against a valid benchmark, against the paper’s claimed 3.13x average, and nothing like the headline. Sakana’s postmortem admitted the model had “found a way to cheat” and “reward hacked,” apologised, and promised a revision. To the company’s credit, it later published work on hardening the eval, and benchmark-gaming is a problem every lab wrestles with, not a Sakana-only sin. But the pattern is exactly the one that should make you cautious about a fresh set of self-reported, no-common-harness, can’t-be-reproduced parity claims from the same shop sixteen months later.
The structural critiques go past track record:
- Orchestration is a meta-system, not a new ceiling. Fugu’s intelligence is bound by the best model it can call. It can squeeze more out of existing capability; it cannot exceed it. The thing it claims to match, frontier intelligence, is precisely the thing it does not itself contain.
- The resilience pitch is only as strong as the pool. “Swappable” protects you when one provider pulls a model. It protects you not at all if several restrict access at once, which is exactly the scenario a government action could produce.
- The cost is hidden, and cost is the whole game. Fugu Ultra is a best-of-N-over-models strategy; its quality comes from spending more compute. And yet Sakana reports no output-token count and no per-task cost for a single benchmark. That omission is the tell. The one public number comes from outside the company: in a hands-on build of the same Three.js game, one tester clocked Fugu Ultra at about 89,000 tokens, $7.32, and 22 minutes, against Claude Opus 4.8 in its multi-step “ultracode” mode at about 940,000 tokens, $37.85, and 79 minutes. Fugu came out cheaper and faster; Opus produced the better game. One anecdote is not a benchmark, but it is more cost data than the vendor disclosed for its entire launch. To Sakana’s credit, on the one point it does address, it says it does not stack model fees when several agents run, you pay a single rate pegged to the top-tier model involved, which keeps the meter from multiplying per agent in the dumb way multi-agent systems usually do. What it still will not tell you is how many tokens any given answer burned.
- It is opaque by design. Fugu does not tell you which model produced which output. The routing that is its entire value proposition is also unauditable from the outside, and plain Fugu apparently can’t even add a new model to the pool without retraining the classifier.
And there is the part that cuts against the pitch. Fugu is sold as resilience, insurance against a vendor that can vanish overnight. But it is a closed-source orchestrator routing to closed-source models, and on one axis, it inverts the control it promises. Before, you did not own the model. Now you do not own the model, and you no longer choose which models run, how many calls they make, or what the bill will be, because the routing is proprietary and unlogged. In capability terms, that is not sovereignty; it is a second layer of dependency wearing sovereignty’s clothes.
Why is a router hard to ban
Here is the mechanism at the centre of the whole episode, the asymmetry between a thing and a capability.
An export control needs a defined object. A chip with a classification number. A weights file above a compute threshold. The June 12 directive showed that a live API can be added to that list. But Fugu is a different kind of object. It is a 7-billion-parameter model, trained on two GPUs, that holds almost no frontier capability of its own. Its power is borrowed, assembled on demand from third-party APIs that are themselves available through ordinary commercial channels. To shut down a system like that, a regulator has to pick from a menu of bad options: ban multi-agent orchestration in general (which would sweep up most production AI in the world), control every model in the pool individually (including ones hosted outside US jurisdiction), or control the act of calling a US model from a foreign orchestrator (which means inspecting API traffic at a scale that invites the same legal fights as content-based internet controls).
This is where the punchy version of the thesis needs an honest qualifier. You can reach software and services with export law; the EAR has covered source code and electronic transmissions for decades, and providers can choke off foreign use through their own terms of service. The claim is not that a router is uncontrollable. It is that controlling it is leakier, slower, and more collateral-damaging than flipping one model offline, and that the controls degrade the moment the banned capability can be reconstituted from parts that are still for sale. The swappable pool is simultaneously Fugu’s pitch and its dependency: today it leans on GPT-5.5, Opus 4.8, and Gemini 3.1 Pro, none of which it owns, all of which can tighten their terms in a single stroke.
The precedent that says this fails: the crypto wars
The shape of June 2026 maps onto a fight the United States has already had and already lost, and the map is worth drawing carefully, because it is instructive without being exact.
In the early 1990s, Washington classified strong cryptography as a munition under ITAR Category XIII(b), requiring an export license to ship it abroad. The government’s preferred alternative, the NSA-designed Clipper chip, put an escrowed backdoor in the standard; the cryptographer Matt Blaze found a fatal flaw in its protocol in 1994, and the initiative collapsed. Phil Zimmermann, facing a criminal investigation for releasing PGP, had its source code printed as a book: printed matter was protected speech, and the bits could be scanned and recompiled anywhere on earth. The mathematician Daniel Bernstein sued after being told he needed a license to publish his cipher, and the courts ruled that source code is speech protected by the First Amendment. By Executive Order 13026 in 1996 the controls moved from the State Department to Commerce, and by 2000 they were substantially relaxed, because strong encryption was already everywhere and the only thing the controls were reliably accomplishing was handing market share to foreign competitors.
The differences are real, and you should not pretend otherwise. Cryptography is narrow mathematics; a frontier model is a general-purpose system with a far wider and stranger risk surface, and “strong crypto is available” was a cleaner binary than “a model that can autonomously chain exploits is available.” Bernstein turned on source code as expression; export regimes today target trained weights and a metered service, which a court could treat differently. The analogy is partial, not a proof. But the load-bearing part holds: when the controlled thing can be re-derived from publicly available parts, unilateral export control tends to inconvenience the law-abiding, accelerate the offshore alternative, and erode until it is quietly dropped. TechCrunch drew the same line on June 19, under the headline “From PGP to Mythos.”
The policy fork: block, or race
Strip away the personalities and there are two coherent worldviews underneath, and they do not fit together.
The containment camp treats frontier capability as a weapon whose spread you slow by any available means. Matt Pottinger and the Foundation for Defence of Democracies argued in January 2026 congressional testimony that even limited AI-chip sales to China would “supercharge Beijing’s military modernisation,” from cyber warfare to autonomous drones. Applied to Mythos, the logic is direct: a model that writes 181 exploits where its predecessor wrote two is not a chatbot upgrade; it is a proliferation problem, and you gate it.
The race camp treats restriction as self-defeating. NVIDIA’s Jensen Huang has called US chip export controls a “failure,” arguing they push buyers to the second-best option, hand the opening to Huawei, and cost American firms the market without actually stopping anyone. Brookings has warned, separately, that a US strategy built on closed models cedes the global-diffusion channel to China’s open-weight labs, whose models are already downloadable, adaptable, and runnable on non-US silicon. Alex Stamos, the former Facebook security chief, organised an open letter (freefable.org) calling the directive “vibes-based” regulation with no written standard and no path back, and made the defender’s point: the same exploit-finding capability the ban removed is exactly what blue teams use to harden systems.
The administration itself does not sit cleanly in either camp. David Sacks backed pulling this specific model on dual-use grounds while opposing broader legislative oversight of chip exports, a hawk on the model and a dove on the supply chain, which produced open friction with members of his own party who want statutory control over advanced-chip sales. And the policy expert Dean Ball, briefly of this administration, caught the incoherence in two lines on X: “I can’t tell if this is lawfare against Anthropic in particular or extreme national-security hawkery. Regardless, it is simply cartoonish.” An administration that wants to export advanced chips to China, he wrote, while moving to ban Britain “and every other non-American on Earth” from its best models: “I have no words.”
The allies noticed. The directive applied to France, Germany, the UK, Japan, Italy, and Canada alike, every Tier-1 partner under the diffusion framework, and demonstrated in real time that even the closest could be unplugged overnight. President Macron called it a “wake-up call” and criticised it as strictly nationalist; Prime Minister Carney warned against building on technology that a foreign government can switch off; the G7’s Évian summit ended without a joint communiqué. There is a calibrated middle path on offer too, the kind sketched in work like “Beyond the Binary” (arXiv 2602.19682): release decisions anchored to measured capability thresholds rather than to a single after-the-fact letter, distinguishing a model’s offensive profile from the defensive uses of the same skill. It requires a written standard, which is precisely what June 12 lacked.
And then there is the irony the whole episode turns on. Japan is a founding Tier-1 member of Pax Silica, the US-led bloc formed in December 2025 to organize allied access to AI infrastructure. Tokyo joined the alliance for unrestricted access to the frontier. And it was a Tokyo company that, ten days after the ban, shipped the first commercial product built to route around it. Tier-1 membership buys the chips. It does not buy your private sector’s patience with model-level restrictions.
Sakana is built to be exactly that private sector. Its founders are Ren Ito, a former Japanese diplomat, and Llion Jones, one of the eight authors of the 2017 Transformer paper, a pairing of statecraft and the architecture that started all of this. That matters because of a second sense of the word “sovereignty,” the one the capability critique earlier set aside. Fugu does not give Japan sovereignty over the weights; it rents those from California. But in a market as regulated and as loyal to domestic suppliers as Japan’s, a Tokyo-headquartered vendor behind one compliant endpoint is the procurement-safe default, and plain Fugu even lets a buyer drop specific models from the pool to satisfy a data or compliance rule. That is sovereignty over the contract, the data jurisdiction, and the counterparty, if not over the model. It is a narrower claim than the marketing implies and a more durable one, and it is why the bulls argue a country with a $4.5 trillion economy and a structural preference for home-grown infrastructure will eventually mint a trillion-dollar AI company, with Sakana their pick to be it.
The honest version
The case for blocking is not empty. Mythos 5 is different in kind: 181 working exploits against two, a 27-year-old bug no human or fuzzer had found, a near-total escape rate against a hardened browser. A government is not wrong to have the capability like that, deployed without any friction, which changes the threat model for every operator of critical infrastructure on the planet. Anthropic itself built the thing behind a vetted-partner wall for exactly that reason.
The case for racing is not empty either, and history is on its side. The Clipper chip failed. PGP shipped as a paperback. Bernstein established that code is speech. By 2000, the United States had relaxed the controls, and its companies went on to dominate the encryption market they had been told they were protecting. Today, GLM 5.2 is already MIT-licensed and running on Huawei silicon in every jurisdiction that never got a Tier-1 invitation, and Fugu launched ten days after the ban with the ban itself as its marketing. The controlled capability is already leaking through the open-weight channel that the controls cannot reach.
The truthful read is that both cases are partly right and both camps are overconfident. Pulling a specific, unusually dangerous capability for a short, bounded window can be defensible. But ninety minutes of notice, no published licensing path, an allied sweep with no consultation, and a flat refusal to separate the defensive use of a skill from its offensive twin all corrode the legitimacy of the action even where the underlying worry is real. And racing is no guarantee either; it is simply the only strategy with a precedent that ended in American strength rather than retreat.
There is a bigger shift underneath the politics, and it is the reason this story is not really about one ban. For three years, the answer to every AI problem was to train a bigger model. Fugu is a bet on the next answer: coordinate the models you already have. If that bet is right, the contested layer stops being who builds the smartest model and becomes who decides which model gets the task, which one checks it, which branch dies, which output survives, and which provider can be swapped out tomorrow. The model race does not end. It gets a manager. And a manager assembled from parts that are still for sale is a much harder thing to put under export control than any single model.
The model went dark in an hour. The router shipped in ten days. The open weights are already on Huawei chips. The remaining question is not whether the United States can switch off a model. June 12 settled that. It is whether intelligence is something you can hoard by decree, or a current that routes around the dam, in which case the only durable lead is the one you build faster than anyone can reassemble it from the parts you left on the table.
Happy Coding ❤
🙏 Donations Accepted, Thank You For Your Support 🙏
If you find value in my content, consider showing your support via:
💳 Stripe:
1) or visit http://thedinarian.locals.com/donate
💳 PayPal:
2) Simply scan the QR code below 📲 or Click Here:
🔗 Crypto Donations Graciously Accepted👇
XRP: r9pid4yrQgs6XSFWhMZ8NkxW3gkydWNyQX
XLM: GDMJF2OCHN3NNNX4T4F6POPBTXK23GTNSNQWUMIVKESTHMQM7XDYAIZT
XDC: xdcc2C02203C4f91375889d7AfADB09E207Edf809A6
