AI輸出制限が技術者を分断、米政府の指令でAnthropicがFable 5を停止

A Friday directive cut every foreign national off from Claude Fable 5 mid-session. After forty years of being asked to justify belonging, I recognized the reflex on sight.12 min readJust now--I do not usually write this kind of piece. I am not a political person, and I have spent very little of my life arguing about governments. My lane is building. Give me a hard problem and a good tool and I am content for a week.Press enter or click to view image in full sizeIllustration by the author (AI-generated, GPT Pro). © Alireza RezvaniWhat I do hold, and have held for as long as I can remember, is a conviction about technology itself. Technology is meant to help people achieve more and live better, and the closer we come to putting it in everyone’s hands, the better that bargain gets. Knowledge wants to be shared. That is not a slogan to me.It is the thing that built civilizations, that carried us from one good idea in medicine or science or engineering to the next, each generation standing on the open work of the one before.AI is the most powerful version of that machinery we have ever made, which is exactly the reason access to it should be widening.“Don’t be evil” has been a quiet mantra of mine for years.Not as a company’s tagline, but as a compass: build things that help, keep the ethics in front of the engineering, and do not pull the ladder up behind you.So it takes something specific to pull me out of my usual lane. A few nights ago, something did.It was late, and Claude Code was working on my core.I had a session running on a product I am building. Claude Code was inside the codebase, the Agent SDK part of the system, and the model I had selected was Fable 5. I was relying on it completely. Not as a novelty I was kicking the tires on. As the thing doing real work while I steered.Then, in the middle of the session, it broke. Not an error I recognized. Not a timeout I could retry my way past. The work simply stopped.My first assumption was the ordinary one: something on my side. A bad config, an expired token, a wrong endpoint. When that came up clean, I assumed it was infrastructure on Anthropic’s side, the kind of outage that resolves itself in twenty minutes if you wait and finish your coffee.It was neither. I went looking for the root cause, and the root cause was a letter.What the letter actually saidOn the evening of June 12, the United States government issued an export control directive to Anthropic, citing national security authorities. Commerce Secretary Howard Lutnick sent it to chief executive Dario Amodei, drafted with help from the Commerce Department’s Bureau of Industry and Security.Anthropic received it at 5:21pm Eastern. The order instructed the company to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including Anthropic’s own foreign-national employees.By the company’s own account, the letter did not provide specific details of the national security concern.Read that scope again, because it is the whole story. The order did not restrict a capability. It did not name a country. It drew a line around a class of people, defined by the passport they hold. The line was so broad that Anthropic could not comply selectively. To honor it, the company had to switch off Fable 5 and Mythos 5 for every customer on the platform, citizen and foreigner alike.Access to all other Anthropic models stayed up. Three days after shipping the most capable model it had ever released to the public, the company turned that model dark for everyone.I want to be precise about who is in the frame here and who is not. Anthropic did not do this to me. Anthropic was handed a directive on a Friday evening and chose the only compliant path available, then said publicly that it believes the order is a misunderstanding and that it is working to restore access.The company shipped Fable with classifiers built specifically to block the high-risk cyber capabilities of the underlying model.It red-teamed those safeguards for thousands of hours with the US government, the UK AI Security Institute, and outside organizations before release. This piece is not an argument against the people who built the tool. It is an argument against the instrument that took it away.The timeline is the storyHere is the part that turned my frustration into something colder.Press enter or click to view image in full sizeThe ten-day gap between the voluntary order and the binding one. Illustration by the author (AI-generated, GPT Pro). © Alireza RezvaniTen days earlier, on June 2, the same administration signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security.” I read it when it came out. It was, by the plain text and by every law-firm summary that followed, expressly voluntary. Not a licensing regime. Not pre-clearance.A framework, to be designed by August 1, under which developers could choose to give the government early access to certain frontier models for up to thirty days before release.Anthropic welcomed it. So did OpenAI. So did Google. The whole industry read it as the reasonable version of government engagement: a request, not a rule.The framework was not even built yet. The August deadline had not arrived. And before the voluntary process the President had just announced could take its first breath, the government reached for a binding export-control directive and switched the models off by fiat.That is the sequence that matters. Voluntary in the announcement, mandatory in the execution, ten days apart. A request became a command the moment a model crossed a threshold the government had not yet finished defining. If you are a builder deciding whether to trust a “voluntary” framework, the timeline already gave you your answer.The signal this sends is more dangerous than the threat it names, because the signal is that the soft promise is provisional and the hard switch is always within reach.It gets sharper when you read what the June 2 order actually set up. The framework leans on a classified benchmarking process, run through the National Security Agency, to decide which systems count as covered frontier models. The order never defined that term. So on June 2 the government announced a voluntary process keyed to a threshold it had not yet written, administered by an intelligence agency, to be stood up by August 1.Ten days later, with none of that machinery built, it skipped the entire apparatus and reached straight for the export-control switch. The voluntary scaffolding was still ink on a page when the binding version arrived.What the bug actually was, as far as anyone can showThe stated trigger, by Anthropic’s account, is a jailbreak. The government’s understanding is that someone found a method to bypass Fable 5’s safeguards and reach the cyber capabilities underneath. Reporting from Axios and CNBC adds the detail that the concern was raised after another company claimed it had jailbroken Mythos.So a competitor claimed a bypass, and a model went dark worldwide. Sit with that for a second.Anthropic’s own characterization of the technique is narrow. The company says the jailbreak it understands the government to be citing is single-instance: it would unlock the model’s cyber capability in one specific case, not a universal break that defeats the safeguards across the board.In its thousands of hours of pre-launch red-teaming, no tester found a universal jailbreak, and Anthropic stated plainly that it suspects perfect jailbreak resistance is not currently possible for any provider on the market.Here is my contention, and I am labeling it as mine rather than dressing it up as a fact: the capability the government is afraid of is not exclusive to Fable. The cyber tasks a narrow bypass would surface are reachable from other deployed frontier models the same afternoon, GPT-5.5 included, by a competent operator who never touches Fable at all.If that is true, and I believe it is, then switching off Fable does not contain the risk. It relocates the customer. The thing demonstrated was not the thing feared.A narrow, already-reachable capability does not become a national emergency because it appeared inside the model that happened to ship last.Let me steelman the other side honestly, because an argument that cannot survive its opposition is just a complaint with footnotes. The government’s strongest case has two prongs.Press enter or click to view image in full sizeFive conditions a legitimate recall power would have to meet. Illustration by the author (AI-generated, GPT Pro). © Alireza RezvaniFirst: even granting that the capability is common, a frontier model with the cyber ceiling of the Mythos class is a genuinely dangerous artifact, and a state has a legitimate interest in slowing its spread.Second: maybe the bypass really is worse than Anthropic believes, and the government is acting on classified information it cannot show.I take both seriously, and I still land where I started.On the first: if the capability is genuinely common, the danger is already distributed, and gating one vendor is theater with a cost.On the second: a power exercised on evidence the public cannot see, through a letter no court reviewed, sorted by the nationality of the user, is exactly the kind of power that demands more justification, not less. “Trust us, it is classified” is the oldest argument for unaccountable action there is. It is not made stronger by being aimed at software.I am not asking for recklessnessI need to be clear about what I am not saying, because the easy way to dismiss this is to pretend I am a man who wants no guardrails.I am not. Fable shipped with safeguards stronger than anything the company had deployed before, and that is the right posture for a model this capable. There are interventions a government should be able to make. If a deployment created demonstrated, model-specific uplift toward catastrophic harm, the state has not just a right but a duty to act. My objection is not to the existence of limits.It is to this instrument: a secret Friday letter, with no stated evidence, that sorts a company’s customers and its own engineers by the passport in their pocket, applied to a capability that is already everywhere.The mechanism is the problem, not the motive.I have seen this reflex before, in a softer accentEurope has been running a gentler version of this for years, and I have lived inside it.The European instinct is to meet a powerful, broadly useful technology by regulating it first and asking what it is good for second. The execution is slow and procedural rather than abrupt, a compliance drag rather than a switch thrown on a Friday.But the instinct is the same: prevent by gating. The cost is measurable. A study published in Marketing Science found that venture investment in EU technology firms fell sharply in the wake of GDPR, with the steepest declines hitting newer and data-reliant startups, the exact companies a continent claiming to want innovation should most want to keep.Research circulated through the NBER found similar drag. Caution has a price, and in Europe the receipts have been coming in for half a decade.I am not going to flatten this into “the US is now the EU.” That is the lazy version a critic kills on sight, and it is wrong on the mechanics. Europe gates through law, slowly, in public, with text you can read and challenge. The June 12 directive did it through a letter, overnight, with reasons nobody outside the room has seen. Same instinct, cruder execution. And I am not going to call it protectionism either, because that word implies an economic motive the facts do not support.This was not about market share. It was about a state’s reflex to reach for the off switch when a technology frightens it, and to reach for it first.Why this one landed differentlyI was born in Iran. I was raised in Germany. I have spent more than forty years in Europe being quietly asked, in a hundred small administrative ways, to justify belonging.You learn the texture of it early: the second look at the name on the form, the extra document requested, the sentence that begins “just to confirm.” You do not stay angry about it for forty years. You cannot. You get used to it. It becomes a kind of weather.So when I read a directive that sorted builders by the passport in their pocket, my first reaction was not shock. Shock is for people who have never seen the uniform before. My reaction was recognition. The worn, unsurprised recognition of a thing you have known your whole life, showing up in a new place wearing new clothes.And the new place is what stings. For most of my life the United States was the counterweight to all of that. The land of the people who wanted to change the world, who did not ask where you were born before they asked what you could build. It was the example I held up, privately, against the Europe I had grown tired of.To watch it reach for the same instrument, faster and with less explanation than Brussels ever managed, is the part of this that I am still sitting with. Not the lost session. The lost symbol.What a legitimate version would look likeRejecting the gate is the easy part. The harder and more honest thing is to say what should replace it, because the risks these models carry are real and not going away. So here is the version I could accept, and who would have to build it.First, a transparent statutory process.If the United States government wants the power to halt a deployment, Congress should write that power into law, with clear thresholds, written findings, and a stated rationale that the public and the company can read. Power exercised by surprise letter is not the same as power exercised by law.Second, technical-fact thresholds instead of verbal claims.A recall should rest on demonstrated, model-specific uplift: a capability this model gives a malicious actor that they could not already get from a deployed competitor, documented and reviewable by people who understand the field. The agency issuing the order should have to show its work.Third, no access sorted by passport for commodity capability.Nationality-based controls have a legitimate home: genuinely frontier-exclusive, dual-use technology, applied through due process. They do not belong on a capability that a paying customer can pull from GPT-5.5 the same afternoon.Sorting a company’s customers, and its own engineers, by heritage, for a capability that is already everywhere, is not security. It is sorting dressed as safety.Fourth, parity testing before any recall. Before pulling a commercial model, the agency should test whether the same output is reachable from publicly available models. If it is, as it plainly was in this case, the case collapses on its own terms and the order should never issue.Fifth, defense in depth over gate and block. The real answer to unavoidable risk is not a switch that turns the future off. It is strong safeguards, plus monitoring, plus the ability to detect and shut down a real attack quickly. That is the strategy Anthropic argued for, and it is the right one. Builders carry a share of this too: the more of us who reduce our single-point dependence on any one provider, the less power a single letter has over any of us.Who decides who gets the futureYou cannot meet the challenges that are coming by blocking the tools that help you face them. The hard problems do not disappear when you switch off the model. They sit there, unsolved, while the people who might have worked on them are turned away at the door for holding the wrong passport. Prevention by exclusion is not caution. It is a refusal to do the harder work of governing a powerful thing well.So I will not end this with resignation, because resignation is what the reflex counts on. To the foreign builders reading this: you are not imagining it, and you are not alone in it.To everyone else who builds on these platforms, citizen or not: the switch that came for us on Friday is the same switch that sits over your work too, and the only question is which letter trips it next.The question worth arguing about is not whether AI is dangerous. It obviously is, in the way every powerful tool is dangerous. The question is who decides who is allowed near it, and on what evidence.This time the answer was a Friday letter, a passport check, and no reasons anyone can read.That is the wrong answer, and we should say so clearly, while the precedent is still fresh enough to push back on.What would a process you actually trust look like? I have given you mine. I would genuinely like to read yours.About Me:I am Alireza Rezvani (Reza), a Berlin-based CTO. I build openLEO.ai, an Agent-as-a-Service product, and I run my engineering team on Claude Code and agent orchestration in production every day. I write about building real systems with AI, and about what it costs when the ground under those systems moves. I maintain an open-source library of Claude agent skills and plugins on GitHub.If you build on these platforms and this resonated, I would rather hear your disagreement than your applause. Find me at alirezarezvani.com , substack.com, X or on LinkedIn.

※ 著作権に配慮し、引用は冒頭3段落までです。続きは元記事をご覧ください。