The AGI Manhattan Project: Treating Frontier AI Like a Weapon

[UPDATED 7–2–2026] The outrage over gated AI models misses the real story. The United States has reclassified advanced artificial intelligence as a national-security asset — something closer to a controlled weapon than a software release. Here is what actually happened, what the documents really say, and why the version circulating online is less accurate than the truth.

The AGI Manhattan Project — Image by Gemini

A model that lived for three days

On June 9, 2026, Anthropic released Fable 5, a public-facing version of its most advanced “Mythos-class” technology, wrapped in heavy safeguards meant to refuse the riskiest cybersecurity, biology, and chemistry requests. On June 12, it was gone.

The shutdown was not a rollback for a bug or a pricing change. It came from the U.S. Commerce Department’s Bureau of Industry and Security, which issued a directive requiring Anthropic to disable Fable 5 and its more restricted sibling, Mythos 5, for “any foreign national” — inside or outside the United States, including Anthropic’s own foreign-national engineers. Because the company could not verify nationality in real time across a user base measured in the hundreds of millions, the only way to comply was to switch both models off for everyone on Earth the same day. A model that had been public for roughly seventy-two hours simply vanished.

That single episode is the cleanest illustration of a shift that most of the public has not yet absorbed. For most of the AI boom, the relationship between a frontier lab and the rest of us looked like a consumer escalator: a model gets built, an API drops, businesses build on top of it, and a better model arrives a few months later. That escalator has not stopped, but a new gate has been bolted onto the top of it — and the gate is operated not by the labs but by the national-security state.

When the gate closes, people get angry. The anger is understandable, and it is also, in important ways, aimed at the wrong target. The dominant public reactions — “this is corporate greed,” or “this is arbitrary government meddling in a product I pay for” — both assume the old escalator model still governs everything. It doesn’t. To understand why a model can be born and killed inside a single news cycle, you have to understand that Washington has quietly reclassified what these systems are. Advanced AI is no longer being treated purely as a commercial product. It is being treated as a dual-use strategic technology, governed by the same instincts — non-proliferation, export control, vetting, secrecy — that the United States applies to nuclear, biological, and chemical capability.

A particular version of this argument has been taking shape among people who follow the industry closely, and it runs roughly like this: that the United States now treats frontier AI exactly as it treats weapons of mass destruction, governed by the same non-proliferation logic that constrains nuclear, biological, and chemical capability; that models are being gated from the public specifically to stop foreign powers from distilling them; that Washington believes itself the only industrial power able to build this technology from scratch — the financial moat too large for anyone else to cross without copying American work — and intends to keep it that way; that the security establishment has decided this generation of models crosses a capability line warranting weapons-grade containment and careful vetting of any customer outside the U.S. government itself; and that, if artificial general intelligence is achievable at all, the United States means to ensure it is born nowhere else. In this telling, private industry is left to cry foul — suing, lobbying, insisting that the model it paid for is being confiscated for reasons it neither trusts nor understands, asking why the government may have the technology when the rest of us may not.

It is a compelling story. Parts of it are demonstrably, documentably true. Other parts collapse the instant you hold them against the public record, and a few are simply the wrong shape. What follows is an attempt to do precisely that work — to take each of these claims in turn and test it against the executive orders, the bills, the court filings, and the reporting, separating what has happened from what has merely been asserted. The accurate version is not the breathless one, in which a shadowy program assembles a secret superintelligence in a desert bunker. It is stranger, because it is real, it is on the public record, and almost nobody is reading the filings.

The fear that organizes everything: distillation

To understand why the government suddenly cares so much, start with the thing that keeps frontier-lab security teams awake: distillation.

Distillation is, in its ordinary form, one of the most mundane techniques in machine learning. A smaller, cheaper “student” model is trained on the outputs of a larger, more capable “teacher” model, learning to approximate its behavior at a fraction of the cost. Labs do it to their own models constantly, to ship faster and lighter versions. There is nothing sinister about the method itself.

The national-security version of the story is what happens when that technique is pointed at a rival’s frontier model, run through tens of thousands of fraudulent accounts, and used to harvest the most commercially and strategically valuable capabilities a lab has — without paying any of the cost of developing them. In that framing, the multi-billion-dollar “compute moat” that was supposed to keep frontier capability scarce becomes far less protective than it looks. You don’t need to steal the weights. You just need enough high-quality outputs to teach your own system to imitate the original.

This is not hypothetical, and the numbers are now part of the congressional record. In February 2026, Anthropic publicly accused three Chinese AI labs — DeepSeek, Moonshot AI (maker of Kimi), and MiniMax — of running coordinated extraction campaigns against Claude. According to the company, the three collectively generated more than 16 million exchanges through roughly 24,000 fraudulently created accounts, using commercial proxy services to route around the restrictions that bar Chinese entities from accessing the model. The capability targets were specific rather than random: DeepSeek allegedly went after reasoning and rubric-based grading (and, separately, more than 150,000 exchanges aimed at producing “safe” answers to politically sensitive questions); Moonshot targeted agentic reasoning, tool use, and computer vision across some 3.4 million exchanges; MiniMax ran the largest of the three, more than 13 million exchanges focused on agentic coding.

Then, in June, the scale jumped an order of magnitude. In a letter dated June 10, 2026, addressed to Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren — first reported by Bloomberg on June 24 — Anthropic accused operators linked to Alibaba’s Qwen lab of running what it called the largest distillation campaign it had ever documented: nearly 28.8 million unauthorized exchanges with Claude over a 44-day window from April 22 to June 5, using roughly 25,000 fraudulent accounts and commercial proxies. The campaign, Anthropic said, targeted exactly the capabilities embodied in its frontier Mythos Preview model — software engineering, agentic reasoning, and cybersecurity — and the company went so far as to allege Chinese government complicity. It was the first time Anthropic named a Chinese technology conglomerate of Alibaba’s scale, and the first time it formally submitted such evidence to a Senate committee.

It is essential to be precise here, because precision is exactly what gets lost when this story is retold. Every one of those figures is Anthropic’s own allegation. None has been independently verified. Alibaba flatly denies it. And the framing — that distillation is “converting billions of dollars in American investment into a massive subsidy for our geopolitical competitors,” as Anthropic’s policy team put it to senators — is a characterization, not an established finding.

Critics, predictably, see something less noble. Chinese commentators and several independent academics have described the accusations as a “kick away the ladder” tactic: a dominant incumbent reframing an ordinary, widely used industry technique as theft in order to wall off competition and justify export controls. The point cuts deeper than national rivalry. Distillation genuinely is standard practice; Anthropic acknowledges distilling its own models. The line between “legitimate research” and “adversarial extraction,” as more than one AI professor has noted, runs not through the technique but through the fraudulent access and the terms-of-service violations layered on top of it. And there is an uncomfortable mirror: Anthropic itself agreed in 2025 to pay roughly $1.5 billion to settle a class action from authors who said the company trained Claude on their books without permission. A company built partly on ingesting others’ work without consent, now invoking national security against others ingesting its work, is a contradiction its competitors have been happy to highlight — Elon Musk among them.

You do not have to resolve that argument to see why Washington took the bait. Whatever the motive, the technique is real, the scale is unprecedented, and the strategic logic is brutally simple: if you cannot protect a model’s outputs from being mined for its underlying cognitive structure, then releasing that model broadly is itself a proliferation event.

The legal machinery, and what it actually says

Once you accept the distillation premise, a cluster of policy moves from the past several months snaps into a single shape. Three are worth understanding in detail, because each is routinely overstated online.

The OSTP distillation memo (NSTM-4). In late April 2026, the White House Office of Science and Technology Policy, under director Michael Kratsios, issued a memorandum characterizing industrial-scale foreign distillation of U.S. models as a national-security threat and committing the government to share threat intelligence with American labs about such campaigns. This is the document that formally reframed distillation from a private terms-of-service problem into a matter of state. Notably, Anthropic’s Alibaba accusation pointedly emphasized that the alleged campaign continued after this memo — in defiance of an explicit government warning.

DAAMTA (H.R. 8283). The Deterring American AI Model Theft Act of 2026 was introduced on April 15 by Representatives Bill Huizenga and John Moolenaar and was reported out of the House Foreign Affairs Committee about a week later. It would use export controls and sanctions to raise the cost of “model extraction attacks” against closed-source, American-owned models: a State Department “AI Model Extraction Attackers List” published for up to five years, automatic coverage of China and Russia, and potential additions to the Commerce Department’s Entity List. The honest caveat — which the dramatic retellings omit — is that DAAMTA is still a bill. The Congressional Budget Office estimated its direct fiscal effect at under $500,000 over a decade, and the historical reality is that most House bills targeting China die before becoming law. It signals intent. It is not yet a wall.

The June 2 Executive Order. This is the centerpiece, and it is the single most distorted item in the entire narrative. On June 2, 2026, President Trump signed “Promoting Advanced Artificial Intelligence Innovation and Security.” The order does several real and significant things. It directs federal agencies to harden cyber defenses on an aggressive 30-to-60-day timeline. It creates an “AI cybersecurity clearinghouse” run out of Treasury with NSA and CISA, to coordinate vulnerability scanning and patching with industry. It directs the Attorney General to prioritize prosecution of AI-enabled cyberattacks. And — the headline provision — it establishes a framework under which developers of “covered frontier models” may give the federal government access to those models for up to 30 days before broader release, with the National Security Agency designating which models qualify through a classified benchmarking process focused on advanced cyber capabilities. After that window, the order contemplates a narrower rollout to “trusted partners” selected in collaboration with the government.

Here is what the popular retelling gets wrong, and it matters: the framework is voluntary. The order states explicitly that nothing in it authorizes a mandatory licensing, preclearance, or permitting requirement for developing, publishing, releasing, or distributing AI models. There is no statutory “lockout.” Earlier drafts reportedly set the government-access window at 90 days; the President pulled a near-final version in late May over fears it would hobble U.S. competitiveness, and the released order cut the window to 30 days as a compromise between the administration’s national-security hawks and its anti-regulation faction. The benchmarking is centered on cyber capability — the ability of a model to autonomously discover and exploit software vulnerabilities — not, as is often claimed, a broad bioweapon-and-chemical-weapon vetting regime. Multiple law firms analyzing the order independently reached the same conclusion: this is an innovation-first, voluntary posture with a national-security overlay, not a preclearance state.

So why does a voluntary framework feel like a lockdown? Because the leverage is real even when the mandate is not. A lab that declines to participate still has to reckon with a government that controls export licenses, that can designate a company a supply-chain risk, and that — as Anthropic learned — can issue a Commerce directive that takes a model offline overnight. “Voluntary” in a field this dependent on government goodwill is a softer word than it sounds.

The Genesis Mission: the Manhattan Project that mostly isn’t

No element of this story gets mythologized faster than the Genesis Mission, so it deserves a careful, deflationary read.

Project Genesis: AGI for America — Image by Gemini

The Genesis Mission is real. President Trump signed an executive order launching it on November 24, 2025. It is led by the Department of Energy, directs the creation of an “American Science and Security Platform,” mobilizes the 17 national laboratories and roughly 40,000 DOE scientists and staff, and is explicitly framed by the administration as comparable in urgency to the Manhattan Project. It aims to pool the federal government’s vast, decades-deep scientific datasets — in energy, materials science, genomics, nuclear physics, and more — and use them to train scientific foundation models and autonomous research agents, with the stated goal of doubling the productivity of American science within a decade.

The mythologized version says Genesis is the AGI Manhattan Project: a program feeding classified national-lab data exclusively to OpenAI, Anthropic, Google, and xAI so that American models can “leapfrog” the world and guarantee that artificial general intelligence is born, permanently and solely, inside a U.S. enclave.

The documents say something narrower and more bureaucratic. Genesis is aimed at scientific domains where the government — not private companies — controls the most sensitive data, precisely because that data is classified or export-restricted and cannot simply be released. It is described as “architecture-agnostic,” designed to avoid lock-in to any single vendor’s ecosystem. Access is to be restricted to vetted federal researchers, national labs, and approved private partners through “uniform and stringent” data-management processes — which is a long way from a private pipeline handing weaponized capability to four companies. Several analysts have stressed that the order is largely conceptual: it directs the DOE to plan, identify assets, and demonstrate an initial capability within 270 days, but it allocates no new funding and leaves the central questions — who can access the platform, how broadly it will be used — to future appropriations and rulemaking. One widely shared industry explainer put the distinction bluntly: Genesis is not about chatbots, copilots, or any of the consumer AI the public touches; it is aimed at strategic scientific sectors, and it leaves consumer-facing AI in the private sphere.

The kernel of truth in the dramatic version is genuine and worth keeping: the United States is consciously building a scientific data moat, is invoking Manhattan Project language, and does intend for the benefits to accrue disproportionately to American institutions and companies. The leap — from “a federally governed science platform with vetted access” to “a secret superintelligence factory ensuring a U.S.-only AGI” — is interpretation, not fact. Treat it as the thesis it is, not the finding it isn’t.

The plot twist nobody wants: the labs are fighting back

Here is the part of the story that breaks the tidy narrative of a unified American security state hoarding AGI with the eager cooperation of its corporate champions. The labs are not happy defense contractors. In at least one prominent case, the lab is suing the government.

Return to Fable 5. The June 12 Commerce directive that killed it did not come at Anthropic’s request. Commerce Secretary Howard Lutnick had separately warned CEO Dario Amodei that the company must obtain explicit government permission before exporting its most advanced models or allowing foreign nationals to access them. The government’s stated concern reportedly centered on a technique for “jailbreaking” Fable 5 — bypassing its safeguards. Anthropic’s own public account is openly skeptical: it said the demonstrated method essentially amounted to asking the model to read a codebase and fix software flaws, that the vulnerabilities surfaced were minor and already known, and that the capability on display was “widely available from other models,” naming OpenAI’s GPT-5.5 as a comparison. In other words, the company being regulated does not agree that its model crossed the bright line the government drew.

The collateral damage spread fast. The shutdown cut off allied users, including the United Kingdom’s AI Security Institute — one of the world’s leading bodies for testing frontier models for safety, which suddenly lost access to the systems it was evaluating. And it triggered the first known legal challenge to such an order. On June 23, a San Jose-based legal-technology startup called Legion LegalTech sued the federal government in Washington, D.C., naming Lutnick among the defendants. Legion is American but relies on Canadian engineers working from Canada — exactly the “foreign national” category the directive targeted. When access vanished, the company said, so did its core development capability; it described the harm in its complaint as “immediate, irreparable, and existential,” and asked the court to vacate the directive. Anthropic is not a party to that suit and has publicly struck a conciliatory tone, saying it is grateful to the administration and committed to U.S. AI leadership.

But conciliation is not the whole picture, because Anthropic is already in court against the government on a separate front. The company sued in Washington and California after the Pentagon moved to brand it a national-security supply-chain risk — a designation that followed Anthropic’s refusal to let the military use Claude for fully autonomous weapons or domestic surveillance.

Sit with the resulting tangle. Anthropic is simultaneously (a) begging the Senate to protect its frontier models from Chinese distillation, (b) suing the Defense Department over a supply-chain blacklist tied to its refusal of certain military uses, and © watching a customer sue the Commerce Department over an export order that took its newest models offline. This is not the behavior of a contented arm of the security state. It is a two-front, sometimes three-front war between a private company and a government that wants the company’s capabilities locked down on the government’s terms — terms the company frequently disputes.

That complicates the grand thesis considerably. “The United States wants to guarantee AGI happens only in America” is a coherent reading of the security state’s instincts. It is not a coherent reading of a landscape in which the leading safety-focused lab is litigating against that same state over how its models can be used and who can touch them. The reality is messier: a security apparatus reaching for non-proliferation tools, a set of labs that welcome protection from theft but resent being treated like munitions exporters, and no settled agreement between them about where the line sits.

A world splitting into tiers

Step back from the courtroom and a structural picture comes into focus. The combined effect of distillation paranoia, export controls, and pre-release review is not a single locked vault. It is a stratification of the global AI landscape into roughly three tiers — and, crucially, the most consequential tier for most people and businesses is the one the dramatic accounts tend to ignore.

The national enclave. At the top sit the gated, security-vetted systems: Mythos-class capability, the Genesis platform, models restricted to cyberdefenders, critical-infrastructure operators, and select researchers. Anthropic’s Mythos Preview has been used by a small set of trusted organizations under a program the company calls Project Glasswing. This is the tier that behaves like a weapons program — vetted customers, classified benchmarks, export licenses.

The public frontier cloud. This is the tier almost everyone actually lives in, and it is not shrinking — it is exploding. Commercial APIs and subscriptions to general-purpose frontier models remain enormous, legitimate, fast-growing businesses. The financial evidence is overwhelming. Anthropic announced in early April 2026 that its annualized revenue run rate had crossed $30 billion, up from roughly $9 billion at the end of 2025, driven by more than 1,000 enterprise customers each spending over $1 million a year. OpenAI, over the same period, sat around $24–25 billion. (There is even a revealing accounting fight underneath those numbers: OpenAI’s chief revenue officer reportedly circulated an internal memo arguing Anthropic’s figure was overstated by about $8 billion, turning on whether revenue routed through cloud partners should be booked gross or net. Both companies are private; both numbers carry asterisks.) The takeaway is simple: the publicly available frontier, sold as cloud intelligence, is funding the entire race. The government is comfortable letting this engine roar, because it keeps the economic value anchored in the U.S. economy — so long as those models stay below the cyber tripwires.

The public-cloud tier persists for hard practical reasons, not sentiment. Renting top-tier general intelligence turns enormous capital expenditure into predictable operating expense. General frontier models retain a cross-disciplinary adaptability that narrow, distilled local models lack — the “jagged intelligence” problem, where a specialized model is brilliant in its lane and brittle the moment it steps outside it. And API customers inherit improvements instantly, without re-downloading or re-tuning anything.

The sovereign on-prem tier. At the other end, a global pivot toward localized, self-reliant AI is accelerating — and it is partly a reaction to U.S. gating. If relying on American APIs means handing Washington a potential kill switch, the rational response for a foreign government or a regulated industry is to reduce that dependency. The clearest institutional expression came on June 3, 2026, when the European Commission published its Tech Sovereignty Package, centered on the Cloud and AI Development Act (CADA) and accompanied by a Chips Act 2.0 and an open-source strategy. CADA would establish four “sovereignty assurance levels” for cloud and AI services, conditioning access to public-sector contracts on graduated control, supply-chain, and data-residency requirements — at the strictest tiers, barring third-country corporate control outright. The driving anxieties are explicit: a structural shortage of EU data-center capacity, an over-reliance on a handful of non-EU cloud providers, and the long shadow of the U.S. CLOUD Act, which can compel American firms to hand over data regardless of where it physically sits. Like DAAMTA, CADA is a proposal working through a legislative process, not yet binding law, with a realistic timeline stretching toward 2027. But the direction is unmistakable.

The irony is sharp enough to be the whole moral of the piece. By reaching for the tools of containment, the United States has not paralyzed global AI. It has incentivized the rest of the world to build its own — its own data centers, its own open-weight models, its own semiconductor pipelines, its own legal jurisdiction over sensitive workloads. A containment strategy aimed at preserving an American monopoly is, at the margin, manufacturing the multipolar, decentralized ecosystem it was meant to prevent.

The quieter story: AI grew up while everyone was arguing

There is a second narrative running underneath the geopolitics, and it is the part of the popular account that holds up best — even if for slightly the wrong reasons. While the public has been transfixed by the drama of gated models and government overreach, the practical use of AI inside companies has matured dramatically — and matured past some of its founding myths.

The highly-acclaimed 10x Employee — Image by Gemini

For several years, enterprises treated AI like a consumer software upgrade in perpetual beta. Why invest in a robust pipeline around this year’s model when next year’s will render it obsolete? That hesitation produced a lot of hype and not much production deployment. What changed is less about a deliberate government “freeze” — models have, in fact, kept shipping; Claude Opus moved through 4.7 and 4.8 even as the frontier tier got locked down — and more about the simple fact that the available models finally got good enough, and reliable enough, to build durable machinery around.

That machinery is where the real productivity lives. The “10x employee” the industry kept promising did not arrive because a model suddenly developed a genius-level IQ. It arrived because engineers stopped waiting for that model and started wrapping today’s capable-but-imperfect systems in deterministic architecture: reflection loops where one model critiques another’s output before a human sees it; multi-agent orchestration where a managing agent delegates to specialized workers; state machines with human-in-the-loop approval gates that turn stochastic text generation into auditable business logic. Anthropic’s own numbers tell the story sideways: its growth is, to a remarkable degree, a single-product story, with the agentic coding tool Claude Code reaching a billion dollars in annualized revenue within six months of launch and continuing to climb. The unit of value shifted from the raw prompt to the engineered workflow.

This is the genuinely optimistic thread, and it is worth stating plainly without overclaiming. The most credible version of “augmentation, not replacement” is not a utopian prophecy; it is an observation about what works. Systems that try to replace a human with a single brittle prompt tend to fail loudly. Systems that turn a human into a supervisor of several reliable agents — defining objectives, reviewing outputs, handling the cases the machine punts on — tend to deliver real, measurable leverage. The companies seeing returns are the ones that invested in the plumbing rather than waiting for a messiah model.

Where I would gently part company with the triumphant framing is the claim that this amounts to a settled “golden age” in which the myths of job loss have been permanently dispelled. The same period that produced these productivity gains also produced headlines about large workforce cuts attributed to AI adoption, and the displacement question is far from resolved. The honest summary is narrower and more durable: AI has crossed from demo to dependency. It has become a line item in corporate budgets, approved by procurement, embedded in operations. That is a profound and underappreciated shift. Whether it ultimately augments or replaces is a question the data has not yet answered, and anyone who tells you it has is selling something.

What is actually true

Strip away the embellishment and the load-bearing facts stand on their own, on the public record:

The United States has reclassified frontier AI as a dual-use strategic technology and has begun governing it with non-proliferation instincts — distillation framed as a national-security threat (the OSTP memo), legislation to sanction model-extraction attacks (DAAMTA), a voluntary but consequential pre-release review regime run through the NSA (the June 2 executive order), and a willingness to take specific models offline via Commerce directives (Fable 5 and Mythos 5). A federal scientific super-platform (Genesis) is being built with explicit Manhattan Project framing, though aimed at science rather than chatbots. The distillation conflict with Chinese labs is real, large, and escalating, even as its framing is hotly contested and the underlying technique is industry-standard. And underneath all of it, a tiered global landscape is forming: a gated enclave at the top, a booming public-cloud frontier in the middle, and a sovereignty-driven on-prem movement spreading outward, accelerated rather than suppressed by American gating.

What is not established fact is the grandest claim — that this all reflects a coherent, successful plan to ensure artificial general intelligence happens only inside an American vault. The security state’s instinct to contain is real. But the labs are litigating against that containment; the flagship export order is being challenged in court; the most capable public models are being sold to the entire world for tens of billions of dollars a year; and the rest of the planet is busily building the alternative. A monopoly strategy is visible in the rhetoric. A monopoly is not visible in the facts.

The outrage that opened this piece — they gated the model I paid for, and I don’t trust the reason — is not irrational. It is just aimed at the wrong frame. The model was not withheld out of greed, and it was not withheld on a whim. It was withheld because, somewhere in the last eighteen months, a critical mass of people in Washington came to believe that a sufficiently capable model is less like a software release and more like a weapon: something whose proliferation is itself the danger, regardless of who is holding it or why. You can think that belief is correct, or paranoid, or self-serving, or all three at once. But you cannot understand a single one of these news stories until you accept that the belief is now policy.

The AGI Manhattan Project, if that is what this becomes, will need no desert and no mushroom cloud. It runs on data centers, classified benchmarks, and export licenses — and Washington decided the secret was too dangerous to share long before most of us noticed it was being built.

What to Watch Next

This story is mid-flight, and several of its load-bearing pieces are unresolved. A handful of concrete inflection points will determine whether the non-proliferation turn hardens into permanent architecture or softens back toward the old open escalator.

The August 1 deadline and the meaning of “covered frontier model.” The June 2 executive order set a 60-day clock, with key deliverables due by August 1, 2026 — including the classified benchmarking process that decides which systems qualify for review. The single most consequential undefined term in the entire framework is “covered frontier model.” Watch whether the NSA draws that threshold narrowly, capturing only a handful of genuinely cyber-capable systems, or expansively, in a way that pulls ordinary commercial releases into the government’s orbit. The whole practical weight of the order rides on where that line lands.

Whether courts will second-guess a national-security export order. Legion LegalTech’s suit against the Commerce Department is the first real test of whether a judge will enjoin a Bureau of Industry and Security directive issued on national-security grounds. If the company wins even a preliminary injunction, the executive’s “voluntary” framework loses much of its hard edge and every future shutdown becomes litigable. If the court defers to the executive — the historically likely outcome in national-security cases — then “voluntary” effectively means “voluntary until Commerce says otherwise.”

DAAMTA’s path, or its quiet death, in the Senate. The model-theft bill cleared House Foreign Affairs but now faces the legislative graveyard that swallows most China-focused bills before they reach a floor vote, with Senate jurisdiction running through Banking, Housing, and Urban Affairs. Watch whether it gets folded into a must-pass vehicle such as the annual defense authorization, which is how this kind of measure usually survives — or whether it stalls and the distillation fight stays a matter of executive action rather than statute.

Anthropic’s two-front war and its march to the public markets. The same company asking the Senate to shield it from distillation is separately suing the Pentagon over a supply-chain risk designation, all while reportedly preparing a public listing that could arrive as early as October 2026. Watch how a company headed for an IPO roadshow reconciles that posture — petitioning Washington for protection with one hand while litigating against it with the other — and whether the unresolved disputes start to spook the enterprise customers who have already raised concerns.

Fable 5 and Mythos 5 — restored, and on what terms. Anthropic has reportedly begun restoring some access under nationality-based controls and additional screening. Watch whether gated, identity-verified access becomes the permanent template for every top-tier release going forward — a structural change to how frontier models reach the public — or whether the restrictions get rolled back as a one-off response to a specific scare.

CADA’s trilogue and whether the sovereignty model spreads. The EU’s Cloud and AI Development Act now enters negotiation between the Council and Parliament, with industry groups already calling its strictest tiers discriminatory and some member states pushing for an even harder line. Watch whether the four-level sovereignty framework survives largely intact, and whether other blocs — in Asia, the Gulf, and beyond — copy the template, accelerating the fragmentation that American gating helped set in motion.

The next distillation disclosure. The government committed to sharing threat intelligence with U.S. labs about foreign extraction campaigns. Watch whether that coordination actually materializes, and whether the next publicly named target escalates the confrontation further — each disclosure so far has been larger and more prominent than the last.

Track those seven, and you will be reading the real story as it is written — not the version filtered through outrage over a model that disappeared.

Addendum, June 29, 2026: The Second Shoe Drops

Signing The “Voluntary” Government Contract — Image by Gemini

The gating of Anthropic’s Fable 5 on June 12 read, at the time, like a single dramatic episode rather than a pattern. Three days later, a second case arrived.

On June 26, OpenAI previewed a new flagship family, GPT-5.6, in three tiers — Sol, Terra, and Luna. It did not launch the way models used to. OpenAI made the family available only to a limited preview of roughly twenty organizations whose participation was disclosed to the U.S. government, with general availability promised “in the coming weeks.” The company has been candid about why: at the government’s request, it began with vetted partners before any broader release, and reporting indicates the request came through the Office of the National Cyber Director and the Office of Science and Technology Policy, with the Commerce Secretary among those advising against an unrestricted launch. By some accounts, access during the preview is being approved on a customer-by-customer basis. All three tiers — not just the flagship — were classified at a “High” risk level for both cyber and biological-chemical capability. The mechanism is explicitly tied to the same June 2 executive order discussed above, and to the classified benchmarking framework that comes due in August.

A second frontier lab being gated changes the weight of the underlying claim considerably. What was one incident is now a pattern, and the pattern has reached the market leader by consumer reach. The idea that the pre-release escalator now has a gate at the top — operated by the security state rather than the labs — is no longer an inference drawn from a single event; it describes how two of the three leading American labs shipped their most capable models within the same month. The observation that “voluntary” is a softer word than it sounds also holds up: a customer-by-customer approval process is not what a voluntary framework usually looks like in practice, even when no statute compels it.

The new evidence does not, however, support the more sweeping reading that has gained traction elsewhere: that this is all proceeding according to a plan, that a leading safety-focused lab engineered the slowdown to secure a permanent monopoly, and that frontier labs secretly want the cage and will soon withdraw capability from the public entirely. The GPT-5.6 episode has been cited as confirmation of that reading. It is closer to the opposite. OpenAI used its own launch announcement to say, in effect, that it disagrees with the arrangement — that this kind of government-access process should not become the long-term default, because it keeps the best tools from the users, developers, and defenders who need them, and that it views the restriction as a short-term step rather than a new standard. A lab objecting in public, on the record, at the moment of launch belongs alongside Anthropic suing the government over the Fable 5 order and the Pentagon supply-chain designation. Together these behaviors describe friction rather than a coordinated handoff of power: a security apparatus reaching for control, and a set of companies that resent the reach even when they comply with it.

A further distinction is worth preserving, since much of the surrounding commentary has collapsed it. There is a meaningful difference between a model being staggered and a model being withheld. GPT-5.6 was previewed, not confiscated; general availability was planned for weeks out, and the government reportedly signaled support for the broader release barring problems in further testing. “You will never get it” and “you will get it after a vetting window” are not the same claim, and the space between them separates the more sensational readings from the documented one. The durable concern is narrower: an opaque, ad-hoc, capability-by-capability approval process is becoming the normal path to release, with no published criteria, no statutory basis, and no equivalent brake on the open-weight labs abroad that face none of it. That concern is legitimate and shared well beyond the loudest voices, and the GPT-5.6 preview makes it more pressing rather than less.

The underlying pattern holds, and the details sharpen it in one direction: the structural shift is real and accelerating, while the temptation to narrate it as a single actor’s master plan should be resisted precisely because the actors keep, visibly, fighting each other and the state. The Manhattan Project comparison concerns how a technology gets governed, not who secretly wins.

The August benchmarking deadline is where the arrangement either acquires published rules or hardens into permanent discretion.

Addendum, July 2, 2026: Blueprint, Not Manhattan Project

Fable 5 and Mythos 5 are back. Anthropic restored global access to Fable 5 on July 1 and access to Mythos 5 for a set of US organizations, after export controls that took both offline on June 12 were lifted on June 30. Anthropic’s own account of what happened changes the shape of the underlying story.

The trigger was smaller than the response to it. The export order followed an Amazon research report describing a way to prompt Fable 5 into identifying software vulnerabilities and, in one case, producing exploit code. Anthropic’s testing afterward found that Opus 4.8, GPT-5.5, and Kimi K2.7 could identify the same vulnerabilities, and that nearly every model tested, including several older Claude versions, could reproduce the single exploit demonstration. The company says the behavior exposed no capability unique to the Mythos tier — a jailbreak had simply reached into a deliberately over-cautious safety margin. A three-week global shutdown traced back to a technique that ordinary, already-public models could largely match.

The fix arrived faster than the politics did. A retrained safety classifier now blocks the reported technique in more than 99 percent of cases, independently reviewed by the Commerce Department’s Center for AI Standards and Innovation, within roughly two weeks. The export control itself took until June 30 to lift, and Mythos 5’s US restoration followed a separate government approval on June 26. Engineering solved the problem well before the government agreed to stand down.

The more consequential shift is structural. Anthropic has committed to giving designated government partners early access to future models that materially advance frontier capability in security-relevant areas, to sharing new safeguards and threat intelligence as they are developed, and to dedicating staff and compute to joint government research. It is co-authoring, with Amazon, Microsoft, and Google, a scoring framework for jailbreak severity, weighing how much capability a technique grants beyond existing tools, how many offensive tasks it unlocks, how easily it converts into a working attack, and how easily it spreads once discovered. Anthropic explicitly asks for the arrangement to be codified in strong regulation and applied equally across frontier developers. OpenAI, days earlier, had said the opposite: that government-gated release should not become the norm. The same week, under the same executive order, the two leading labs staked out opposite positions on whether this should end or become permanent.

That disagreement points to the real question underneath both incidents: what kind of arrangement is actually forming between Washington and the frontier labs. Two models are available for comparison, and the shape now emerging resembles neither cleanly.

The Manhattan Project model means direct government ownership and operational control — the state sets the objective, contractors execute to government specification, the output belongs to the government, and no separate commercial market exists for the product. Little of that describes Anthropic or OpenAI. Both remain private, for-profit, competing companies selling subscriptions and API access to the public at tens of billions of dollars a year. Both have, at different moments, resisted government direction outright: Anthropic in court over a Pentagon supply-chain designation, and a customer of OpenAI’s comparable arrangement suing over the Fable 5 export order. A Manhattan Project does not get sued by its own contractors, and its output is not something ordinary subscribers pay ten dollars a month to use.

The closer analogue is the model China has applied to its own technology champions for a decade: nominally private, commercially competitive, market-facing firms that are simultaneously subject to continuous state oversight — licensing requirements, data and export controls, alignment with national strategic priorities, and a standing government ability to intervene in specific products or decisions without taking ownership of the company. Alibaba and Tencent still compete, still list shares, still chase revenue, while operating under a government that redirects their behavior when it judges the stakes high enough. That is the closer structural match for what is now on the record in the United States: independent, sometimes adversarial companies fully exposed to the open market, layered under a government that reserves the right to review, delay, or shut down specific releases in the name of national security — and that is now working with those same companies to make that reserved right permanent and procedural rather than ad hoc.

The distinction matters because the two models fail differently. A Manhattan Project’s core risk is that the technology stays locked away forever, available only to the state that built it. A state-guided industrial policy’s core risk is different: the companies keep innovating and selling on the open market, but which products reach that market, on what timeline, and under whose review becomes a standing point of negotiation — with the state holding more leverage each time a company needs it to lift an order. Anthropic’s request to codify the current arrangement into law is a request to settle that negotiation permanently in the state’s favor, through published rules rather than case-by-case discretion. Whether it produces a narrow, appealable standard or a wide standing discretion with better paperwork is the question the arrangement itself has yet to answer.

A related contest over whose safety standard becomes the government’s reference point predates both June incidents and runs alongside them. Project Glasswing launched in early April with Claude Mythos Preview and a roster of launch partners that included Amazon, Apple, Google, Microsoft, JPMorgan Chase, NVIDIA, Cisco, CrowdStrike, and Palo Alto Networks. OpenAI answered a month later with Daybreak, built around a security-specialized version of GPT-5.5 and its own partner program, widely described at the time as a direct response to Glasswing. Three of Daybreak’s partners — Cisco, CrowdStrike, and Palo Alto Networks — also sit inside Glasswing, running both programs simultaneously. OpenAI does not appear among the companies co-authoring Anthropic’s jailbreak severity framework; rather than sitting outside the coordination effort, it built a rival one.

Microsoft’s position cuts against any clean story of OpenAI’s exclusive cloud partner backing it against a unified Anthropic coalition. Microsoft is a named Glasswing launch partner in its own right, standing behind the framework built by the company its primary AI partner is competing against. Nor is the relationship between the two labs purely adversarial. In December 2025, Anthropic and OpenAI co-founded the Agentic AI Foundation together with Google, Microsoft, Amazon, and others, donating core agent-interoperability protocols — Anthropic’s Model Context Protocol and OpenAI’s AGENTS.md — to a neutral, jointly governed home under the Linux Foundation. Rivalry over who sets the cybersecurity standard and cooperation on adjacent infrastructure are running in parallel, not in sequence.

Whether either company could use its market position to steer eventual government policy toward its own framework and away from the other’s is a live question, and each has an obvious incentive to try: Anthropic through a consortium spanning three of the largest cloud providers, OpenAI through a rival consortium sharing several of the same enterprise security partners. What the record does not yet show is capture by either side. The Department of Commerce and the National Cyber Director’s office are still the ones who will decide what qualifies as a covered frontier model and which severity framework, if any, becomes the government’s reference point. Two competing candidate standards, built by companies that also sit on the same nonprofit board when the subject is agent protocols rather than jailbreaks, describes the current state more accurately than either company having already won.

Works Cited

1. The White House, “Launching the Genesis Mission,” November 24, 2025. https://www.whitehouse.gov/presidential-actions/2025/11/launching-the-genesis-mission/
2. U.S. Department of Energy, “Energy Department Launches ‘Genesis Mission’ to Transform American Science and Innovation Through the AI Computing Revolution,” 2025. https://www.energy.gov/articles/energy-department-launches-genesis-mission-transform-american-science-and-innovation
3. Institute for Law & AI, “The Genesis Mission Executive Order: What It Does and How it Shapes the Future of AI-Enabled Scientific Research,” February 2026. https://law-ai.org/the-genesis-mission-executive-order-what-it-does-and-how-it-shapes-the-future-of-ai-enabled-scientific-research/
4. CSIS, “The Genesis Mission: Can the United States’ Bet on AI Revitalize U.S. Science?,” February 9, 2026. https://www.csis.org/analysis/genesis-mission-can-united-states-bet-ai-revitalize-us-science
5. Morrison Foerster, “Executive Order Establishes ‘Genesis Mission’ to Accelerate AI-Driven Scientific Discovery,” December 11, 2025. https://www.mofo.com/resources/insights/251211-executive-order-establishes-genesis-mission
6. The White House, “Promoting Advanced Artificial Intelligence Innovation and Security,” June 2, 2026. https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/
7. Holland & Knight, “Executive Order on Artificial Intelligence Expands Cybersecurity, Federal Oversight,” June 2026. https://www.hklaw.com/en/insights/publications/2026/06/executive-order-on-artificial-intelligence-expands-cybersecurity
8. Skadden, Arps, Slate, Meagher & Flom LLP, “New AI Executive Order Calls for Frontier Model Security, Early Government Access and AI-Enabled Cyber Defense,” June 2026. https://www.skadden.com/insights/publications/2026/06/new-ai-executive-order
9. A&O Shearman, “Trump Administration Issues Executive Order on AI and Cybersecurity,” June 2026. https://www.aoshearman.com/en/insights/trump-administration-issues-executive-order-on-ai-and-cybersecurity
10. Crowell & Moring LLP, “Executive Order Creates Voluntary Regulatory Regime of Frontier AI Models,” June 2026. https://www.crowell.com/en/insights/client-alerts/executive-order-creates-voluntary-regulatory-regime-of-frontier-ai-models
11. Wiley, “New AI Executive Order Addresses Frontier Models and Cybersecurity Vulnerabilities,” June 2026. https://www.wiley.law/alert-New-AI-Executive-Order-Addresses-Frontier-Models-and-Cybersecurity-Vulnerabilities
12. U.S. Congress, H.R. 8283 — “Deterring American AI Model Theft Act of 2026,” 119th Congress, introduced April 15, 2026. https://www.congress.gov/bill/119th-congress/house-bill/8283/text
13. Congressional Budget Office, “H.R. 8283, Deterring American AI Model Theft Act of 2026,” May 28, 2026. https://www.cbo.gov/publication/62480
14. Center for Data Innovation, “The United States Needs a Strategic Response to Adversarial AI Distillation,” June 2026. https://datainnovation.org/2026/06/the-united-states-needs-a-strategic-response-to-adversarial-ai-distillation/
15. CNBC, “Anthropic joins OpenAI in flagging ‘industrial-scale’ distillation campaigns by Chinese AI firms,” February 24, 2026. https://www.cnbc.com/2026/02/24/anthropic-openai-china-firms-distillation-deepseek.html
16. The Next Web, “Anthropic accuses Alibaba of running largest distillation campaign against Claude,” June 2026. https://thenextweb.com/news/anthropic-accuses-alibaba-distillation-claude-qwen
17. Tom’s Hardware, “Anthropic claims that China’s Alibaba used 25,000 fake accounts and 28.8 million exchanges to illicitly ‘distill’ its Claude model,” June 2026. https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropic-claims-that-chinas-alibaba-illicitly-distilled-its-models-from-april-to-june-2026-says-effort-involved-25-000-fake-accounts-and-28-8-million-exchanges-on-claude
18. Global Times, “Anthropic’s ‘distillation’ claims against Chinese firm lack substance, rooted in tech hegemony anxiety: Chinese expert,” June 25, 2026. https://www.globaltimes.cn/page/202606/1364418.shtml
19. Startup Fortune, “Anthropic’s distillation problem reveals that export controls alone cannot hold the line in the US-China AI race,” June 2026. https://startupfortune.com/anthropics-distillation-problem-reveals-that-export-controls-alone-cannot-hold-the-line-in-the-us-china-ai-race/
20. VentureBeat, “Anthropic says it hit a $30 billion revenue run rate after ‘crazy’ 80x growth,” May 8, 2026. https://venturebeat.com/technology/anthropic-says-it-hit-a-30-billion-revenue-run-rate-after-crazy-80x-growth
21. PYMNTS, “Anthropic Hits $30 Billion Run Rate as Enterprise Demand Accelerates,” April 7, 2026. https://www.pymnts.com/artificial-intelligence-2/2026/anthropic-hits-30-billion-run-rate-as-enterprise-demand-accelerates/
22. Anthropic, “Anthropic raises $30 billion in Series G funding at $380 billion post-money valuation,” 2026. https://www.anthropic.com/news/anthropic-raises-30-billion-series-g-funding-380-billion-post-money-valuation
23. Remio, “Anthropic Revenue Just Passed OpenAI. The Growth Rate Is the Real Story,” April 27, 2026. https://www.remio.ai/post/anthropic-revenue-just-passed-openai-the-growth-rate-is-the-real-story
24. European Commission, “Proposal for the Cloud and AI Development Act (CADA),” June 3, 2026. https://digital-strategy.ec.europa.eu/en/library/proposal-cloud-and-ai-development-act-cada
25. European Commission, “Cloud and AI Development Act” (policy page). https://digital-strategy.ec.europa.eu/en/policies/cloud-and-ai-development-act
26. Hogan Lovells, “The EU’s Cloud and AI Development Act (CADA): Towards a sovereignty-focused framework for cloud and AI services,” June 2026. https://www.hoganlovells.com/en/publications/the-eus-cloud-and-ai-development-act-cada-towards-a-sovereigntyfocused-framework-for-cloud
27. Covington (Global Policy Watch), “EU Tech Sovereignty Package,” June 4, 2026. https://www.globalpolicywatch.com/2026/06/eu-tech-sovereignty-package/
28. Euronews, “EU’s cloud and AI development act gets mixed reception,” June 22, 2026. https://www.euronews.com/next/2026/06/22/eus-cloud-and-ai-development-act-gets-mixed-reception
29. The Next Web, “Legion LegalTech sues US over Anthropic Fable 5 and Mythos 5 shutdown,” June 2026. https://thenextweb.com/news/legion-legaltech-sues-us-anthropic-access
30. Techstrong.ai, “AI Startup Sues U.S. Government After Order Forces Anthropic to Block Foreign Engineers,” June 2026. https://techstrong.ai/articles/ai-startup-sues-u-s-government-after-order-forces-anthropic-to-block-foreign-engineers/
31. TechSpot, “Startup sues US government for blocking access to Anthropic’s Fable 5 AI model,” June 2026. https://www.techspot.com/news/112880-startup-sues-us-government-blocking-access-anthropic-fable.html
32. Let’s Data Science, “Legion sues U.S. over lost access to Anthropic models,” June 2026. https://letsdatascience.com/news/legion-sues-us-over-lost-access-to-anthropic-models-2e697bd4
33. OpenAI, “Previewing GPT-5.6 Sol: a next-generation model,” June 2026. https://openai.com/index/previewing-gpt-5-6-sol/
34. VentureBeat, “OpenAI unveils GPT-5.6 Sol, Terra and Luna models — but only accessible to limited preview partners for now, per US Gov,” June 2026. https://venturebeat.com/technology/openai-unveils-gpt-5-6-sol-terra-and-luna-models-but-only-accessible-to-limited-preview-partners-for-now-per-us-gov
35. Axios, “OpenAI releases powerful new GPT-5.6 model under restrictions,” June 26, 2026. https://www.axios.com/2026/06/26/openai-gpt-sol-terra-luna-trump
36. The Hacker News, “OpenAI Limits GPT-5.6 Rollout as Sol Previews With Stronger Cyber Safeguards,” June 2026. https://thehackernews.com/2026/06/openai-limits-gpt-56-rollout-as-sol.html
37. CybersecurityNews, “OpenAI Released GPT-5.6 Sol With Limited Access and Strong Cyberattack Protections,” June 2026. https://cybersecuritynews.com/gpt-5-6-release/
38. Anthropic, “Claude Fable 5 and Mythos 5 redeployed,” July 1, 2026. https://www.anthropic.com/news/redeploying-fable-5
39. Anthropic, “Project Glasswing,” April 2026. https://www.anthropic.com/project/glasswing
40. Cybersecurity Dive, “OpenAI launches Daybreak to combat cyber threats,” May 11, 2026. https://www.cybersecuritydive.com/news/OpenAI-Daybreak-cyber-threats/820122/
41. Memeburn, “OpenAI Models and Codex Are Now Generally Available on AWS, and Daybreak Is Next,” June 2026. https://memeburn.com/openai-models-and-codex-are-now-generally-available-on-aws/
42. Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF),” December 9, 2025. https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation

A note on sourcing and certainty: The distillation figures attributed to DeepSeek, Moonshot AI, MiniMax, and Alibaba’s Qwen are allegations made by Anthropic in public statements and in correspondence to the U.S. Senate; they have not been independently verified, and the named companies dispute them. Revenue run-rate figures are company-reported and the subject of an active accounting dispute between Anthropic and OpenAI. DAAMTA and the EU’s CADA are legislative proposals that had not become binding law as of late June 2026. Readers are encouraged to follow the primary sources above.