The directive's predicate is what set the blast radius. The rule keyed on the nationality of the person making the request, inside or outside the United States, and it reached Anthropic's own foreign-national employees [3]. A rule shaped like that is not satisfiable by geofencing a region or freezing a tenant. It needs a per-request attribute that either exists in your identity graph or does not, and there is no HTTP header for citizenship. Anthropic had no reliable way to verify nationality in real time, so it suspended both models for everyone [4]. Deny-all is what that set logic produces when the attribute is unknowable at request time.
The timeline, as recounted in the dev.to essay "America Can Still Lose the A.I. Race to Itself," is worth laying out plainly. The directive landed at 5:21 p.m. Eastern on Friday, June 12 [1]. Controls stayed in force until June 30 [5]. Fable was restored globally on July 1 [6]. That is 18 days under controls and 19 days from directive to full restoration of the general-use model [1][2]. Mythos had government approval on June 26, four days before the controls lifted, and came back to a set of United States organizations rather than to everyone [7][3].
Correlation is the part worth putting in a design doc. Fable and Mythos shared the same underlying model, differing in safeguards and distribution: Fable shipped broadly with strong safeguards, Mythos went to a small group of defensive-cybersecurity partners with fewer [8]. One directive therefore removed both the general-use tier and the restricted tier. A second SKU from the same vendor was not a fallback here, because it was the same weights under a different policy wrapper.
The triggering finding was narrow. Amazon researchers prompted Fable past its safeguards to identify several software vulnerabilities and, in one case, to produce code demonstrating an exploit [10]. Anthropic's own account after the fact says less capable models could find the same vulnerabilities and that every other model it tested reproduced the single exploit demonstration, which it characterised as routine defensive-security work its safeguards had blocked out of caution [11]. Anthropic is the interested party in that reading, and the directive arrived with no published severity test and no disclosed threshold, with nothing between full availability and none [12]. The models went from released to globally unavailable in a few hours [13], after thousands of hours of pre-release red-teaming by Anthropic, the United States government, the United Kingdom's A.I. Security Institute and outside organisations [14]. The targeted classifier, tested by the Commerce Department's Center for A.I. Standards and Innovation [15], and the proposed common framework for judging jailbreaks [16], both arrive after the shutdown rather than before it.
Eighteen days is best treated the way you'd treat a vendor benchmark: a number measured on someone else's dependency. For it to transfer to yours, your request path has to name one frontier model, you have to lack a second vendor with comparable capability already evaluated, and the control has to key on a user attribute you cannot verify per call. In my context that means keeping the prompt and eval harness portable and one alternate provider warm, priced against 18 dark days. For internal tooling that premium is easy to skip. For a customer-facing request path it is much harder to justify skipping.
