The Good, the Bad, and the Ugly

THE NUMBER: 48 — the hours between the United States government pulling Claude Fable 5 off the market on national-security grounds and China shipping GLM 5.2, an open and unfiltered model that took the #1 spot on the bench, beating the model we’d just locked in a vault, at a tenth of the cost and three hundred tokens a second. Two days. That’s the entire half-life of an American AI containment strategy in 2026. Forty-eight hours is also exactly long enough to learn the lesson the whole episode is screaming: capability is a rental, and the only thing worth owning is the ground under your own feet.

There’s a moment at the end of Sergio Leone’s The Good, the Bad and the Ugly that runs almost five minutes with barely a word spoken. Three men stand in a circular graveyard, the Sad Hill cemetery, each at a point of a triangle, every hand hovering near a holster. Tuco, Blondie, Angel Eyes. The camera cuts faster and faster between their eyes, their hands, the iron, the dust. Nobody can move first, because the man who draws gets shot by one of the other two. The whole crisis is a problem of position and trust, and it holds, unbearably, until it breaks.

That’s the picture I couldn’t get out of my head this weekend, because the AI business just walked into exactly that graveyard, and the wonderful, maddening thing is that you cannot tell who’s who.

🪦 Nobody Knows Who’s Who

Start with what happened, because the facts are stranger than any take on them.

On Friday the US government issued an export-control directive — the first one ever aimed at a large language model — ordering Anthropic to suspend all access to Fable 5 and Mythos 5 for any foreign national, inside the country or out, including Anthropic’s own foreign-national employees and H-1B workers sitting at desks in California. Anthropic complied by taking the models down worldwide. The best model the public had ever touched, released Tuesday, gone by the weekend. Then Saturday, China’s Zhipu shipped GLM 5.2, open-weights and unfiltered, and by Sunday it sat at the top of the BridgeBench leaderboard, past the model America had just declared too dangerous to export, at a fraction of the price.

Now try to assign the roles. From the White House chair, Anthropic is the Ugly — Tuco, the operator who won’t play straight, who builds a cyber-capable model, brands it a weapon, asks to be regulated, and then refuses to fix it when asked. From the coder’s chair, Washington is the Bad — Angel Eyes, the suit who’ll brick your entire stack over a soundbite and an election cycle. And from Beijing’s chair, both of them are Tuco, digging frantically in the wrong grave while China strolls off with the gold. Pick your seat, pick your villain. The roles won’t sit still, and that is not a flaw in the story. That is the story. Nobody at this grave knows who’s digging and who’s getting buried, and if we’re honest, neither do we.

What we can do is read the board the way we’d read any standoff: figure out who actually loses as the clock runs, and figure out what’s still worth owning when the shooting stops.

🔫 The Gun Everyone’s Fighting Over Is a Rental

Here’s the part the meme accounts blew right past, because it’s less fun than a thought-police panic.

The ban did not expose a weakness in Anthropic. It exposed that capability stopped being worth anything you can defend. For a year — and this newsletter was as guilty as anyone — the industry treated the frontier’s last ten percent of model quality as the crown jewel, the thing worth guarding, the moat. On Wednesday we wrote Buy Wins, Not Players and told you to look at the flags on the minimills, the cheap open models collapsing the price floor, and to notice that most of them were Chinese. We did not expect the point proven this hard, this fast.

Because watch the mechanism. Bottle the single best American model under national-security authority, and the floor refills from Shenzhen inside a weekend, cheaper, with no filter at all. You cannot export-control your way out of a math problem. The capability the government just tried to lock in a vault is, by the nature of the technology, reproducible by anyone with enough compute and good data, and China has both. GLM 5.2 at a tenth of Fable’s cost is not a fluke. It’s LLMflation doing what it has done every quarter — constant-capability intelligence falling roughly ten times a year — except this time the deflation arrived as a geopolitical event instead of a pricing footnote.

So the most capable model in America became, for a weekend, the least available one, while its Chinese rival became the most. If your business plan depended on owning the fastest gun in the room, the room just informed you that the gun is a rental, the rental company answers to people you didn’t vote for, and there’s a competitor handing out the same iron for free across the street. The frontier still matters — it’s the conveyor belt that decides what enters the realm of the possible. But the conveyor belt is not a moat. It’s a process, and processes get cheaper.

⚖️ Claiming the Pen

Which brings us to the one man in this who seems to know exactly which grave he’s standing on.

The administration’s demand, as best anyone can reconstruct it, was simple: patch the jailbreak or we pull the model. Dario Amodei said no. And the reason that “no” matters is that it rhymes with the last one.

In February, Defense Secretary Pete Hegseth gave Anthropic a Friday deadline to open Claude for unrestricted military use — “all legal purposes” — or be branded a supply-chain risk and hit with the Defense Production Act. Anthropic said it “cannot in good conscience accede.” It refused. In March the Pentagon made good on the threat, designated Anthropic a supply-chain risk for the first time ever applied to a US AI company, moved to cut it off from federal contracts, and Anthropic responded by suing the Pentagon. A defense official went on record calling Amodei a “God-complex” case. That fight is still in court.

So this is not a man who folds when the state leans on him. Twice in four months he has told Washington the same thing, in effect: the intelligence is ours, and we decide what it’s for. Not your weapon to point at people. Not your model to edit on a Friday deadline because a partner found a hole. He is claiming the pen — the right to draw the line on what this technology does — and he is paying cash for it, a Pentagon contract last quarter and a flagship model this week.

Now, the loudest account of the takedown came from David Sacks, the administration’s AI czar, in a Saturday post that did seven million views. Read it, but read it knowing the source. Sacks tells it cleanly: a “highly credible trusted partner of both Anthropic and the USG” — read Amazon — found a jailbreak of Fable’s guardrails that turned it back into unfiltered Mythos, the admin asked Dario to fix it or pull it, Dario refused, and so the government acted. His kicker is that Anthropic “itself widely promoted the idea that Mythos was a cyberweapon and needed to be regulated,” and is now “at odds with their branding” by refusing to cooperate. The door, he says, is open: fix it and Fable comes back.

It’s a tidy story, and Sacks is not a neutral narrator. Two days earlier he posted that “about eight months ago I warned that Anthropic is running a sophisticated regulatory-capture strategy based on fear-mongering.” The man has had Anthropic in his sights since last fall. His scoop is a move, not a deposition. Set it next to Anthropic’s own statement, which did eighty-seven million views and framed the directive as the overreach, and next to the working press — Every’s Dan Shipper read the same facts as “a misunderstanding that won’t last.” Three narrators, three scripts. The honest issue holds all three up. The disagreement is the news.

And there’s a detail in the contradiction worth sitting with. Sacks wants you to see hypocrisy: doom-mongered the model, then shrugged at the breach. But those are two different claims. “Frontier models will have dangerous capabilities and we need a regime ready” is about the category. “This specific jailbreak is a manageable risk, not a five-alarm fire” is about the incident. A company whose entire doctrine is deploy with mitigations, and mitigations are imperfect by design can hold both without blinking. The genuinely strange move isn’t the shrug. It’s the refusal to patch. And the cleanest read of that refusal is the one Sacks would never print: you don’t refuse to fix your own model unless either you can’t fix it on their clock, or the standoff itself is worth more to you than the running model. I think it’s both, and I think the second is the whole game.

💰 Cui Bono

When a model this good gets pulled three days after launch and a week before its maker’s IPO, you don’t ask whether it’s strategy. You ask who gets paid. Donald Sutherland’s character in JFK sat on a park bench and reduced an entire assassination to two words. Who benefits.

OpenAI benefits, cleanly. Anthropic’s flagship goes dark, Codex becomes the obvious place to run, and Shipper himself published a graph of his own usage flipping from Claude to Codex in a single day. That happened mid-S-1. OpenAI filed confidentially at an $852 billion valuation while posting a negative 122 percent operating margin — it loses a dollar twenty-two on every dollar of revenue — and is reportedly prepping drastic price cuts to fight Anthropic. A competitor’s week-long outage is the best marketing OpenAI could never buy.

Elon benefits. Anthropic still rents compute in his orbit, the frontier race slows, and “Grok is maximally truthful” lands a little harder when your rival just got branded a cyber-liability by the US government. Meanwhile SpaceX closed its first public trading day near $2.1 trillion, the first of the great IPO wave to actually price, with an orbital data-center satellite as its set piece. He’s having a good month.

The harness and routing crowd benefit most of all. Every shop that already routes across open and frontier models, with its data in infrastructure it controls, didn’t feel a thing on Friday. The ones who got the fire drill are the ones who welded their business to a single API.

Amazon is the interesting one. The reflex is to say Anthropic’s $8 billion backer wouldn’t kneecap its own portfolio company. But Amazon doesn’t need Anthropic to win the frontier outright. It needs Anthropic embedded in Bedrock, burning Trainium, one model among many it brokers. A world where “the frontier is a dangerous, revocable liability” is a world that pushes every enterprise toward exactly the diversified, Amazon-intermediated posture AWS sells. And being the partner the government calls to test models makes Amazon the security auditor of record, a moat no marketing budget buys. Per Fortune and Politico, it was Andy Jassy who flagged the jailbreak to the White House after Amazon researchers pulled restricted cyber-capabilities out of the model. Semafor adds that the government suspected a Chinese-linked group had already used the same exploit — a claim Anthropic disputes, noting it blocks access from China. Whoever’s right, Amazon’s fingerprints are on the match. The benefit is real and double-edged: ratting out your own investment is a strange flex with every future founder watching.

And China, of course. A 48-hour clapback that tops the leaderboard is the best argument Beijing could make that American self-restraint is a gift.

🧭 A Man for All Seasons

So why would a winning company want its best model pulled and then lapped by an open Chinese model, on the eve of a triumphant IPO?

The romantic answer is four-dimensional chess. I don’t buy it. Deliberately provoking a global ban days before a roadshow is a catastrophic, unhedgeable bet, and companies winning this cleanly rarely light a fire this size on purpose. The simplest story that fits two refusals in four months, both eaten at real cost, isn’t a scheme. It’s conviction. This is Thomas More in A Man for All Seasons — the man who won’t take the oath, and pays. There’s a thing Dario won’t do, twice now, and the price of not doing it this week happens to be Fable.

But I won’t walk him all the way to sainthood, because here’s where conviction and strategy stop being different things. The one moat that survives a commoditizing market isn’t capability — GLM just proved capability rents for a tenth. It’s trust. And you cannot buy “the company that sued the Pentagon rather than build autonomous weapons.” Every time Dario refuses the state in public and bleeds for it, he mints the only differentiator a frontier lab has left. For this company, principle and positioning are the same vector, which is exactly why it’s so hard to read and so effective. The martyrdom is the marketing.

There’s a darker version I can’t rule out, and neither can you. Maybe he won’t patch because he can’t. If Fable’s guardrails aren’t a removable layer, if the underlying Mythos capability bleeds through and the jailbreak is the nature of the thing rather than a bug, then “refuse to patch” actually means “we cannot honestly promise to contain this,” and pulling it is the only move that isn’t a lie. The defiance narrative is a far kinder look than the truth: the safety company shipped something it can’t fully cage. Everyone skips this read because everyone assumes the company whose whole brand is control is, in fact, in control.

Either way the conclusion holds, and it’s the unsettling part. If the safety company’s deepest moat is its willingness to be martyred by the state, then it is quietly incentivized to keep picking fights it loses in public. We should expect more of these, not fewer. Forget the spies behind the curtain. The scarier version was always the one standing in the open, taking the hit on purpose.

🛠️ What You Actually Do Monday

Step out of the graveyard for a second, because there’s a real reader on the other end of this with a real business, and the practical news is calmer than the headlines.

How many people rebuilt their entire operation on a three-day-old Fable and woke up Saturday with a broken company? Roughly nobody. The shops that route across open and frontier models, with their data and business logic in a harness they own, didn’t notice. Shipper’s own graph is the proof — he switched primary models in an afternoon, frictionless, because the model was the rented part and his workflow was the owned part. We have been writing this prescription for two weeks. The ban is the fire drill that proves it. “Guarding the last ten percent” wasn’t just the wrong containment strategy for the country. It’s the wrong build strategy for you, and now both got demonstrated in the same news cycle.

This is the part that’s bigger than Anthropic. Isaacus, an Australian legal-AI firm caught in the blast radius, put it plainly: “any application depending on US-based LLMs is subject to being shut down at any moment,” and there was no forewarning. Mark Carney said the quiet thing for an entire hemisphere — US restrictions “underscore the risks of dependence.” The cloud taught us not to depend on a single vendor. This weekend taught us not to depend on a single country. Sovereignty stopped being an ideology and became a continuity-of-operations line item a CFO signs.

So before you trust any model vendor with anything load-bearing, answer these eight. If you can answer them cleanly, you don’t need us. If you can’t, that’s the conversation.

If your primary model vanished tomorrow with no notice, what percent of your workflows break — and do you know that number today, before the fire drill?
Who can turn this off? Name every party holding a kill switch: the lab, a government, an investor, your cloud host, a partner shipping a competing model.
Do your data, your prompts, your business logic, and your evals live in something you own — or inside the vendor’s walls where they leave when the vendor does?
Can you re-route a critical workload to a different model in an afternoon, or is your stack welded to one provider’s API and quirks?
For each workload, do you know the cheapest model that clears your quality bar — or are you paying frontier prices for commodity work because you never measured?
Where’s your jurisdiction risk? US vendor means export-control and political exposure for non-US users and staff. Offshore or open means the exposure runs the other way. Which are you carrying, and on purpose?
What’s your fallback for your three most critical workflows, and have you tested it under load — or is “we’ll switch if we have to” a hope rather than a plan?
When the vendor’s interests and yours diverge — on price, on access, on a government order — whose problem is that, and have you priced it like the counterparty risk it is?

That’s the exercise. None of it requires you to leave Anthropic, or to love or hate any player in the graveyard. It requires you to notice that in a standoff, the survivors aren’t the ones with the fastest gun. They’re the ones standing on ground they own.

Capability you rent by the token. The ground under your business you have to own.

Stop renting the gun. Start owning the ground.