Who Holds the Off Switch on Frontier AI?

Who really controls access to the frontier models that more and more organisations are now building on top of? And what happens the first time one of the parties holding that control actually decides to use it?

The past fortnight handed us a partial answer to both, and it is not a comfortable one. It showed how fast the supply can be choked.

Anthropic went first

Two weeks ago Anthropic released Claude Fable 5, a more tightly governed take on its Mythos model, and bolted on a new layer of restrictions. A few of those are easy to live with: it will not help you with hacking, it will not help you with bioweapons, and almost nobody is going to argue that those lines should not exist. One restriction, though, belongs in a different category altogether. You are no longer allowed to use the model to help build a rival large language model.

That is the one I struggle with. This whole field runs on work that was shared rather than hoarded: the papers, the benchmarks, the architectural ideas each lab borrowed from whoever published last. Anthropic has drawn on that openness as much as anyone.

So consider what the equivalent would look like elsewhere: a line in Microsoft's licence forbidding you from writing anything that competes with their products, or a Google that quietly degraded your search results the moment it suspected you of building a rival. The argument underneath the restriction, that it would be dangerous to let anyone else move the frontier forward, does not hold up well for me, least of all from a company whose own progress came from moving that same frontier forward on the back of everyone else's.

The way it was done made it worse. To begin with there was no announcement at all. If the system decided you were probing how these models work, it quietly made Fable 5 worse for you: thinner answers, degraded behind the scenes, with nothing to tell you it was happening. The backlash was loud enough that Anthropic backed down and undertook to say so in future whenever it deliberately holds the model back. Even now, though, it will not put its strongest models in front of people doing AI research.

Take the safety language away and what you are left with is a company using the vocabulary of safety to do the work of competition.

There is a knock-on effect here that worries me more than the row itself. A platform only holds together while the people building on it believe the rules will stay roughly where they are. You commit to a foundation on the assumption that it will still be standing, on familiar terms, a year from now. Changing the rules overnight, the restriction itself plus a new requirement to keep thirty days of usage data on anything that touches Fable, chips away at that assumption. The lasting damage is not really to Anthropic. It is to the idea that you can safely build a business on any single proprietary provider at all.

Then Washington went much further

If Anthropic turned the supply down, the government showed it could cut it off entirely.

It leaned on the powers the Commerce Department holds over anything that might count as a national security concern, and used them to put export controls on both Mythos and Fable. The scope is the striking part. Under it, anyone without US citizenship or a green card needed an export licence before they could go near either model, whether they were sitting in an office in California or on the other side of the world, and that caught Anthropic's own non-American staff. There was no clean way to comply, so the company took the only route that worked. It shut Fable down for everyone, in every country, at once.

Sam Altman, aiming the remark squarely at Anthropic, made the point more sharply than I would. The way he put it, more or less: there is something almost brilliant about a sales pitch that consists of telling the world you have built a bomb, warning everyone you are about to drop it on them, and then offering to sell them the shelter for a hundred million dollars. The flaw in selling fear that way is not a subtle one. Insist loudly and long enough that you have made something capable of catastrophe, and eventually the people who write export policy take you at your word and regulate the thing you described.

For what it is worth, my own view is that nothing Anthropic has released is anywhere near a bomb, and that putting export controls on Fable was the wrong call. But whether the controls were justified is almost beside the point now. The moment the US government reached for that lever, every other country watching, allies and rivals alike, learned something it will not forget: the access it assumed was its own can be taken away, fast, by people over whom it has no say. Governments that had been holding loose, theoretical conversations about AI sovereignty are now holding pointed ones about how to make sure the supply never gets interrupted.

An old pattern, a new subject

There is nothing novel about the dynamic; only the commodity has changed. For a long time most of the world was content to lean on a handful of large suppliers, the US and China chief among them, for big chunks of what it consumed, and that contentment held right up until the supply started to look vulnerable. The instant access feels at risk, the calculation flips, and whoever is exposed starts building their own version as fast as they can manage.

You can watch the mechanism run in both directions. When the US restricted China's access to advanced chips, a domestic industry that had been inching along for years suddenly found its urgency, and before long Chinese foundries were rolling out advanced processors they were not supposed to be able to build. It runs the other way too: each time China has squeezed the supply of rare earths and the critical minerals the West leans on, Washington and its allies have gone scrambling to stand up sources of their own. Dependence feels like the efficient choice right up until the day it feels like a liability.

We are now at that point with frontier AI, and it should not come as a complete surprise. The US had already circled the idea once: a rule drafted in early 2025 reached as far as the model weights themselves before it was pulled a few months later. What changed is that the cut-off has stopped being a draft and started actually happening, and it is no longer a thought experiment that access can be withdrawn, by a company or by a state, and withdrawn quickly. That fact alone changes the arithmetic for everyone on the outside, and it makes a serious investment in alternatives, open and self-hostable models included, look a good deal more sensible than it did a month ago. Building a frontier model from nothing is genuinely hard, so whether these efforts amount to much is an open question. But the incentive has shifted, and shifting incentives are what eventually move money.

What this means if you are building on top of it

Most organisations I talk to about AI are not worrying about export law or model sovereignty. They are worrying about the use case in front of them, which is fair enough. Even so, the last fortnight should change the calculation slightly.

The takeaway is not to panic, and it is certainly not to stop using the best models available. It is that concentration has stopped being a theoretical risk and become one you can actually see. If your plans rest on the assumption that one provider's strongest model will be there for you, on today's terms, for as long as you want it, that assumption has just been shown to be a choice rather than a guarantee.

The response is not complicated. It is the same discipline you would bring to any dependency you cannot afford to lose. Work out which parts of what you do would simply stop if a particular model vanished overnight. Keep your architecture loose enough that moving to another provider is an annoyance rather than a six-month project. Treat open or self-hostable models as a real option you keep ready to use, not a curiosity you will get around to later. None of that means giving up the tools that are clearly out in front. It means not staking the whole operation on the belief that the best tool will always pick up when you call.

Satya Nadella made a similar argument recently: that the thing worth protecting is a healthy, open layer of activity built on top of the frontier models, rather than leaving it in the hands of a few players who can wall it off whenever they choose. He is right. My hope is that this fortnight turns out to be a step in the right direction and not the opposite.

What I would prefer is something far more open than where we appear to be heading: findings that circulate instead of getting locked away, and a set of rules and habits level enough that nobody gets shut out of the race. If the past fortnight has an upside, it is honesty. Nothing about the fragility of the current arrangement is theoretical or hidden any more. It has been put in front of all of us, plainly, at the same time.