YOU CANNOT BAN MATH, SOFTWARE, OR PHYSICS
The US government moved to block the export of Mythos and Fable 5, with the government demanding that AI company Anthropic block all possible jailbreaks of its most advanced models. A US senator called for new controls on 3D-printed guns. British officials resumed their long campaign against end-to-end encryption. In India, amendments to IT rules require platforms to label AI-generated content and verify its synthetic origins; never mind that routine edits, compression, or screenshots strip the provenance signals needed to comply. Four different technologies, three different countries, the same instinct. The instinct is the problem.
Four stories, one pattern
Read the news on any given week and you are likely to find a regulator somewhere proposing to control a technology whose basic properties make that control nearly impossible. The four cases above span countries, parties, and decades of repeated failure. And they share a root cause that nobody in power seems willing to name.
This is not a partisan point. The AI export directive came from a US administration citing national security. The 3D-printer panic came from a Democratic senator. The encryption push came from a British prime minister. The Indian labeling mandate came from a government trying to make synthetic content traceable. The pattern crosses ideologies and continents because the problem is not ideology. It is a structural ignorance about how the technology actually works.
The stakes are not abstract. These are the systems that run your bank, your messages, your hospital records. When they get misregulated, they do not get safer. They get weaker.
Banning a model changes nothing
On June 9, 2026, Anthropic launched Fable 5 and Mythos 5, its most capable model family. Fable 5 is the public, consumer-facing version, with extra guardrails. Mythos 5 is reserved for select enterprise partners.
Three days later, at 5:21 PM ET on June 12, the US government issued an export control directive. Citing national security authorities, it ordered Anthropic to suspend all access to Fable 5 and Mythos 5 by any foreign national, inside or outside the United States, including foreign-national Anthropic employees. Because Anthropic could not reliably separate foreign users from the rest of its customer base in real time, the practical result was a worldwide shutoff of both models.
The government’s justification was a claimed jailbreak of Fable 5. A jailbreak is a prompt that makes a model bypass its safety rules. This one essentially consisted of asking the model to read a specific codebase and identify software flaws. Anthropic reviewed the demonstration and found it surfaced only a small number of previously known, minor vulnerabilities. The company also stated that other publicly available models, including OpenAI’s GPT-5.5, can produce the same output without any bypass at all.
“We disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people. If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.” — Anthropic, June 2026
Anthropic went further: “We suspect that perfect jailbreak resistance is not currently possible for any model provider.” If that is true, then the standard the government applied here, applied consistently, would block every frontier model from ever shipping.
The government saw it differently. David Sacks, co-chair of the President’s Council of Advisers on Science and Technology, said the administration had asked Anthropic’s CEO Dario Amodei to fix the jailbreak or take Fable 5 offline. He said the administration “issued this reluctantly” and was “very surprised that Anthropic hasn’t wanted to cooperate with a reasonable safety request.” Two sides, one technical fact: there is no known way to make a frontier model immune to all jailbreaks.
There is a defensive cost, and the government knew it. Mythos was very effective at finding cybersecurity vulnerabilities. Under Project Glasswing, a restricted US government program to find and fix flaws in critical software before attackers can exploit them, NSA Director Gen. Joshua Rudd disclosed that Mythos identified vulnerabilities in nearly all of the NSA’s classified systems within hours. Senator Mark Warner, one day before the ban, defended controls on exactly those grounds.
“It would have been irresponsible to not impose export controls on it.” — Senator Mark Warner, June 2026
But this is the trap. The same model that could help an attacker find vulnerabilities is the model a security team uses to find those vulnerabilities first and patch them. Restrict the model and you disarm the defenders along with the attackers. More than 100 cybersecurity executives, including Alex Stamos and Chris Wysopal, signed an open letter at freefable.org arguing the ban removes frontier models from defenders without justified risk.
And then the punchline. On June 28, 2026, sixteen days into the ban, Zhipu AI, a Chinese lab outside US jurisdiction, reported that its latest model comes close to Claude Mythos on security bug-detection benchmarks, the exact capability class the US government cited as justification for the export control. Zhipu’s GLM series has historically been open-sourced, meaning the capability the ban was designed to restrict could become freely downloadable by anyone, including every actor the ban was meant to exclude.
A ban on one model, in one country, does not remove the capability from the world. It removes it from the defenders who obey the law. The frontier moves fast. The capability the government tried to bottle up walked out the door in just over two weeks, through a lab the directive cannot reach.
The 3D printer that cannot be locked
In May 2013, Senator Chuck Schumer stood at a podium in his Manhattan office and described a future that frightened him. “A terrorist, someone who’s mentally ill, a spousal abuser, a felon can essentially open a gun factory in their garage,” he said. He was announcing support for a federal bill to extend the ban on undetectable firearms to cover 3D-printed guns and their components.
“A terrorist, someone who’s mentally ill, a spousal abuser, a felon can essentially open a gun factory in their garage.” — Senator Chuck Schumer, 2013
The fear is real. The proposed fix is not.
Think about how a 3D printer actually works. The printer does not understand what it is making. It follows instructions written in a language called G-code, plain-text commands like “move the print head to position X, Y, Z and extrude plastic.” You can open a G-code file in any text editor and read it. You can edit it by hand.
The software that turns a 3D model into G-code is called a slicer, and the most widely used slicers and firmware (the low-level software that runs the printer itself) are open source, meaning their source code is public and freely modifiable. Marlin, the most popular 3D printer firmware, is licensed under the GPL, a license that requires anyone who distributes the software to also share the source code. Klipper, another major firmware, runs on a general-purpose Linux computer, often a Raspberry Pi, and can be recompiled from source by anyone.
So imagine a rule that says every 3D printer must ship with software that detects and blocks gun parts. How would that even work? A slicer would need to analyze the shape of every object before printing and decide whether it is a gun component. But geometry is ambiguous. The trigger of a firearm and the trigger of a toy are the same shape. A barrel is a tube. A stock is a plastic shape. There is no simple technical filter that distinguishes a gun part from an ordinary object.
And even if someone built such a filter, it would run inside software that is open source. Anyone could read the code, find the filter, delete it, recompile, and print whatever they want. The open source nature of the stack is not a bug. It is the point. It cannot be recalled by a legislature.
A 2013 memo from the US Department of Homeland Security and the Joint Regional Intelligence Center put this more bluntly than any politician would. “Proposed legislation to ban 3D printing of weapons may deter, but cannot completely prevent their production,” the memo read. “Even if the practice is prohibited by new legislation, online distribution of these digital files will be as difficult to control as any other illegally traded music, movie or, software files.” That is the government’s own intelligence center saying the control cannot work.
The only way to actually stop 3D-printed gun parts would be to treat the printers themselves, and their components, like firearms. Regulate the nozzles, the control boards, the Raspberry Pis. That is a politically and economically catastrophic path, and everyone knows it, which is why nobody proposes it. They propose the software filter instead, because it sounds reasonable in a press conference, even though it cannot work.
The backdoor that breaks the lock
The third case is the oldest fight on this list, and the one with the most evidence stacked against it.
End-to-end encryption is the property of a messaging system where only the sender and recipient can read the message. The company running the service cannot read it. A court order cannot compel the company to decrypt the content, because the company does not hold the key. This is not a loophole. It is the entire design.
Regulators hate this. They want a backdoor, a second way in, reserved for law enforcement. The demand sounds reasonable: if a judge issues a warrant, the police should be able to read the message. The technical reality is that you cannot build a backdoor that only the good guys can use. A backdoor is a vulnerability. If it exists for the FBI, it exists for any attacker who finds it, including hostile intelligence services and criminal syndicates.
This is not a theoretical risk. It has already played out, more than once.
In 1993, the US government pushed the Clipper chip, an encryption device designed by the NSA with a built-in backdoor. The idea was that every encrypted communication would include a Law Enforcement Access Field, or LEAF, a small piece of data that let law enforcement recover the key. The chip was promoted as essential for national security.
In 1994, a cryptographer named Matt Blaze published a paper showing that the LEAF could be defeated. The 16-bit hash used to authenticate the access field was too short, so an attacker could brute-force a valid LEAF without ever revealing the real keys. The backdoor could be bypassed while the encryption kept working. A second attack, published in 1995 by Yair Frankel and Moti Yung, showed that one device’s LEAF could be attached to messages from another device, defeating the escrow in real time. The Clipper chip was dead by 1996. The only significant buyer was the US Department of Justice.
The cryptographers did not stop there. In 1997, a group of leading experts published “The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption,” a detailed analysis of why mandated government access to encrypted data was architecturally unsound. In 2015, many of the same authors published a follow-up, “Keys Under Doormats,” arguing that the problem had gotten worse, not better, in the intervening two decades. The technical consensus has been stable for nearly thirty years. Mandated backdoors introduce vulnerabilities that cannot be contained.
The history of the 1990s is full of this. Cryptography was placed on the US Munitions List and treated as a weapon. Phil Zimmermann’s encryption program PGP became the target of a criminal investigation simply because it was posted on the internet. Netscape was forced to ship two versions of its browser: a 128-bit version for Americans and a 40-bit version for everyone else, because export rules forbade strong crypto. The 40-bit version could be broken in days with the right hardware. The rule did not stop criminals from using strong encryption. It guaranteed that ordinary users overseas had weak, breakable security.
And yet the demand never dies. In 2015, after the Charlie Hebdo attack, British Prime Minister David Cameron called for outlawing encryption the government could not break, saying there should be no “means of communication” which “we cannot read.”
There should be no “means of communication” which “we cannot read.” — David Cameron, 2015
In 2016, US Senators Feinstein and Burr introduced a bill that critics said would effectively criminalize strong encryption. The EARN IT Act, first proposed in 2020, would condition legal immunity for online platforms on meeting “best practices” that, in practice, would require abandoning end-to-end encryption. The Dual_EC_DRBG scandal, revealed in the Snowden leaks, showed the NSA paying a company to make a backdoored random number generator the default in a widely used security toolkit.
The pattern is not that regulators keep trying and failing. The pattern is that they keep trying the same thing, ignoring the same evidence, in the hope that this time the math will cooperate.
The label that cannot survive a screenshot
The fourth case is the youngest, and it has already been tried in more than one country.
India’s 2026 amendments to its IT rules require platforms to label AI-generated content and embed provenance metadata to trace its synthetic origins. China implemented similar rules in 2025, standardizing on-screen disclosure labels and embedded provenance metadata for AI-generated text, images, audio, and video. The instinct is reasonable: people should know when something is synthetic. The technical demand is not.
Provenance signals, the watermarks and metadata that mark a piece of content as AI-generated, do not survive routine transformations. A screenshot of an AI image loses its embedded metadata. Recompressing an image destroys watermarks. Cropping removes visible or invisible marks. Re-encoding a file between formats breaks the provenance chain that standards like C2PA rely on. Since any digital media can be screenshotted, re-encoded, or re-uploaded, the provenance chain breaks at the first transform. The regulation demands a property the technology cannot guarantee. A user who never intended to deceive can strip the label by doing nothing more than saving the file in a different format.
The bias no one in power will name
There is a name for what is going on here, and it is uncomfortable to say about people in power.
The Dunning-Kruger effect is the cognitive bias where insufficient knowledge of a domain produces overconfidence about what is possible in that domain. The less someone knows about a subject, the more confident they tend to be that it is simple. Regulators are not (usually) stupid. They are operating without the technical fluency to judge whether their proposals can work. And the structure of government does not require them to acquire that fluency before legislating.
A senator can propose a 3D printer software filter without ever having read G-code. A prime minister can demand encryption backdoors without understanding what a key is. An administration can order a model shut off worldwide because of a jailbreak it cannot define. A regulator can mandate provenance labels that cannot survive a screenshot. The proposals sound reasonable in a hearing room. They collapse on contact with the actual technology.
This is a structural problem. It does not matter which party is in charge, or which country you are in. Any regulator without deep technical fluency will repeat the pattern. You cannot fix it by electing better people. You can only fix it by changing the process so that technical feasibility is assessed before the law is written, not after.
Test the rule before you write it
The fix is not complicated in concept. Before a regulation is proposed, it should be assessed on three axes by people who actually understand the technology.
The first axis is feasibility. Can the rule technically work at all? A 3D printer software filter fails this test. A model export ban fails the moment a foreign lab replicates the capability. An encryption backdoor fails by design. A provenance labeling mandate fails at the first screenshot.
The second axis is complexity. How hard and costly is compliance? If the rule requires every platform to redesign its security architecture, the cost is enormous and the benefit is negative.
The third axis is fallout. What collateral damage does the rule cause? Restricting frontier AI models disarms defenders. Weakening encryption exposes every citizen’s communications. Treating 3D printers as firearms cripples a manufacturing technology used for everything from medical devices to aerospace parts. Mandating provenance labels creates liability for a property that cannot be guaranteed.
None of this requires a new government agency. It requires an independent body, staffed by technologists and cryptographers and engineers, that rates regulatory ideas before they become law. Not a veto. A rating. Feasibility, complexity, fallout. Publish the rating. Let the politicians legislate with their eyes open.
The technologies we rely on are built on properties that regulation cannot reach directly. Open source cannot be recalled. Mathematics cannot be restricted. A file on the internet cannot be unshared. Attempts to reach these things anyway do not make us safer. They weaken the systems we depend on, and they hand the advantage to whoever ignores the rule. The fix is not better-intentioned politicians. It is a feasibility check that runs before the law is written, not after the damage is done.