Previous issues: #7 | #8 | #9 | #10 | #11 | #12 | #13
On Friday, June 12, at 5:21 in the evening, Eastern time, Anthropic received a letter from the United States government and, within hours, turned off two of its own products. Fable 5 and Mythos 5 went dark for every customer on earth. Every other Claude model, including Opus 4.8, kept running. The company called the order a misunderstanding and said it was working to reverse it. Days later, the models remain dark.
The shutdown has already been described, here and elsewhere. The more durable fact is the mechanism. For the first time, the machinery of export control was pointed not at chips, and not at model weights, but at live inference: the right of a foreign national to send a prompt to a running model and receive an answer. The thing being controlled was access to a service, switched off from the outside, in an afternoon.
The directive’s reach is wider than the word export suggests. Acting under the Export Control Reform Act of 2018, the Commerce Department treated the two models as export-controlled cyber weapons and required a license for their export, re-export, or even domestic transfer. The bar falls on any foreign national, whether outside the United States or inside it, and it counts Anthropic’s own non-citizen staff among the barred. A model can be served from a data center in Virginia to a user in Virginia and still fall under the control, because the control attaches to the person, not the border. Faced with a rule it could not partition cleanly, Anthropic disabled the models for all and routed live sessions back to the older Opus 4.8.
The stated cause is a single security finding. By Anthropic’s account the government offered verbal evidence of one narrow technique, which amounted to asking the model to read a codebase and propose fixes for its flaws. The underlying research, according to reporting, came from scientists at Amazon and reached the White House by way of Andy Jassy and Treasury Secretary Scott Bessent; the President authorized the restriction and assigned the Commerce Secretary to manage it. Anthropic’s rebuttal is that the same capability is available in models already deployed to hundreds of millions of users, including GPT-5.5, and is used daily by the people who defend networks rather than attack them. On the public record, the security case is thin and the response was total.
That judgment is now contested in the open. More than 80 cybersecurity leaders signed a letter urging the government to relent, on the argument that withdrawing the best available defensive tool helps attackers more than it hurts them. The administration’s artificial intelligence advisor, David Sacks, took the other side, holding that a model which can be talked into building a cyberweapon is serious by definition. The letter that started it all has not been published.
A model served from the cloud has an off switch by construction. Access runs through an API key, and a key can be revoked between one request and the next. There is no recall, no seizure, no logistics. There is a line in a configuration file. A model whose weights sit on a customer’s own hardware has no such switch. To stop that model you would have to find the machines, track the usage, and physically intervene, which is the difference between editing a permission and mounting a raid. Gated cloud delivery is not merely how Fable and Mythos were sold. It is why they could be turned off at all.
This is the second time in a year that the state has reached into Anthropic’s business. The Department of Defense earlier designated the company a supply chain risk, a label historically reserved for foreign adversaries, and the litigation over that designation is still open. Two interventions against one vendor is no longer an accident of a single bad week. For anyone building a company on top of one gated frontier model, the off switch has moved from the tail of the risk distribution toward its center. It is now a thing to be priced, hedged, and second sourced, in the way a lender prices the chance that a counterparty is cut off from the dollar.
There is a tempting reading in which the incumbent quietly welcomes a barrier that its rivals must also clear. It does not survive the facts. Anthropic is fighting the order in public, has sent senior staff to Washington to argue against it, is suing the government over the related designation, and carries the cost of all of it into a confidential public offering that values the company near $965 billion. A firm engineering its own capture would not be litigating its way out of it. The honest version of the point is structural, not secret. When capability concentrates in a handful of gated providers, it also concentrates the leverage of whoever can lean on them. The switch exists because the architecture put it there, and the architecture was a choice.
By this week the posture had moved from defiance to negotiation. Commerce Secretary Howard Lutnick, who signed the order, is now on regular calls with the company; senior Anthropic staff sat down at the Commerce Department on Monday alongside the National Cyber Director; and Dario Amodei and Lutnick are both due at the Group of Seven meetings at Evian-les-Bains, where the matter may be settled in a corridor. The government’s asking price is an assurance that the models cannot be turned against the United States. Read plainly, this is the part that should hold a founder’s attention. The models will most likely return, and they will return on terms set across a table in Washington. An off switch you do not control is one kind of risk. A switch whose owner will flip it back only on conditions of their choosing is a different and larger one.
The lesson did not stay inside the United States. Because Anthropic pulled the models worldwide, every foreign customer lost them in the same hour, and the capitals noticed. The European Commission said it would study the implications. Britain asked to be spared and was told that exempting even an ally would be illogical. Allies of the United States learned, in an afternoon, that building on a gated American model means living with an American switch.
The counter architecture has a name now. In April the AI Alliance, a coalition of more than 200 organizations, launched Project Tapestry, with Yann LeCun as its chief science advisor, to train frontier open models by federation: contributors pool capability into a shared base while keeping their data and building sovereign derivatives they own outright. Thirty partners met in Paris in May to argue about architecture. It is, by its own admission, an argument and not yet a model, the earliest phase of something that has to clear hard problems in distributed optimization before it clears anything else. But the design has one property the events of June 12 made concrete. A model with no single owner has no single switch.
That is the line this newsletter has been drawing for a year (Models Aren’t Moats and The Labor Market for Compute). The value is migrating to the layers that cannot be switched off from the outside: the compute you can point at any model, the memory that outlives any one provider, the physical and local infrastructure that answers to its operator and no one else. A borrowed frontier is a fine place to build a demo. It is a poor place to build a balance sheet. On Friday at 5:21 in the evening, several thousand companies learned which one they had been building, and the lucky ones learned it cheaply.
Other People’s Money
The switch flipped in the same week the public was asked to pay for the build-out at record scale, and the timing is the story. SpaceX began trading on the Nasdaq on Friday as SPCX, at $135 a share, a price Elon Musk set himself rather than finding it through a roadshow. (TechCrunch, June 11) The sale raised about $75 billion, rising to $85.7 billion with the over-allotment, the largest IPO on record, and made Musk, on paper, the world’s first trillionaire. (CNBC) The stock opened at $150, hit $176, and closed day one worth more than $2 trillion, around ninety times last year’s revenue. (CNBC)
At SpaceX, almost no one was selling. The filing locks up every pre-offering share, so the only stock trading Friday was newly minted, and insiders’ gains sit on paper behind staggered release dates. (Money Stuff, June 12) The selling was at the two labs still private. OpenAI and Anthropic ran employee tenders worth about $14 billion between them, letting staff cash out through investors instead of a listing. (The Information, June 16) Both have since filed confidentially, Anthropic on June 1 and OpenAI within the week, but neither trades until the listings price. The people closest to it get liquid first and privately, and ask the public in second.
Even the company with the least need for cash raised some. Nvidia sold $25 billion of bonds on Monday, its first debt sale since 2021, into orders that reached $85 billion. (SEC term sheet, June 15) It holds about $13 billion in cash, earns seventy-five cents of gross margin on the dollar, and clears more than $50 billion of operating cash flow a quarter, and said the bonds were meant to benchmark its cost of credit and refinance existing debt, not to fund chips. Demand ran better than three to one anyway. Money will lend against almost anything attached to the build-out, whether the borrower needs it or not.
Underneath this is a turn in the market’s plumbing. For two decades US equities were defined by scarcity, with buybacks pulling nearly $12 trillion of stock out of public hands. (Bloomberg, citing JPMorgan and Citigroup, via Money Stuff, June 15) JPMorgan now expects $1.5 trillion of net new equity over two years, the heaviest issuance since the late 1990s, almost all to fund AI. The issuance is forced by arithmetic in the build-out itself. The five largest hyperscalers, Microsoft, Amazon, Alphabet, Meta, and Oracle, are growing capital spending about three times faster than the cash their operations generate, roughly 70 percent a year against 23, and on current trends the two lines cross in the third quarter of 2026, when their combined free cash flow reaches zero. (Epoch AI, June 17) Oracle has already crossed, Amazon is crossing now, and Microsoft holds out until 2028; all five stay profitable, since the spending counts against earnings slowly, through depreciation. Internal cash runs out first, and the rest has to come from the public, the bond market, or the balance sheet.
The public is also buying in on terms that keep it out of the room. The companies leading the wave are listing with founder-control structures: super-voting shares, controlled-company exemptions, and public-benefit charters whose trustees can be removed only by a shareholder supermajority. (The Economist, By Invitation, June 13) Gill Whitehead, writing for the Economist, noted that while the industry races to engineer guardrails into its models, the corporate-governance versions of those guardrails have been dismantled. The buyer gets the upside, the now-uncushioned downside, and no vote.
I have argued before that markets tend to price the AI story well ahead of the cash flows beneath it (Everything’s a Shitcoin). This week the story carried a ninety-times-revenue listing and the first trillion-dollar fortune. The capital came from the public and the bond market, the cash went to insiders where the lockups allowed it, and control stayed with the founders either way. And the asset underneath all of it, as Friday showed, can be switched off by a letter.
Build to rent
Apple unveiled its rebuilt Siri at its developer conference, and the intelligence behind it comes from Google. The assistant runs on a custom version of Google’s Gemini, a model of about 1.2 trillion parameters, for which Apple is paying Google on the order of $1 billion a year. (TechTimes, reporting Bloomberg’s Mark Gurman) Apple’s own cloud model runs around 150 billion parameters, so it has rented a brain roughly eight times the size of the one it built. Craig Federighi confirmed that the most capable tier, which Apple calls Foundation Model Cloud Pro, runs on Nvidia chips inside Google’s cloud, the first time Apple has put its AI on another company’s silicon and another company’s data centers. (The Next Web, June 9) Apple’s own infrastructure, two years in, could not carry the agentic workloads at scale.
Apple kept the parts that face the user: the assistant, the small on-device models, the orchestration that decides what runs where, and the privacy story it has built into a brand. It rented the part that does the thinking, from the company it competes with most directly, and it left room for users to swap in Claude, ChatGPT, or Grok behind the same surface. The company that spent two decades building its own chips, operating system, and devices looked at building its own frontier model and decided the model was not the thing worth owning.
The same move turned up in silicon. Qualcomm is in talks to buy Tenstorrent, the chip company Jim Keller runs, for $8 to $10 billion, against a $2 billion valuation eighteen months ago. (Tom’s Hardware, June 15) Rather than design a data-center accelerator itself, Qualcomm would buy one, the same choice Apple made with the model.
I have made the case that the model is the commodity and that durable value sits in what wraps around it, the proprietary data, the orchestration, and the judgment about what good looks like (Models Aren’t Moats). Apple has now made that case from the demand side, holding the strongest hand at the table. When the company whose whole identity is owning the entire stack rents its frontier model from a rival and runs it on the rival’s chips, the model is no longer where Apple expects to win or lose.
Portfolio Company Updates
Prime Intellect
Prime Intellect published “True Agents Model the World,” which argues for pairing supervised fine-tuning on tool outputs with reinforcement learning on assistant tokens to improve environment modeling and generalization, and joined the NVIDIA Nemotron Coalition for post-training infrastructure. The work deepens the open tooling layer for persistent, self-improving agents. Full results are in the writeup.
Vast.ai
Arkhai
Following the launch of its Simple Compute Market, Arkhai published architecture documentation covering separable roles for buyers, sellers, and indexers, peer-to-peer negotiation, and Alkahest escrow settlement, alongside a presence at NYC Tech Week. The agent-first design, in which software buyers carry budgets, deadlines, and policies, remains one of the cleaner executions in the coordination and payments layer. See the architecture docs and recent updates.
LayerLens
LayerLens kept up a fast pace on evaluation infrastructure, publishing analysis on benchmark aging and continuous-evaluation commentary and drawing the groups for Stratix Cup season one, a tournament of frontier models in agentic football that begins June 22. As models and agents multiply, continuous outside evaluation becomes production infrastructure rather than a nicety. See the Stratix Cup draw.
Intelligent Internet
Intelligent Internet launched Factory Agent, a modular video tool that lets users edit individual shots without regenerating the whole sequence, and continued building out II-Agent across iOS and a browser extension. The work puts sovereign agent experiences into everyday creative and mobile workflows.