If Mythos is too dangerous, we will soon have a much bigger problem

The global shutdown of Anthropic’s ‘Mythos’ and ‘Fable’ frontier models on 12 June 2026 illustrates the fundamental governance debate. What began as a limited release programme ended in a regulatory shutdown, prompting speculation as to whether usage bans are an effective way of managing AI risks.

Anyone working in a regulated industry knows this reflex all too well: something is too powerful, so access is controlled. And rightly so. However, this precedent highlights that external access controls alone are no longer a reliable foundation. In order to protect critical core systems, organisations must strengthen their own technological capabilities and integrate defence mechanisms directly into their architectures.

The ‘Mythos’ frontier model, developed by Anthropic, possesses capabilities that were previously considered purely hypothetical. It can identify unknown vulnerabilities independently, write functional exploits and execute complex cyber operations with minimal human intervention. Such capabilities were long deemed too dangerous for public release.

To manage these risks, Anthropic initially pursued a two-stage approach:

In practice, this security architecture only lasted a few days. Although Fable shares Mythos’s architecture, it also incorporates classifiers designed to block responses in high-risk domains. However, security researchers bypassed this protective concept using a simple method. They asked Fable 5 to analyse a specific codebase and patch its vulnerabilities. In the process of carrying out this seemingly defensive task, the model activated its offensive capabilities and exposed the security flaws.

In response, Commerce Secretary Howard Lutnick instructed Anthropic CEO Dario Amodei in a letter to disable both models for all foreign nationals, including foreign-born employees, regardless of their location. As selective implementation was impractical, Anthropic shut down both models globally.

The government’s concerns are entirely justified. The current debate centres on the fundamental question of whether highly advanced frontier models should be deployed outside of strict controls at all. This caution is particularly understandable for systems that exhibit pronounced strengths in sensitive areas such as cybersecurity or biologically relevant information. The debate touches on the two areas of risk where biological weapons and large-scale cyberattacks could cause irreversible damage: a single mistake could have catastrophic consequences. Those who dismiss these concerns as hysteria are ignoring the dramatic escalation in technological development over the last two years.

The current control framework has a real impact on at least part of the problem. Central control points exist with major providers. However, the system relies on the physical accountability of these actors.

Central control points: API access leaves traces, allowing suspicious behaviour to be detected and blocked. A provider with a registered office and a board of directors is liable and regulatorily accountable. This is precisely the familiar ground for IT decision-makers.

BIS Framework (January 2025): The BIS framework ‘Framework for AI Diffusion’ created its own control class for frontier model weights. ECCN 4E091 covers closed weights trained with more than 10²⁶ computing operations, making their export from the US subject to mandatory licensing.

Executive Order (2 June 2026): The US government signed the order ‘Promoting Advanced Artificial Intelligence Innovation and Security’. It requests developers to submit their most advanced models for voluntary regulatory review 30 days prior to release.

Together, these two measures form a coherent system: strict export controls regulate the international dissemination of the most dangerous models, while domestic policy relies on cooperation and involves the responsible developers. This model works as long as cutting-edge capability and institutional responsibility reside in the same place. But this is precisely what makes the debate incomplete if it ignores the technological reality of decentralisation.

The problem lies in the system’s reach. Open-source models currently lag behind in terms of performance. However, what is only possible today with a frontier model could be available in the form of an open-source model, a specialised fine-tuned model or a locally executable variant within 6 to 12 months. The gap is narrowing. The line of control remains drawn around closed-weight providers, while capability is leaking out underneath.

This problem already exists to some extent today. Uncensored models run locally without a central API, provider monitoring or effective access control. No licensing framework can access a file on a private hard drive. This dramatically lowers the barrier to entry.

Anthropic’s own objection to the order is revealing. The company complied with the order, but disputed its basis. They argued that the alleged jailbreak vulnerability was trivial and, in any case, could be reproduced using other publicly available models, such as GPT-5.5. If banning one model can be bypassed using a second, freely available model, then the ban merely addresses the symptom rather than the cause.

Dangerous knowledge is no longer confined to isolated forums or the dark web. Locally run, uncensored models can structure and simplify it, so that technical background knowledge barely matters anymore.

For the governance logic of regulated industries, this represents a structural shift. Our tools are based on a point of reference, such as a provider, a contract or an interface. However, this point dissolves as soon as the model weight leaves the controlled sphere. The critical difference lies in the reversibility of control:

This third line is a technical property. If you close down a provider, the product remains gone. However, if you distribute open weights globally, they persist on tens of thousands of computers. Once a file has been copied, it cannot be recalled.

Furthermore, existing safety mechanisms can be stripped from open models retroactively. Abliteration is a post-training technique that permanently removes a language model’s refusal behaviour by orthogonalising the weights against the so-called “refusal direction” in the activation space. This is a permanent modification to the model itself, in which the capabilities are largely preserved. Pre-release vetting takes effect before publication. Abliteration takes effect afterwards.

Ordinarily, I would not mention such a tool by name, but with around 24,800 GitHub stars and approximately 2,660 forks, Heretic is no longer a secret. The open-source tool, published in September 2025 by Philipp Emanuel Weidmann, automates exactly this intervention. Heretic is merely the most visible representative of an entire genus: over 1,000 abliterated variants have already been published on Hugging Face, derived from Llama, Qwen, Mistral, Gemma, and DeepSeek, often within hours of release.

A closed weight can be placed under export control. Once copied and distributed globally, an open weight is practically impossible to recall. Therefore, regulation precisely addresses the part of the problem that can still be addressed, but fails to reach the part that is currently evading resolution. This is not a weakness of the individual measure. Rather, it reveals the structural weakness of any prohibition logic, as open weights cannot be held back by any export classification or pre-release vetting.

The protective mandate is changing significantly for organisations responsible for digital core systems. Simply blocking access to dangerous models or relying on the integrity of cloud filters is an inadequate strategy. Strong offensive AI capabilities are widely available and cannot be banned.

The response must not be one of hysteria or technological resignation, but rather a realignment of security architecture. For IT decision-makers, this means transitioning to a zero-trust model for AI interactions.

Companies in regulated industries in particular should not depend on the security promises of external API providers. The ‘Mythos’ case demonstrated how swiftly geopolitical decisions can disrupt global supply chains in artificial intelligence. Digital sovereignty therefore means establishing controllable, resilient AI infrastructures that comply with strict European data protection and auditability requirements.

If Mythos is too dangerous to be operated openly, then the ban is not the real message. The key takeaway is that uncensored AI capabilities are already in circulation. Rather than hoping for ineffective bans, companies must strengthen their core systems against autonomous attacks.