Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide.
For 18 days in June, two of America’s most capable AI models went dark worldwide, not for technical or business reasons, but because the U.S. government ordered it. On June 12, 2026, the Commerce Department informed Anthropic that its Fable 5 and Mythos 5 models could no longer be provided to any foreign person without a license, and the company concluded that compliance meant shutting the models down for everyone. Public access to Fable 5 was restored on June 30.
The United States doesn’t have a trusted, standardized process for evaluating the security risks of frontier AI models or proportionate remedies when problems are found. When a security concern surfaces, the government employs blunt tools, including emergency export controls and closed-door pressure. These are wielded through processes that are opaque, unpredictable, and vulnerable to politics and personality. The United States should close this gap by creating a statutory AI security review agency, paired with new, purpose-built legal authority for emergency remedies, anti-capture safeguards, real resourcing, and a path toward allied mutual recognition.
The predictable objection is that any such agency would be captured by industry or politicized by whoever holds power. The June episode illustrates why this view gets the problem backwards. Left without a structured institution, we are vulnerable to a system where private, unvalidated corporate claims dictate public outcomes, the very definition of capture. The design challenge is not whether to build one, but how to build one more insulated from those pressures than the status quo. This is not an argument for adopting Anthropic’s preferred policy position, nor for treating its mitigation claims as presumptively correct. The same process should apply to OpenAI, Google, xAI, Amazon, Meta, and any other developer whose frontier model raises comparable national security questions.
On Friday afternoon, June 12, Secretary of Commerce Howard Lutnick sent a letter (not officially public, but Bloomberg has reported the contents) informing Anthropic CEO Dario Amodei that a license was now required to provide Fable 5 and Mythos 5 to any “foreign person” worldwide. This restriction included Anthropic’s own employees. The order capped a 24-hour scramble that began when Amazon security researchers reportedly found a way to “jailbreak” the models’ guardrails and chief executive officer Andy Jassy relayed the findings to Secretary of the Treasury Scott Bessent. Much remains unclear: the technical details of the claims, whether third parties validated them, and whether Anthropic was given sufficient recourse. According to a statement from Anthropic, Lutnick’s letter “did not provide specific details of its national security concern.” An administration resoundingly against AI regulation in word and deed had effectively banned two of America’s most capable AI models worldwide.
None of this took place in a political vacuum. In March, the Pentagon labeled Anthropic a supply chain risk after the company sought limits on how its models would be used. Emil Michael, the Pentagon’s senior official for research and engineering, called Amodei “a liar” with “a god-complex” on social media, and Pentagon chief Pete Hegseth announced that companies using Anthropic models could no longer do business with the department. An objective observer could reasonably conclude that personal animosity is a factor, and some would call the June order retaliation. My argument does not depend on that theory. Even if the government’s technical case is sound, valid evidence demands a structured process, not opaque wrangling that takes one technology company’s word over another’s. The failure was the absence of any trusted, standardized process to evaluate the claim and impose proportionate remedies.
The government cited the Export Control Reform Act of 2018 and its deemed-export rules, but whether either applies to a foreign person’s access to a hosted American AI model is unsettled. As a Harvard Law Review analysis observes, when a foreign national prompts a model on American servers, the software never leaves the country. The first legal challenge arrived on June 23, when Legion LegalTech, an Anthropic customer, filed suit arguing that the directive “exceeds every source of statutory authority on which it could conceivably rest,” including the International Emergency Economic Powers Act, whose Berman Amendment excludes informational materials. Most consequentially, Legion invokes the major questions doctrine, central to the Supreme Court’s February decision striking down the administration’s emergency-powers tariffs. If the executive branch wants to regulate AI, Congress should clearly authorize it.
These legal questions expose a distinction any reform must confront: Creating an evaluator and creating the authority to act on its findings are two separate problems. An agency without substantive legal authority leaves the government reaching for ill-fitting emergency tools. Authority without a credible evaluator produces remedies untethered from validated findings. Congress should do both — establish the review body and write a narrow, purpose-built emergency-remedy authority requiring written determinations, strict time limits, proportionality, and judicial review. If the courts extend the major questions doctrine to AI, clear congressional authorization will be the only legally durable path for a federal system that can assess frontier-model security and impose remedies when validated findings warrant them.
Throughout, the burden of proof rests with the government. No restriction persists without an independently validated finding and a written determination, and orders lapse if deadlines pass unmet. Congress writes the authority, the agency adjudicates within it, and the courts review the result: the ordinary constitutional division of labor the June order bypassed.
This matters well beyond Anthropic. Other American frontier companies are close to developing capabilities on par with Mythos 5, and Chinese AI companies may not be far behind, given how much the model performance gap has closed. American AI offerings already cost more than less advanced yet capable Chinese alternatives. Off-the-cuff government reactions that can suddenly cut off millions of paying users compound the disadvantage. When Chinese models are near-frontier, cheaper, and increasingly easy to deploy, every unpredictable pause in U.S. access risks pushing developers, enterprises, and governments toward a rival stack. This matters because the diffusion of AI is at least as important to U.S. competitiveness as staying at the technological cutting edge, and unilateral restrictions smooth the path for Chinese firms to gain market share and standard-setting influence.
A June 2 executive order directed agencies to develop classified benchmarking and a voluntary framework for evaluating frontier models up to 30 days before release, while going out of its way to disclaim any mandatory licensing, preclearance, or permitting regime. What is needed, though, is exactly the kind of body the order was written to avoid, because the Anthropic episode shows the voluntary approach failing on its own terms. Ten days after it was signed, the same administration imposed the most restrictive action in the history of American AI policy. Congress should act, though even the administration seems to recognize the gap. National Economic Council Director Kevin Hassett said in May that the White House was studying an executive order establishing a pre-release security review, likening it to the Food and Drug Administration’s drug approval process.
Congress should build on existing resources rather than start from scratch. The Center for AI Standards and Innovation, housed within the National Institute of Standards and Technology, could serve as the new agency’s technical backbone. Statutory independence and protected funding would fast-track its creation. Many in the frontier AI safety community counter that the center is too politicized to serve as a credible regulator. Its remit has shifted with the administration, and its leadership serves at the pleasure of the commerce secretary. They are right about the institution as it exists today. That is the argument for the statute, not against the agency.
Fixed leadership terms, protected appropriations, and mandatory written findings exist precisely to convert a politically exposed office into a durable one. Its writ would include time-limited model-security reviews, validation of mitigation plans, accreditation of third-party evaluators, and public and classified risk assessments. The standard should be a 30-day pre-release review with third-party validation and written findings. In addition, for credible, acute threats, it should also have the authority to initiate a 72-hour emergency review followed by a temporary mitigation order, independent validation, and a mandatory written determination within 30 days.
The regime should be proportionate, avoiding the binary choice of approving or pulling a model. A narrow jailbreak could require a patch and monitoring. Moderate misuse uplift could mean conditional deployment, narrower access, and enhanced logging. A high-risk capability with safeguards that can be bypassed would mean temporary restrictions, controlled access, and required mitigation. An acute national security threat would trigger an emergency order, classified review, and interagency escalation. Had this ladder existed in June, the government would have had options between doing nothing and switching off two models for the whole world.
A mandatory pre-release gate might seem to damage diffusion just as ad hoc shutdowns do. It is the lesser burden for three reasons. The 30-day review would run largely in parallel with the red-teaming labs already conducted before release, adding process more than calendar time. A scheduled review is a known, priceable cost. Leaving things as they are could expose America to losses with no clear upper limit. The June shutdown cut off every downstream customer, mid-deployment, worldwide, for 18 days. Legion told the court that losing access was eroding its viability as a business. Moreover, certification can be a market asset. FedRAMP helped accelerate federal cloud adoption by giving agencies a standardized, reusable security authorization baseline that they could rely on across procurements. A rigorous U.S. security review would function the same way in foreign procurement, making it a reason to choose American models, not avoid them.
Critics argue that an independent agency accrediting third-party evaluators is a capture mechanism dressed up as oversight. In this instance, the status quo is the capture scenario. The June shutdown was set in motion by a competitor’s private report to a cabinet secretary, adjudicated behind closed doors, with no independent validation and no public written record. Whatever capture risk a statutory agency carries, it is strictly less than that of a system in which outcomes turn on which chief executive has which secretary’s cell phone number. Resistance should still be engineered into the statute: fixed, staggered leadership terms; mandatory unclassified findings; conflict-of-interest and cooling-off rules; multiple competing accredited evaluators; appropriations rather than industry fees; and Government Accountability Office review with a reauthorization sunset. Policymakers already have frameworks on the table to institutionalize the Center for AI Standards and Innovation, ensure adequate funding of $100 million per year, and establish an independent verification regime.
Resourcing is where proposals like this go to die. Today’s Center for AI Standards and Innovation cannot do this job as it has roughly 30 staff and about $30 million in total funding since 2024, roughly one-tenth of what its British counterpart spends. Even the administration-aligned America First Policy Institute calls it “chronically underfunded.” The Institute for Progress puts an “equipped” Center for AI Standards and Innovation at about $84 million per year. This is trivial given the stakes, on the order of a single F-35. The new agency should permit excepted service pay, obtain detailees from the National Security Agency and national laboratories, and host a classified compute enclave.
Skeptics will ask how anyone conducts a credible frontier-model review in 72 hours when developers probe their own products for months. The answer is that an emergency review is claim triage, not a de novo evaluation. The agency would not start cold, but rather would validate a specific exploit claim against baselines it already holds from the standing pre-release process. There is evidence this works. The Center for AI Standards and Innovation has conducted more than 40 evaluations and holds pre-deployment agreements with Anthropic, OpenAI, Google DeepMind, Microsoft, and xAI. The 72-hour product would be a validation judgment and a temporary, proportionate remedy, and the full written determination would then follow within 30 days.
The hardest question is why allies, many hedging against dependence on American technology, would align with a U.S.-led review regime rather than build their own. The honest answer is that they are routing around the United States for a reason. American export control decisions have become unpredictable, and allies increasingly perceive them as weaponized. A statutory, transparent, court-reviewable process would help restore allied confidence in U.S. leadership.
Allies also have affirmative reasons to join. The frontier models they deploy are overwhelmingly American, so a credible American review regime would govern systems they already depend on and provide visibility they cannot generate alone. Most allied bodies do measurement science and lack the model access, compute, and cleared talent for frontier reviews. Mutual recognition would spare their companies duplicative compliance across fragmented national gates, an outcome that raises costs for everyone and cedes standard-setting influence to Beijing. The Center for AI Standards and Innovation’s International Network for Advanced AI Measurement, Evaluation, and Science, with its 10 member governments, is a good starting point. Adding India, Israel, the Netherlands, and Taiwan, all with semiconductor weight and growing AI prowess, would bolster its democratic governance and technical credentials. The sequencing matters: mutual recognition of security evaluations first, common test standards second, export control alignment as the long-term horizon.
The United States cannot lead global AI development and diffusion if its own companies and allies cannot predict how security decisions will be made. An independent AI security agency — armed with real legal authority, designed against capture, and resourced for its mission — would make American AI governance a competitive advantage, offering predictability while strengthening confidence in the American AI stack. Leaving the current approach unaddressed risks ceding American leadership in AI to its chief competitor, China.
Martijn Rasser is vice president for technology leadership at the Special Competitive Studies Project. He previously served as an executive at two AI startups. The views expressed here are his own.
Image: Midjourney