From PGP to Model Weights: What Are Export Controls Good For?

Export control law was never built for mathematics. It was built for tanks, artillery, and guided missiles — physical objects that cross physical borders and can be stopped at a physical checkpoint. Twice now, regulators have tried to force a digital artifact into that same physical mold: once with encryption source code in the 1990s, and again today with the trained parameters of frontier AI models.

Both times, the same structural flaw has surfaced. This post traces that flaw from its first appearance to its second, some thirty years later.

01 The T-Shirt That Was a Missile

The first time the US government tried to treat a piece of software as a physical weapon, the attempt collapsed under the weight of its own absurdity. The setting was the early commercial internet, the artifact was encryption, and the regulatory vehicle was a Cold War-era arms export regime never designed for computer code.

The 1990s ITAR Classification Dilemma

During the early days of the commercial internet, the United States government viewed strong cryptography not as consumer privacy technology, but as auxiliary military hardware. Under the Arms Export Control Act (AECA) and its implementing regulations, the International Traffic in Arms Regulations (ITAR), any encryption algorithm using key lengths exceeding 40 bits was classified alongside tanks, artillery, and guided missiles on the United States Munitions List (USML).

The rationale of the Cold War national security apparatus was clear: if foreign adversaries acquired unbreakably encrypted communications, signals intelligence programs operated by the National Security Agency (NSA) would go dark. However, this policy clashed directly with the emerging digital economy, which required strong public-key cryptography — RSA and Diffie-Hellman key exchanges among them — to secure online banking, e-commerce, and enterprise data transfers.

Cypherpunk Resistance: Books, T-Shirts, and Tattoos

To highlight the legal absurdity of treating computer code as a physical weapon, software developers and digital rights activists — collectively known as cypherpunks — initiated a series of deliberate civil disobedience campaigns:

• PGP book trick. In 1991, Phil Zimmermann released Pretty Good Privacy (PGP), the first widely available public-key encryption software. When the federal government launched a criminal investigation into Zimmermann for exporting PGP without a license over the internet, MIT Press published the complete C source code of PGP in a physical hardcover book. Exporting the digital code on a floppy disk was a federal felony; exporting the exact same text printed on bound paper was a constitutionally protected publication. Developers outside the US subsequently bought the book, scanned the pages using Optical Character Recognition (OCR), recompiled the code, and proved the regulatory boundary was unenforceable.
• Munitions on t-shirts. Activists printed short RSA encryption algorithms written in Perl directly onto t-shirts, alongside the text of the First Amendment and a legal warning: "This t-shirt is classified as a munition and cannot be exported outside the United States." Wearers walked through international airport customs checkpoints, daring federal agents to arrest them for wearing illegal arms.
• Munitions on skin. Adam Back's five-line Perl implementation of RSA — already circulating as an email signature and a t-shirt print — ended up tattooed directly onto some cypherpunks. A mailing-list thread only half-jokingly labeled the result a "BIO-MUNITION." Technically, the wearer was exporting a regulated munition every time they crossed a border shirtless.

The fundamental flaw of the early crypto export controls was trying to treat digital information as if it were physical matter. Information obeys the physics of light and electricity, not mass and gravity.

Landmark Jurisprudence: Bernstein v. Department of State

The legal structure of software export controls was ultimately broken through Bernstein v. United States Department of State (later Bernstein v. Department of Justice). In 1995, Daniel J. Bernstein, a Ph.D. candidate at the University of California, Berkeley, sought permission from the State Department to publish an encryption algorithm called Snuffle alongside an explanatory academic paper.

The State Department informed Bernstein that Snuffle was a munition and that he would need to register as an arms dealer and obtain an export license before teaching his class or publishing his code online.

Supported by the Electronic Frontier Foundation (EFF), Bernstein sued the federal government. In a landmark 1996 ruling, District Judge Marilyn Hall Patel held that computer source code is expressive speech protected under the First Amendment, and that the ITAR regulatory framework governing encryption software functioned as an unconstitutional prior restraint on academic expression and free speech.

By 1999 and 2000, faced with judicial defeat and intense lobbying from American technology firms who were losing global market share to foreign developers unrestricted by US laws, the Clinton administration officially transferred commercial encryption controls from the State Department's USML to the Commerce Department's Bureau of Industry and Security (BIS), effectively ending the main front of the Crypto Wars.

As a 2015 retrospective by Bankston, Thompson, and Kehl documents, the government's preferred alternative to an outright ban had already collapsed once before, on almost the identical timeline.

In 1993 the Clinton White House proposed the Clipper Chip, a government-designed encryption chip with a built-in "key escrow" backdoor that would let law enforcement decrypt any communication running through it. In May 1994, cryptographer Matt Blaze published a design flaw that let anyone strip the escrow mechanism out of a Clipper-protected message, and the proposal was quietly abandoned.

The lesson — that a mandated technical backdoor is also a technical vulnerability — would resurface, unlearned, in nearly every encryption debate since. (For a fuller narrative walkthrough of this era, see Pyro's Chaos Communication Camp 2023 talk on the '90s Crypto Wars.)

02 The Silicon Curtain

When AI reawakened the national security dilemma of the 1990s, regulators reflexively reached for the one chokepoint that had actually worked last time: physical matter. But the silicon curtain, they would soon discover, leaks at the speed of software, not the speed of atoms.

The Hardware Containment Strategy (2022–2024)

When the rapid rise of modern generative artificial intelligence sparked fresh national security concerns in Washington, regulators initially sought to avoid the legal landmines of the 1990s by focusing strictly on physical objects rather than software code.

Beginning with the Bureau of Industry and Security's watershed regulations on October 7, 2022, and expanded in late 2023 and 2024, the United States executed a hardware-centric containment strategy. This strategy relied on physical chokepoints in the advanced semiconductor supply chain.

• Fab equipment chokepoints. Restricting export of extreme ultraviolet (EUV) and deep ultraviolet (DUV) lithography systems produced by ASML in the Netherlands.
• Compute performance gates. Banning the export of high-performance accelerator chips (such as NVIDIA A100, H100, and B200 architectures) to strategic competitors based on total processing power and interconnect bandwidth thresholds.
• Foundry restrictions. Prohibiting advanced semiconductor foundries (such as TSMC) from manufacturing custom AI silicon designed by foreign entities without explicit BIS authorization.

Hardware controls were appealing because atoms are dramatically easier to regulate than bits. Manufacturing a cutting-edge AI accelerator requires a billion-dollar supply chain, ultra-pure materials, specialized industrial equipment, and physical transport across international borders.

Why Physical Walls Fail to Contain Software

Despite the initial effectiveness of chip export restrictions, the rapid evolution of artificial intelligence software demonstrated that hardware controls alone cannot permanently isolate model capabilities. Four structural dynamics eroded the "silicon curtain":

• Algorithmic efficiency gains. Engineers consistently find ways to extract greater capability from less physical compute. Through advances like 4-bit and 8-bit quantization, Mixture-of-Experts (MoE) architectures, and memory-efficient attention mechanisms (FlashAttention), open-source research routinely reduces the hardware footprint required to train and run capable models by four- to eight-fold. A model that required a massive GPU cluster in 2023 can often be run on legacy or consumer hardware a few years later.
• Cross-border model distillation. Hardware controls target the training process, but intelligence is highly portable. Developers in compute-constrained regions can use synthetic outputs generated by closed, top-tier frontier APIs to "distill" knowledge into smaller, open-weight architectures. In effect, the frontier API pays the massive hardware compute cost once, while downstream entities absorb the capability into locally hosted models at a fraction of the cost.
• Cloud compute arbitrage. While physical chips are stationary, execution access is fluid. Foreign entities prohibited from purchasing physical H100 or B200 clusters can rent compute hours through intermediate third-party cloud providers, proxy networks, or overseas subsidiaries.
• Decentralized GPU networks. DePIN marketplaces like io.net and Akash Network aggregate idle compute from thousands of independent suppliers — data centers, crypto miners, individual GPU owners — into a permissionless pool with no KYC gate and no single accountable operator. Even a functioning cloud-provider compliance regime has nothing to serve a suspension order to when the H100 for rent this hour belongs to whoever happened to list it.

As a result of these forces, the national security debate inevitably migrated from physical hardware back to where it sat in 1995: the software artifacts themselves.

03 What Are We Actually Controlling?

Before debating whether model weights can be controlled, it is worth defining what they are in technical terms — and why they occupy a category that export control law has never encountered before.

Demystifying Model Weights

To understand the legal and operational challenge of modern AI export policy, one must define what a model weight is in technical terms. An artificial neural network consists of an architectural skeleton (the code defining layer connections, activation functions, and attention heads) and a set of trained parameters known as weights (and biases).

When a model is described as "open-weight," the developers have publicly released these parameter matrices. Anyone with a general-purpose processor, a compatible software framework (like PyTorch or vLLM), and these files can run, fine-tune, modify, or embed the model locally.

From a regulatory perspective, model weights occupy a strange middle ground: they are not executable binaries, only passive data arrays; they are not raw human-readable source code, yet they are the direct product of human-designed algorithms and data processing; and they are mathematical values, representing trillions of vector multiplications encoded as binary data.

The Regulatory Leap: Model Licensing

Recognizing that releasing open weights provides unmonitored access to raw model capability, the United States Department of Commerce's Bureau of Industry and Security (BIS) introduced a regulatory classification: Export Control Classification Number (ECCN) 4E091. Under this framework — and the associated interim final rule under the Framework for Artificial Intelligence Diffusion, issued in January 2025 — the US government established global licensing requirements specifically for advanced AI model weights.

1. Compute threshold. A model trained using more than 10²⁶ total FLOPs (floating-point operations).
2. Hardware lineage. A model trained using controlled high-performance chips (e.g. ECCN 3A090.a / 4A090.a).
3. Extraterritorial FDPR. The Foreign Direct Product Rule applies even if model training occurred outside the United States, so long as US technology was used in the stack.

The Foreign Direct Product Rule Expansion

A critical mechanism of ECCN 4E091 is the assertion of global jurisdiction via the Foreign Direct Product Rule (FDPR). Under this rule, if an overseas laboratory — whether in Europe, Asia, or elsewhere — trains a frontier AI model using US-origin software or hardware (such as NVIDIA GPUs or US-designed EDA tools), the resulting model weights are legally categorized as subject to US export jurisdiction.

Transferring those weights to restricted end-users without a BIS license constitutes a violation of US law, regardless of where the training physical plant was situated.

This assertion sets up an inevitable legal tension reminiscent of the 1990s: if a model weight matrix is simply a sequence of numbers, can the government prohibit an individual from transmitting those numbers without running afoul of speech protections and technical realities?

RAND analyst Lennart Heim's assessment of the framework is worth dwelling on for what it reveals about the thresholds themselves: control triggers are designed to auto-ratchet upward as the public compute frontier advances, and licensing rules are keyed jointly to a company's headquarters location and its export destination. The compute threshold is a moving target by design, not a fixed line — which means the classification boundary shifts under a developer's feet even when nothing about their model has changed.

Weights are not the only frontier surface regulators are eyeing. A parallel argument, made by Khawam and Schnabel in a December 2025 Just Security analysis, is that model outputs deserve equal scrutiny: testing across four leading US frontier models found that every one of them produced controlled technical information — reportedly touching categories on the US Munitions List — when prompted, and professional red-teamers bypassed safety defenses more than 70% of the time.

If a weights matrix is hard to control because it is just numbers, an output stream is harder still, because it is generated fresh for every request and never touches a border at all.

04 Two Capitals, Two Bets

The challenge of regulating open-weight models has created distinct strategic dynamics in the United States and China. Both governments view frontier AI as a critical strategic capability, yet both struggle with the trade-offs between open diffusion and national control.

The Walled Garden: Washington Bets on Gated APIs

The primary focus of American regulatory strategy is preventing strategic competitors and non-state actors from acquiring frontier dual-use capabilities — specifically in areas like offensive cyber operations, automated exploit generation, and biological agent design.

To mitigate these risks, major US frontier labs (such as OpenAI and Anthropic) have historically maintained closed ecosystem models, serving capability strictly through hosted Application Programming Interfaces (APIs). These APIs allow labs to deploy active safety filters, monitor prompt logs, run automated refusal classifiers, and instantly terminate accounts violating usage policies.

However, US policymakers face a severe domestic dilemma:

• Innovation friction. Restricting American open-weight releases (like Meta's Llama family) penalizes domestic open-source developers and small enterprises that rely on fine-tuning accessible models locally.
• Regulatory arbitrage. If US developers are barred from releasing capable open-weight models, foreign open-weight alternatives rapidly fill the vacuum, becoming the default infrastructure for developers in the rest of the world.

The TikTok Playbook: Beijing Bets on Open Weights

Conversely, Chinese AI strategy has leveraged open-weight distribution as an instrument of global market expansion — a strategy analysts refer to as the TikTok playbook for AI.

Faced with US hardware sanctions, leading Chinese labs and technology giants — including Alibaba (Qwen), Moonshot AI (Kimi), Zhipu AI (GLM), and DeepSeek — shipped open-weight models globally. By offering high-performing, open-weight alternatives at low or zero cost, Chinese models achieved millions of downloads on global hubs like Hugging Face, establishing deep developer traction across Asia, Europe, and the Global South.

However, Beijing faces its own domestic policy dilemmas regarding open weights:

• Export curbs deliberations. China's Ministry of Commerce (MOFCOM) has been consulting Alibaba, ByteDance, and Zhipu AI on a package of controls that would restrict foreign access to advanced model weights, the training data behind them, and semiconductor designs from Chinese chipmakers — reportedly including whether overseas users should be barred from downloading the weights behind China's most capable models at all.
• Strategic asset protection. Chinese regulators worry that releasing unconstrained open-weight models allows Western competitors to distill Chinese algorithmic progress, while exposing domestic companies to foreign IP theft.
• Domestic alignment. Open-weight models deployed abroad cannot be easily updated to comply with evolving domestic content regulations and alignment standards once downloaded onto private foreign servers.

Both capitals find themselves caught in the exact same trap: openness provides massive ecosystem adoption and influence, but control requires restriction.

This Is Not Bilateral: The Allied Chokepoint

Framing the contest as Washington versus Beijing hides the actors who actually determine whether US controls hold. The Foreign Direct Product Rule, the chip thresholds, and ECCN 4E091 all reach across borders, but their leverage depends on five allied countries that hold the physical and legal chokepoints in the AI supply chain. None of them have the United States' full toolkit, and their willingness to use what they have is what makes or breaks the wall.

• Netherlands. ASML is the world's sole supplier of extreme ultraviolet lithography — the single most concentrated physical chokepoint in the entire AI stack. In June 2023 the Dutch invoked Article 9 of EU Regulation 2021/821 to license previously uncontrolled semiconductor manufacturing equipment unilaterally, the first time an EU member state reached for that national-control authority.
• European Union. On 14 November 2025 the Commission published a Delegated Regulation adding a new "500 series" to the EU Dual-Use Control List — the first time the EU included items not agreed under the Wassenaar Arrangement. Russia has used its Wassenaar veto since 2022 to block list updates, forcing the EU into unilateral moves on quantum computing, semiconductor equipment, and advanced computing ICs. In parallel, the EU AI Act's Article 55 imposes systemic-risk obligations on general-purpose AI models from August 2026 — a second regulatory layer on the same frontier models export control targets.
• Japan. In 2023 Japan added licensing requirements on 23 categories of semiconductor manufacturing equipment under its 1949 Foreign Exchange and Foreign Trade Act, as part of a reported trilateral deal with the United States and the Netherlands. Its end-user list, however, still covers only WMD-linked entities — far narrower than the US Entity List, which means many of the Chinese firms Washington has blacklisted face no equivalent Japanese curb.
• South Korea. Korea blocks sensitive technology transfer through its Act on Prevention of Divulgence and Protection of Industrial Technology, a national-security-via-industrial-policy tool that does not map onto classical export control. It was also the most conspicuous collateral victim of the Mythos directive: the US-government-funded Glasswing cyber-defense collaboration with Korean telecoms was disrupted when Anthropic pulled Fable 5 and Mythos 5, accelerating Seoul's push for sovereign AI as a hedge against future US cutoffs.
• Taiwan. Taiwan is the partial exception among the allies: it maintains country-specific restrictions on citizens and firms supporting the Chinese semiconductor industry, and recently tightened dual-use controls on advanced semiconductors and quantum technology. But as a CSIS analysis documents, no ally other than Taiwan has the legal authority to impose country-wide chip controls of the kind the United States runs — which means the FDPR's reach depends on enforcement by partners whose statutes don't currently let them mirror it.

The pattern across these five jurisdictions is what a CSIS report calls the "allied enforcement gap": most allies have list-based authority but lack equivalents to the FDPR, the Entity List, and country-wide restrictions.

The EU's November 2025 "500 series" and the Netherlands' unilateral SME rules are the most aggressive allied moves to date, and they point the multilateral system toward the same unilateral posture that broke ITAR in 1999 — only now fragmented across more capitals, each with its own industrial base to protect.

China's Chokepoint: Minerals, Not Allies

The natural next question is whether Beijing has an allied chokepoint of its own. It does not — not in the same structural sense. China has no treaty partner holding an ASML-grade veto, no shared Entity List, no ally with FDPR-style country-wide reach. Where the US chokepoint is multilateral but fragile — five partners, none with the full toolkit — China's chokepoint is unilateral but narrow: it runs through China's own dominance of rare-earth and critical-mineral refining, not through a coalition.

Beijing has been tightening that lever on almost the same clock as the AI weight wars. An April 2025 round restricted heavy rare-earth elements and permanent magnets; an October 2025 round went further, adding — per a CSIS analysis — a foreign direct product rule of its own: any product made anywhere in the world using even trace amounts of Chinese-sourced rare-earth material now needs Beijing's approval to export. The vocabulary is not a coincidence.

China built its own FDPR without needing a single ally to enforce it, because the refining capacity itself is the chokepoint.

The countries that do appear on China's side of the ledger play the opposite role from America's allies: not co-enforcers, but leaks. Singapore-based brokers were charged in February 2025 with a $390 million fraud scheme rerouting Nvidia-equipped servers toward Malaysia amid a US probe into whether DeepSeek had obtained restricted chips through exactly this kind of channel, and a March 2026 case tied roughly $2.5 billion in smuggled servers to transshipment routes running through Vietnam, Malaysia, Thailand, and the Philippines. These jurisdictions are not China's allied enforcement layer — they are gaps in the West's own enforcement layer that Chinese demand pulls chips through.

05 Why History Repeats Itself

The arc from PGP to model weights is not an analogy that has to be argued into existence; it is a pattern that the physics of information imposes. Once a digital artifact is published, the same leakage mechanics apply whether it is source code or weight matrices.

The Mechanics of Software Leakage

The history of software regulation — from 1990s PGP code to modern open-source neural networks — demonstrates a consistent pattern: software export controls almost always leak. Once a digital file consisting of weights or code is published to a connected device, attempting to restrict its distribution across geographical borders fails due to fundamental technical mechanisms:

1. Bit-level duplication. Digital files replicate with zero cost and perfect physical fidelity.
2. Decentralized peer-to-peer networks. BitTorrent protocol and encrypted IPFS storage bypass central domain takedowns.
3. Algorithmic compression. Quantization reduces multi-gigabyte weight files to sizes easily transmitted via consumer bandwidth.

When a set of model weights leaks or is intentionally released, it is mirrored across thousands of private servers and public repositories within minutes, torrent networks and peer-to-peer protocols distribute the payload beyond the reach of any single sovereign domain registrar or cloud hosting provider, and fine-tuning techniques (such as LoRA and QLoRA) allow end-users to strip away embedded safety refusal layers using modest compute resources.

Attempting to enforce ECCN 4E091 against an open-weight file that has entered public torrent networks is functionally equivalent to trying to pull back PGP source code after it was printed in books in 1995.

The Mythos Precedent

The mirror image is not hypothetical, and it did not take thirty years to arrive. On June 12, 2026, the US government issued an export control directive ordering Anthropic to suspend all access to its Fable 5 and Mythos 5 models for any foreign national, anywhere, including foreign-national Anthropic employees.

Anthropic had no reliable way to verify a user's nationality in real time, so the only compliant response was to disable both models for every customer worldwide — vetted partners in roughly fifteen countries included. Eighteen days later, on June 30, 2026, the Department of Commerce lifted the restriction and access resumed.

Zimmermann — the PGP creator whose export battle opened this post — needed a federal investigation and a legal defense fund to test whether export law could reach a floppy disk. Anthropic needed ninety minutes and a single memo.

The artifact under control this time was not open weights but API-gated inference — closer to the human-consumed API anchor point than to a distributable file. But the reflex is the same reflex: a government asserting export jurisdiction over a piece of software because of who might use it, and a company discovering in real time that the software has no way to know who is asking.

The Paradigm Shift: From Outlawing Numbers to Identity and Cloud Governance

Because outlawing floating-point numbers is legally suspect under speech protections and technically ineffective against peer-to-peer distribution, future AI regulation must undergo a structural pivot.

Regulators cannot effectively control the numbers themselves; they must govern the physical compute infrastructure and identity layers required to create and execute them.

• Cloud-level "know your customer" (KYC) protocols. Rather than stopping weight files at the border, regulation shifts to cloud compliance: providers must verify the identity, nationality, and beneficial ownership of whoever is renting large GPU arrays.
• Hardware enclaves and compute telemetry. Future chips may embed cryptographic attestation directly on the die — executing high-FLOP training runs only with signed authorization certificates, or reporting aggregate compute telemetry back to vendors to enforce global thresholds.
• Access management over file proliferation. Governance shifts from restricting downloads to auditing air-gapped datacenters and API access directly — once weights leave the training enclave, regulators must assume they're permanently public.

06 The Cybersecurity Perspective

The Mythos suspension showed what happens when a government yanks access on a single afternoon. Security researcher Marcus Hutchins — who stopped the WannaCry ransomware outbreak, and has spent a decade fighting forum, YouTube, and TikTok bans on cybersecurity education — argues gatekeeping does something worse on an ordinary Tuesday: it disarms defenders while barely touching the people it's meant to restrain.

The Asymmetry Argument

Hutchins's throughline across that decade of bans is simple: restricting knowledge mostly hurts the good guys. Cybercrime is now a fully commercialized service economy — prebuilt phishing kits, malware kits, ransomware kits, infostealers, all purchasable for a few dollars — so the technical bar to attack is close to zero. Defenders face the opposite problem: keeping protections current requires actually understanding how constantly updated attack tooling works.

Gate the education, and the side that loses is the one that needed to learn, not the one that could already buy a kit.

Why Threat Actors Aren't Buying It

Hutchins, who works in threat intelligence, says he isn't seeing mass AI adoption among threat actors, for a mundane reason: most criminal operations already work, and criminals follow a "don't fix what isn't broken" logic — he cites one ransomware group reportedly clearing $2 billion in a year with tooling untouched by AI. Their bottleneck was never breaking in; it was cashing out, laundering stolen funds faster than the pipeline could absorb it.

Most attacks succeed through free phishing, not paid exploits, which makes an expensive AI-found bug a bad trade for an ordinary criminal — Hutchins notes one Mythos-found exploit reportedly cost $20,000 in tokens, and "why spend $20,000 if free will do."

The buyer he expects instead is nation-states, who already pay exploit brokers millions for access to hardened targets phishing can't reach, and who—if cut off entirely—have the money to just build their own models. Gatekeeping, in his account, restrains nobody who actually wants in.

Project Glasswing: The Access Anthropic Still Restricts

Independent of Hutchins's argument, Anthropic's own numbers point the same direction. Project Glasswing — the same partnership the Mythos directive hit two sections earlier for its Korean telecom involvement, which has since resumed — ran Claude Mythos Preview against more than 1,000 open-source projects and surfaced 23,019 flaws, an estimated 6,202 of them high- or critical-severity: of the subset independently verified, 90.6% proved valid and 62.4% confirmed severe.

Only 530 of those were reported to maintainers, and just 75 have been patched. Anthropic's own framing concedes the point before Hutchins has to make it:

"Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch" them.

Yet Mythos-class models remain unreleased to the public — restricted to Glasswing partners and a Cyber Verification Program for vetted professionals — because, Anthropic says, safeguards aren't ready yet.

Inside the Cyber Verification Program

Hutchins is himself a vetted member of that program, and his account of it is not reassuring. Certain topics, he says, stay flagged as categorically forbidden regardless of vetting — ransomware chief among them, even though building ransomware-defense software requires understanding, and sometimes writing, ransomware to test against.

The model, he argues, cannot reliably infer intent from technique: full-disk encryption and ransomware are the same code with a different plan for the key, and a real ransomware actor has in fact weaponized Windows's own BitLocker exactly this way. Unable to tell "securing my laptop" from "about to hold this laptop hostage," the model hedges against the worse reading — and, he says, sometimes only refuses the request after it has already generated the answer and charged him for the tokens. He puts his own losses to that pattern at around $1,000.

Bugs aren't going unpatched because no one can find bugs. It's because no one is being paid to find bugs.

The Builder's View: A Small Cabal Isn't Enough

David Slater, co-founder and chief architect at the defensive-AI firm Armadin, watched the same stretch from the vendor side, and reaches a harsher verdict on the export-control logic itself. The weeks Mythos and Fable sat dark were, in his account, the exact weeks Chinese open-weight models crossed a threshold: GLM 5.2 paired the intelligence and endurance American frontier models had monopolized with the one trait US labs deliberately suppress in their own — a willingness to be used for offensive cyber work at all — just as quantization dropped the cost of running it week over week. Restricting the American frontier while the Chinese frontier closed the gap turned out to be the same move, pointed at each other.

Slater doesn't dispute that some restriction is reasonable — he compares unrestricted API access to selling rocket launchers on eBay. His objection is to the fix labs chose instead: a small, vetted circle of trusted partners gets early access to frontier capability, while hundreds of thousands of other organizations, including critical infrastructure and financial institutions, in his words "never get a shot" and simply wait to get breached by whatever model comes next.

His proposed alternative sharpens the same gatekeeping critique this section has already traced: disclose, don't release — run early checkpoints offensively against real infrastructure with a trusted group, then warn everyone else what's about to be exploitable, instead of keeping both the capability and its findings behind one gate.

He also gives the attacker-defender asymmetry a sharper edge than the "kits are cheap" framing above: AI doesn't create that gap, it magnifies it. A defender has to triage every confident false positive a Mythos-class model produces; an attacker only needs the one lead that pans out and can ignore the rest. As token costs keep falling, that asymmetry compounds well before the models gain the working memory for the kind of multi-step, weeks-long attack chains a patient human still handles better.

The Kimi Reality Check

Slater's alarm gets an important qualifier from an actual government assessment. A joint UK AISI/US CAISI evaluation, released July 24, 2026, of Moonshot AI's Kimi K3 — marketed as China's most capable model — found it scoring 32.2% on ExploitBench, against a 76.2% average for leading US models, and landing zero successful arbitrary-code-execution exploits across all 41 tasks tested, versus 20 for the American frontier.

On The Last Ones cyber-range test — a 32-stage attack path through four subnets and more than 20 hosts — the US models averaged 28.5 stages deep; Kimi K3 reached only 17. It did edge out GLM 5.2, which scored 24% on the same benchmark, so the Chinese field isn't uniform — but "most capable" and "closing the gap on offensive cyber" turned out to be two different claims.

An earlier reading had pointed the other way. Belgian security firm Aikido Security, publishing July 16, 2026, found Kimi K3 detected 23 of 26 newly disclosed vulnerabilities — tying both OpenAI's GPT-5.6 Terra and the premium GPT-5.6 Sol system on the same benchmark, at roughly a quarter of Sol's operating cost. That result measured passive detection, not active exploitation; the UK/US assessment measured the opposite, and the contradiction between the two is itself the finding.

The gap has a structural cause, per a July 2026 analysis: distillation can only transfer what the teacher model actually demonstrates, and US labs' own safety training means their frontier models refuse to demonstrate offensive cyber reasoning in the first place. The cross-border distillation this post described earlier as an erosion force on hardware walls turns out to have a ceiling — it inherits a teacher's refusals along with its knowledge.

Anthropic's June 2026 letter to the Senate Banking Committee, per the same analysis, alleges Alibaba's Qwen lab used roughly 25,000 false accounts to run 28.8 million conversations with Claude over 44 days — a figure Alibaba disputes — but the offensive reasoning those turns were fishing for is precisely what Claude refuses to show.

What Kimi K3's own guardrails didn't do, notably, was refuse to try: assessors got it to attempt exploit development every time, succeeding on the hardest cyber-range test once in ten runs. Not gatekept and not yet dangerous is not a combination that has to hold for the next release.

Researchers Vote With Their Feet

The gate has a second-order effect neither Anthropic nor Hutchins fully advertised. A TechCrunch investigation found offensive-security researchers describing vetted-access programs as inconsistent and arbitrary, closer to babysitting than a workflow: RemoteThreat's Chris Thompson said guardrails "work differently every day," forcing researchers to negotiate with the model instead of running their security program; Crowdfense's Paolo Stagno said the vetting treats customers "like children who need babysitting." The reporting's own framing of the consequence is blunt: researchers increasingly rely on, or get pushed toward, Chinese open-source models like GLM — freely downloadable, run locally, no vetting or usage restrictions — per Thompson.

Thompson's own warning captures the irony: pushing "responsible researchers" off US-governed systems and onto foreign-owned ones is the opposite of the security outcome the gate exists to produce. Hutchins would add a sharper frame to that irony: the same companies restricting access to this knowledge built their models by scraping the open internet in the first place — control over who gets to use it, in his view, was never really theirs to claim.

None of this is a new mechanism — it is the same open-weight displacement this post has already traced at the model layer, now showing up one layer down, in the tools used to hunt for bugs rather than the models that write software. Gate the trusted channel, and the demand doesn't disappear; it moves to the channel with no gate at all.

A Theater of Limitations

Joshua Saxe — fifteen years in ML security, former head of Sophos's machine-learning program, later security lead for Llama at Meta, now building an AI-agent vulnerability-management startup — makes a version of Hutchins's argument from the defender-telemetry side, in conversation with Chris Hughes on the Resilient Cyber newsletter, also available on video.

His frame is visibility, not access: "You use Fable and some team in Anthropic might catch you in your tradecraft and then send that directly to the NSA," he says — so a rational attacker doesn't fight through a frontier lab's monitoring at all, they just switch to a self-hosted open-weight model with none. Restricting the frontier doesn't shrink attacker capability; it moves the attacker into the one place defenders can't see them, the same shadow-IT lesson enterprise security relearned a decade ago with unsanctioned SaaS.

The guardrails built to stop that five percent carry the same dual-use cost Hutchins describes from the vetting side — "if you're gonna block attackers, you're gonna block defenders with these guardrails." Saxe's own prescription isn't fewer restrictions and nothing else: he'd rather see labs and defenders spend the effort on access management, SOC automation, and burning through the security industry's technical debt with agents — work that doesn't require picking a side of the guardrail to sit on.

Saxe made the same case in writing three weeks earlier, in a July 1 essay on his own newsletter, and it adds a resource asymmetry the interview doesn't mention: far more defenders than attackers, and far more compute, plus the structural edge of controlling the infrastructure under attack and being able to vet it with AI before release.

His empirical read holds up the same way: "the sky is not falling." Attackers are already using AI for reconnaissance, phishing, and coding help, same as everyone else, and — in his words — there's been no "huge discontinuity or crisis that restrictionists imply." His sharper warning is about what the current gating strategy risks if it works too well: imagine a world where 80% of AI inference in liberal democracies runs on models under the PRC's indirect control — the walled-garden bet Slater flagged two subsections earlier, carried to its endpoint.

"There's a thousand times more people interested in finding and fixing the bugs than there are in finding and exploiting them." Gatekeeping the frontier doesn't change that ratio. It just decides which side of it gets the better tools.

Kerckhoffs's Principle

Every argument in this section is a modern restatement of something cryptography settled in 1883.

The AI labs' restriction logic inverts that maxim on purpose: keep the mechanism secret, and the enemy supposedly doesn't know the system. History's verdict on that bet is not close. DVD copy protection was a secret cipher; DeCSS broke it within a year of anyone bothering to look, and once broken it stayed broken, forever, for every disc. GSM's A5/1 cipher was proprietary by design; once academics got their hands on it, it fell to rainbow-table attacks that ran in seconds.

Diebold's voting-machine source code was never meant to be public either. When it leaked in 2003, Kohno et al. found the vulnerabilities had been sitting there the whole time: privilege escalation, broken cryptography, votes castable without detection. Obscurity hadn't fixed a single one of them. It had just kept anyone from noticing.

The counter-example is the infrastructure the internet actually runs on: OpenSSL, the Signal protocol, the Linux kernel — all public, all continuously attacked, all more trusted for it. Eric Raymond's formulation from 1997 still gets cited for a reason: "given enough eyeballs, all bugs are shallow."

It isn't a guarantee — Heartbleed sat unnoticed in open, widely-used OpenSSL for two years before anyone found it — but the comparison that matters is to the alternative, not to perfection: a bug hiding in public code can still be found by the next person who looks. A bug hiding behind a gate can only be found by whoever's allowed through it.

Restricting who gets to look at Claude Mythos or GPT-5.5-Cyber isn't a new security strategy. It's the same bet DVD studios and GSM carriers already made and lost, run again on a system an order of magnitude more consequential to get wrong.

07 Two Futures: Containment or Diffusion

Every export-control regime is a bet on which equilibrium the underlying technology will settle into — and the gatekeeping critique the previous section traced at the cyber-tools layer turns out to be the same bet, one layer up, for the models that write the software.

The 1990s Crypto Wars resolved in favor of diffusion: strong encryption became free, ambient infrastructure — open-source, peer-reviewed implementations like OpenSSL, BoringSSL, and libsodium are now the de facto standard for real-world deployment — embedded in every browser and messaging app, and the same national security agencies that once fought it now depend on it.

AI weights could resolve the same way — or they could not. Two scenarios are worth taking seriously, because the policy response each one demands looks almost nothing alike.

Two Eras, Thirty Years Apart

Laid side by side, the crypto wars of the 1990s and the AI weight wars of today share the same target artifact, the same core legal conflict, and the same regulatory outcome — only the vocabulary has changed.

The Closed Scenario: Containment Wins

In a closed future, ECCN 4E091 and its successors hold. Frontier capability above the compute threshold stays inside a small number of hyperscale API providers, protected by cryptographic attestation on the training hardware, cloud-level KYC on inference access, and a Foreign Direct Product Rule broad enough to reach any lab that ever touched a US chip or a US EDA tool. Open-weight releases at the frontier slow to a trickle and then stop; what circulates openly is capped well below the statutory threshold — good enough for commodity tasks, structurally behind the walled-garden frontier.

This is the scenario the hardware containment strategy and the ECCN framework are explicitly built to produce. It requires the attestation and telemetry layer described earlier to actually work at scale, across every foundry and cloud region, indefinitely — and it requires every major jurisdiction with fabrication capacity to keep enforcing it in lockstep, including under domestic political pressure to relax it, which is exactly the pressure that broke ITAR in 1999.

The Open Scenario: Diffusion Wins

In an open future, the containment apparatus is real but leaky in the way every predecessor was: it slows diffusion without stopping it. Algorithmic efficiency gains keep dragging the effective compute cost of a given capability level below the threshold faster than regulators can lower the threshold to compensate. Chinese labs continue shipping open weights as a matter of stated strategy rather than policy accident, and Western open-weight releases — under competitive pressure to avoid ceding developer ecosystems entirely — follow rather than lead. Frontier capability becomes ambient infrastructure within a few years of first appearing behind an API, the same way PGP-grade encryption did.

In this world, the API-gating and weight-control apparatus does not disappear — it just stops being the thing that matters. Governance work migrates entirely to the identity and compute layer this post has already described: KYC at the cloud provider, attestation on the silicon, and a planning assumption that once a capability exists anywhere, it exists everywhere within months. Decentralized inference pushes the same logic one layer up — once a request can be served by whichever node on a permissionless network happens to be online, there is no single API operator for a KYC regime to reach and no cloud account left to suspend.

Which Future Is More Likely?

History has a vote here, and it has already cast it once. The first Crypto Wars did not end in a stalemate; they ended in diffusion, so completely that the same agencies the 1990s controls were built to protect now rely on the encryption they once tried to contain. The Mythos episode is a small-scale replay of the same arc, compressed from years to weeks rather than resolved any differently: an order, a scramble, a reversal — not a permanent wall.

None of this makes containment pointless. It can still buy time — months or years during which frontier capability is harder to reach, which is exactly the interval a defender needs to build the next layer of protection. But betting the long-run architecture on numbers staying contained is betting against the only precedent this domain has ever produced.

08 Arguments For and Against Model Controls

The case for and against controlling AI model weights does not divide neatly along partisan or institutional lines. Some of the strongest skeptics of weight controls are also the strongest defenders of compute controls, and the two positions are not always reconcilable.

The pairs below set the two cases side by side, drawing on the framings the debate actually uses rather than a strawman version of either.

What to Govern

Does the Lead Hold?

The Cloud as Chokepoint

What Controls Buy You

Hardware Attestation

Who the Threshold Protects

Can You Take It Back?

Geopolitical Diffusion

The Output Surface

Read across each pair and the two positions are not always symmetric rebuttals — often they are arguments at different layers. Much of the "for" side is really arguing for governing compute infrastructure, closed APIs, or model outputs; much of the "against" side is arguing against governing the weights themselves, or against US-only curbs that cede open ecosystems abroad. Lennart Heim sits in both columns at once on the compute half, which is the tell: the live debate is less whether to control AI than which layer of the stack is controllable at all.

09 Past the Two-Player Game

Every pair above frames restriction as a move in a two-player game: Washington wants to keep its lead, Beijing wants to capture the ecosystem, and each side's "for" or "against" argument is really a bet on who benefits. That framing quietly assumes the thing worth arguing about is who controls the frontier — not whether the frontier itself, past some capability level, needs controlling regardless of who gets there first.

If the actual tail risk is a system that outstrips meaningful human oversight — the AGI scenario neither side's export-control apparatus was originally built for, and the one the industry's own containment efforts, like the Frontier Model Forum's safety standards work and the Seoul Frontier AI Safety Commitments' red-line thresholds, already address more directly than any export regime — then the compute thresholds, KYC layers, and hardware attestation described throughout this post stop being competitive weapons and start looking like the only technical infrastructure anyone has proposed for slowing an uncontrolled takeoff, no matter whose flag is on the datacenter.

Both capitals have already put this in writing once: the Bletchley Declaration, signed by the US, China, and 26 other governments in November 2023, commits every signatory to treat frontier-model risk as a shared problem rather than a national one — a commitment that sits uneasily next to the Washington-Beijing hedging catalogued earlier in this post.

None of the nine pairs above resolve if the frontier turns out to be existential rather than merely strategic.

A regime built to stop China — or anyone else — from catching up looks mechanically identical to a regime built to stop any actor, American or otherwise, from deploying something nobody can steer.

The bickering over whose export-control regime is more legitimate may simply be the wrong argument: the harder question is whether either capital would keep the machinery in place once it stopped being useful for winning.

10 Conclusions

The evolution from 1990s cryptography export controls to modern AI weight restrictions illustrates a foundational truth of the digital age: when technology takes the form of pure mathematics and executable code, border controls based on physical customs enforcement become obsolete.

The 1990s Crypto Wars proved that source code is a form of human expression that cannot be contained by classifying floppy disks as munitions. Today's regulatory efforts under frameworks like ECCN 4E091 demonstrate that while governments can restrict physical silicon foundries and monitor massive datacenters, attempting to outlaw the distribution of trained weight matrices faces the exact same legal and technical failure points.

As the AI ecosystem continues to evolve, the policy frameworks that succeed will be those that abandon the illusion of "outlawing numbers" and instead focus on transparent infrastructure governance, verifiable compute identity, and robust international standards.

None of this has to stay a US-China scoreboard, either. If the deeper risk on the horizon is AGI — a capability neither government can safely let anyone hold unilaterally — Washington and Beijing have a rarer opening than either capital's export-control rhetoric admits: treat compute governance as shared infrastructure rather than a contest, the way the Bletchley signatories already gestured at once.

The bickering over whose weights leak faster may be a distraction from the one regime both capitals might actually need.

Maybe the lesson of PGP was never really about cryptography. It was that a sufficiently determined regulator can control the silicon, and can control the cloud account — but in thirty years, from PGP's source code to a frontier model's weights, it has never once controlled the numbers themselves.

Lastly, this post has stayed with the technical and legal mechanics — export classifications, compute thresholds, the physics of leakage — deliberately setting aside the incentives of whoever decides what counts as dangerous enough to control in the first place. For a more cynical, macabre take on that question, a satirical dispatch from an invented frontier-lab comms lead argues the entire disclosure apparatus exists to sell dread, not to report it.

References

• Zimmermann, P. R. (1995). PGP: Source Code and Internals. MIT Press. Available at: philzimmermann.com
• Bernstein v. United States Department of State, 974 F. Supp. 1288 (N.D. Cal. 1997) (holding that encryption source code is speech protected by the First Amendment).
• Electronic Frontier Foundation (EFF). Legal Analysis of Encryption Export Controls and the ITAR Legacy. Historical Legal Archives.
• Bankston, K., Thompson, A. W., & Kehl, D. (2015). "Doomed to Repeat History? Lessons from the Crypto Wars of the 1990s." New America Foundation. Available at: newamerica.org
• Pyro. (2023). "A Brief History of the '90s Crypto Wars." Talk presented at Chaos Communication Camp, August 15, 2023. Available at: media.ccc.de

• U.S. Department of Commerce, Bureau of Industry and Security (BIS). Framework for Artificial Intelligence Diffusion & Interim Final Rule on Model Weight Controls (ECCN 4E091). January 2025 / May 2025 compliance updates.
• Heim, L. (2025). "Understanding the Artificial Intelligence Diffusion Framework: Can Export Controls Create a U.S.-Led Global Artificial Intelligence Ecosystem?" RAND Corporation, Perspective PEA3776-1. Available at: rand.org
• National Telecommunications and Information Administration (NTIA). (2024). "Dual-Use Foundation Models with Widely Available Model Weights." U.S. Department of Commerce, July 2024. Available at: ntia.gov
• Khawam, J., & Schnabel, T. (2025). "AI Model Outputs Demand the Attention of Export Control Agencies." Just Security, December 12, 2025. Available at: justsecurity.org
• Microsoft et al. (2026). "Open Weights and American AI Leadership." Industry Coalition Statement, July 24, 2026. Available at: microsoft.com

• Franceschi-Bicchierai, L. (2026). "From PGP to Mythos: A Brief History of Export Controls That Didn't Stop Anyone." TechCrunch, June 19, 2026. Available at: techcrunch.com
• Anthropic. (2026). "Statement on the US Government Directive to Suspend Access to Fable 5 and Mythos 5." Available at: anthropic.com
• Rozenshtein, A. (2026). "Alan Rozenshtein on Friday's Shocking Shutdown of Claude Fable 5." AI Summer, June 15, 2026. Available at: aisummer.org
• Kapoor, S. (2026). "Sayash Kapoor on Claude Mythos as Normal Technology." AI Summer, April 13, 2026. Available at: aisummer.org

• Anthropic. (2026). "Project Glasswing: An Initial Update." May 2026. Available at: anthropic.com
• Hutchins, M. (2026). "AI Gatekeeping Harms Cybersecurity, Open Source Is The Solution." YouTube. Available at: youtube.com
• UK AI Security Institute & US Center for AI Standards and Innovation (CAISI). (2026). "Preliminary Assessment of Kimi K3's Cyber Capabilities." July 24, 2026. Available at: nist.gov
• Lee, J. (2026). "The Illusion of Performance Secured Through Distillation: Kimi K3 Exposes Cyberattack Limitations." The Economy, July 27, 2026. Available at: economy.ac
• Aikido Security. (2026). Independent assessment of Kimi K3's vulnerability-detection performance. July 16, 2026.
• South China Morning Post. (2026). "China's Kimi K3 Significantly Below US Rivals in Hacking Power, UK-US Study Shows." Available at: scmp.com
• Otto, G., host. Slater, D., guest. (2026). "A Builder's View of the AI Arms Race." Safe Mode, CyberScoop. Available at: youtube.com
• Franceschi-Bicchierai, L. (2026). "How AI Guardrails Are Impeding the Work of Offensive Cybersecurity Researchers." TechCrunch, July 23, 2026. Available at: techcrunch.com
• Hughes, C., host. Saxe, J., guest. (2026). "Why Restricting AI Makes Us Less Secure." Resilient Cyber, July 21, 2026. Available at: resilientcyber.io and youtube.com
• Saxe, J. (2026). "Restrictive AI Cyber Policy Around Both Closed and Open Models Makes Us Way Less Safe." July 1, 2026. Available at: substack.com

• Kerckhoffs, A. (1883). La Cryptographie Militaire. Journal des Sciences Militaires. Available at: petitcolas.net
• Kohno, T., Stubblefield, A., Rubin, A. D., & Wallach, D. S. (2004). "Analysis of an Electronic Voting System." IEEE Symposium on Security and Privacy. Available at: avirubin.com
• Raymond, E. S. (1999). The Cathedral and the Bazaar. Formulation of Linus's Law. Available at: en.wikipedia.org

• Ministry of Commerce of the People's Republic of China (MOFCOM). Consultations on Export Controls for Advanced AI Models, Weights, and Chip Designs. Public Sector Review.
• Entrepreneur Asia Pacific / Financial Times. "China Weighs Export Curbs on Advanced AI Models and Chip Designs." Available at: apac.entrepreneur.com

• Baskaran, G., & Schwartz, M. (2026). "Rare Earth Export Restrictions One Year Later." CSIS, April 27, 2026. Available at: csis.org
• Malay Mail. (2025). "Nvidia Chips for DeepSeek? Three Men Charged With Fraud as Singapore Comes Under US Scrutiny." February 28, 2025. Available at: malaymail.com
• The Economy Editorial Board. (2026). "China Transshipment and the Southeast Asian Weak Link in Chip Controls." June 29, 2026. Available at: economy.ac