The exterior of the United States Department of Commerce in Washington, DC.

Alex Stamos on Why the US Should Lift Its Fable and Mythos Export Ban

President Donald J. Trump holds a cabinet meeting in the Cabinet Room Wednesday, May 27, 2026. (Official White House photo by Daniel Torok)

President Donald J. Trump holds a cabinet meeting in the Cabinet Room Wednesday, May 27, 2026. (Official White House 

Transparency and Accountability Gaps in Trump's New AI Executive Order

This features two images, the background image is a road with a zebra crossing. Overlaid is an image of a typical street with buildings either side and cars lined up on the side of the street. There are also trees and a large stretch of road which centers the image. The whole image has a purple filter and a pixel effect. 

AI, Privacy, and the Hidden Architecture of Harm from Inference

AI Am Over It by Nadia Piet & Archival Images of AI + AIxDESIGN / 

AI's Catastrophic Risk Isn't Rogue Machines, It's Cognitive Surrender

The image depicts a large, diverse crowd of miniature figures, representing a wide variety of people. The figures are painted in different colors, wearing various clothing styles, and some appear to be engaged in conversations or interactions. The focus of the image is on the middle part of the crowd, with the surrounding figures gradually blurring into the background, creating a sense of depth. The diversity of the figures, in terms of skin tones, attire, and activities, suggests themes related to social cohesion, diversity, and community.

Toward Representative AI Governance

A Meta sign at Meta Headquarters in Menlo Park, California, in January 2025.

Tech Workers Are Fighting Against Silicon Valley’s AI Push

3D image photo collage template sketch of an anonymous spyware business.

Canada Has a Precedent to Regulate Surveillance Pricing

Protesters march through downtown Memphis, Tennessee, carrying signs opposing Elon Musk and xAI during the "Get Out of Memphis" demonstration on October 4, 2025. (Photo by AUSTIN JOHNSON/AFP via Getty Images)

Addressing Regulatory Arbitrage in the AI Supply Chain

Brazilian President Luiz Inacio Lula da Silva holds a cabinet meeting at Planalto presidential palace in Brasilia, Brazil, Wednesday, June 3, 2026. (AP Photo/Eraldo Peres)

Big Tech's Proxy War Against Brazil's New Platform Accountability Rules

Members of the European Parliament Arba Kokalari and Michael McNamra pictured during the AI omnibus interinstitutional negotiations. / Photo: EP

Members of the European Parliament and Arba Kokalari and Michael McNamra pictured during the AI omnibus interinstitutional negotiations. / Photo: EP

EU Lawmakers Move to Ban AI Nudifiers, but Enforcement Remains Unclear

An array of colorful, fossil-like data imprints representing the static nature of AI models, laden with outdated contexts and biases.

Luke Conroy and Anne Fehres & AI4Media / 

A Case Against Forever: Why Cloud and Social Media Need Inactivity-Based Deletions

Howard Lutnick, US Secretary of Commerce, testifies before the House Committee on Appropriations Subcommittee on Commerce, Justice, Science, and Related Agencies in the Rayburn House Office Building in Washington, DC on Thursday, June 5, 2025. (Photo by Aaron Schwartz/Sipa USA)

Did the US Government Just Set An AI Export Precedent by Blocking Mythos?

An abstract image based on the US Constitution

Earning a Social License for Transformative AI

BRUSSELS, BELGIUM—JUNE 3: EU Commissioner for Tech Sovereignty, Security and Democracy Henna Virkkunen introduces the European Technological Sovereignty Package, featuring the Chips Act 2.0, Cloud and AI Development Act, and related strategies to reduce the EU's dependence on non-European suppliers for critical digital technologies. (Photo by Thierry Monasse/Getty Images)

Europe’s AI Sovereignty Problem Runs Far Deeper Than Frontier Access

Rep. Lori Trahan (D-Mass.) speaks during an interview with POLITICO in her office on Capitol Hill on May 21, 2026. (Francis Chung/POLITICO via AP Images)

Unpacking the Great American Artificial Intelligence Act of 2026

Anthropic's Co-Founder and CEO, Dario Amodei on stage at the Code with Claude developer conference on Wednesday, May 6, 2026 in San Francisco. (Don Feria/AP Content Services for Anthropic)

Anthropic's Mythos Recall and the White House's Missing AI Safety Playbook

G7 Summit Set to Kick Off Amidst Allies' Widening Rift Over AI Sovereignty

A collage featuring a vintage illustration of a woman’s head mapped with labeled sections resembling a phrenology chart. The mapped sections are overlaid by a neutral network diagram– depicting crisscrossing black lines. Two anonymous hands extend from the left side, pulling on two wires from the diagram.  In the background is a panel of the Turing Machine with numerous knobs and switches, highlighting a connection between the history of computing, psychology, biology, and artificial intelligence. 

Personifying AI Harms People and Protects Companies

Helen McEntee, Ireland's Minister for Foreign Affairs and Trade, outlines priorities for Ireland's upcoming EU Council Presidency on June 10. Source: Irish Presidency of the Council of the EU 2026.

Ireland Targets AI Omnibus, Child Safety in EU Presidency Agenda

Northwest view up to the pediment, rotunda, and dome of the California State Capitol in Sacramento. (Radomianin / Wikimedia Commons)

Northwest view up to the pediment, rotunda, and dome of the California State Capitol in Sacramento. 

 States Step in Where Congress Stalls on AI Safeguards for Kids

, "Promoting Advanced Artificial Intelligence Innovation and Security." On its face, the order is a cybersecurity measure: it directs federal agencies to harden their systems against AI-enabled threats, evaluate advanced cyber capabilities, and create a clearinghouse for sharing vulnerability information. And, it asks the United States Department of Justice to go after criminals who use AI for cybercrime. Few people would object to any of that in isolation. Cyber defense for national security systems, federal civilian systems, and critical infrastructure is important.

However, the EO should attract more critical attention due to its substantive misdirection and 

 of approach, and because of the primary agency it authorizes—the National Security Agency, an intelligence agency of the Department of Defense.

We should ask who gets to evaluate the most powerful AI systems in the country, on what terms, who gets to find out what those evaluations conclude, and how the opaqueness of the system undermines public trust in the US and abroad.

A classified yardstick for "covered frontier models"

The EO proposes a framework for assessing AI models judged to have advanced cyber capabilities, such as the ability to discover or exploit software vulnerabilities at scale, before the model’s release. The Treasury Department, the NSA (acting through the Secretary of Defense), and the Cybersecurity and Infrastructure Administration (CISA) are delegated to build a benchmarking process that determines the threshold at which a model earns "covered frontier model" designation. However, that benchmarking process will then be classified, and the NSA Director will make the final call on whether a given model crosses the line. The government will design the voluntary framework with input from industry players.

Classifying the benchmark prevents adversaries from reverse-engineering which exploits the government can and can't detect. But in practice, the EO creates a situation where companies that participate will presumably learn how their own models score, while the public will be kept in the dark. Possibly, even the developers of these models who do not carry security clearance may not know. Even many of the cybersecurity professionals working in major American companies providing critical infrastructure services will not know.

In effect, an intelligence agency is being positioned not just to assess frontier AI systems for cyber risk, but to help decide which outside organizations get privileged early access to the most capable models in the world.

In practice, the EO disregards transparency, due process and democratic accountability. Layered on top of this opaque process is a voluntary arrangement. There is no requirement for unclassified summary reporting to Congress, no role for the Government Accountability Office, no ability to acquire information through freedom of information requests, either of the benchmarking criteria or the results. Smaller AI companies, academic researchers, journalists, and civil society organizations who study AI risk will have no way to know what the threshold is, how it was set, or how consistently it is applied.

, “[g]oing forward, the gravest questions about AI’s military, cyber, and social power will be answered through a classified review and private collaboration.” Such disregard for transparency and due process also opens the door for the Trump administration to take interventionist steps toward companies.

Compare this to other domains where the government evaluates products for public safety (drug approvals, vehicle safety, environmental permitting), all of which involve some combination of published criteria, notice-and-comment processes, and records that can eventually be reviewed by courts, journalists, or independent experts. The EO places the most consequential judgments about powerful AI systems almost entirely inside the classified world of an intelligence agency whose core mission and culture are built around secrecy. Secrecy leads to decisions which can undermine the interests of the public. The EO does not simply create a democratic accountability problem; it also creates practical oversight problems. Blackbox decisions make it difficult to contest agency decisions.

If anyone thinks the EO’s transparency logic will not repeat itself, only days after the EO, 

 of the administration asking the Center for AI Standards and Innovation (CAISI) to “stop issuing public reports

 of its model assessments should be clear evidence. As I 

 elsewhere, the National Institute of Standards and Technology (NIST) and CAISI are civilian entities, with public-facing work, and with missions to advance “measurement science, standards, and technology” and “foster technological advancements that benefit society.” Yet, their work is now being censored.

"Unlawful access" versus the broader data problem

The EO asks prosecutors to treat AI-enabled hacking as a priority within existing laws. The order does address data, yet it says nothing about the mass scraping of personal information used to train frontier models, the profiling and inference capabilities those models enable, or the privacy implications for government access (for example the NSA). The government gains early, privileged access to systems trained on enormous quantities of data about ordinary citizens. Most concerning is that the EO focuses only on cyber risks, while leaving out any mention of privacy, civil liberties, or public safety. By framing "AI and data" almost entirely as a cybercrime issue, the order sidesteps the implications for surveillance, data brokerage, and behavioral profiling by both government and corporations. The government 

 align policy with civil liberties and democratic values.

Why this matters for trust at home and abroad

The EO pre-release model review framework is voluntary, and explicitly disclaims any “mandatory licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models.” Voluntariness has obvious appeal in a political environment focused on avoiding regulation. But it also means the entire system depends on companies choosing to participate or move in tandem with administration’s goals. Through the powers bestowed by this EO, the administration can make winners and losers. Meanwhile, Defense Secretary Pete Hegseth 

 on social media that his department “kicked @AnthropicAI out of our building—forever.”

CAISI already has voluntary agreements with AI labs, runs pre-deployment evaluations and collaborates with US allies. The correct direction from the government should have been an EO establishing a robust and public evaluation standard for AI systems that would strengthen trust, enhance legal certainty and make American AI stack trustworthy. Instead, the current approach strengthens the position of intelligence agencies and a handful of powerful companies while leaving everyone else in the dark. What is at stake, right now, is replacing the public interest with the interests of the few, and dismantling existing public reporting infrastructures.

The strategy is also inconsistent with US efforts to promote US-made AI solutions. Secret and ad-hoc decisions create ambiguity and legal uncertainty. Very few foreign businesses will be comfortable depending heavily on AI models which can be unplugged overnight. Similarly, very few foreign governments will trust the NSA to certify AI systems for their use. In effect, the EO and future decisions dependent on it are more likely to alienate US allies and encourage countries to diversify their AI model options.

Varsha Bansal is a fellow at Tech Policy Press

A Meta sign at Meta Headquarters in Menlo Park, California, in January 2025. Shutterstock

On May 12, Meta employees in at least five US offices posted flyers asking workers to come together and sign a petition against the company’s new Model Capability Initiative (MCI)—which allows Meta to collect its employees’ computer use data to train AI models. Over 1,600 workers 

 the petition. Earlier in May, Google DeepMind workers in the UK 

 in a bid to fight against the company providing AI for military use. In April, over 600 of the laid off Oracle employees 

 asking the company for higher severance and longer healthcare — after they came together to discuss their issues. They claim that Oracle was using them to train AI systems, 

Since 2025, close to 400,000 tech workers 

, with several explicitly fired due their company’s increased focus on artificial intelligence. At the same time, many of these companies have reported 

. This paradox has shattered a long-held assumption: that white-collar tech workers don’t need unions.

There’s a tech worker movement brewing across companies and continents. As tech companies embrace AI — forcing workers to use it, using it to surveil them, or justify firing them because of it — more workers are coming together to organize and fight back as they feel they are losing influence over decisions that affect their jobs. This collective action is their way to get back the voice they used to have at their workplace, more than half a dozen tech workers told Tech Policy Press.

“Most people coming in right now are interested in unionizing,” said Kaitlin Cort, founder of a new organizing group for tech workers impacted by AI called What We Will. “That was not the case before.”

Meta, Alphabet and Oracle did not respond to a request for comment by Tech Policy Press.

The past few months have been demoralizing for Meta workers. First, they were told their computer usage including mouse movements and keystrokes 

 just before the company let go of around 10% of its workforce in May. The morale is so low, that some of the workers drafted to an AI team, which they say involves data labelling work for Meta’s AI model, exchanged their frustration in internal chat conversations with their colleagues that they’d rather be laid off. “Getting drafted, can I switch with someone getting laid off instead?” posted a Meta worker on this internal chat, viewed by Tech Policy Press.

It was around this sentiment that one Meta worker in London realized that they had two options: they could either quit or do something about this situation. They chose the latter.

Even until recently, most of their colleagues didn’t feel the need to organize. “They just felt like high pay, chance of layoff, fair deal, I'll take it,” said this worker, who requested anonymity due to fear of professional reprisal. “But when it’s high pay, chance of layoff, and all the other stuff, invasive monitoring, training these various questionable models, and being treated with absolute disrespect and no dignity — now people are ready.”

This worker decided to band together with others to organize. They changed their name on internal online platforms to “Union Rep” and started discussing with colleagues about the options they had to fight back, and that they only need 500 people to get signed up and get recognized as a union. “We have a path,” this worker said. “Let's drive towards it.”

They reached out to all the unions possible, and teamed up with United Tech and Allied Workers (UTAW), a branch of the Communications Workers Union. “We're a few weeks in, we’ve got a good number of sign ups,” said this Meta worker. “It’s looking positive. Our next stage really is trying to just go from hundreds to thousands. My goal is to build large support that can actually change what the company is doing.”

Meanwhile, Meta workers’ pushback against MCI seemed to have had some impact: earlier this month, Meta said they will allow employees to 

pause data collection for up to 30 minutes at a time

The different waves of tech worker organizing

There have been a few waves of tech workers organizing in the past, says Emily Mazo, a tech labor collective action researcher at Columbia University, with two distinct periods in recent years. One took place from roughly 2014 to 2019, when workers mostly organized around external issues. Their concerns ranged from immigration policy and government contracts, to race and gender discrimination. That wave, Mazo explains, led into a second wave of organizing from 2019 to 2022 which took on a more labor-oriented form. “Tech workers who had engaged in workplace protest on social issues had largely either experienced retaliation or been ignored,” said Mazo. “And this led to an understanding that tech workers and their bosses were not aligned, and did not have the same goals.” 

Mazo explains that armed with this new understanding, tech workers began taking actions aimed at improving their own working conditions or attempts at exerting more control over their workplaces, such as salary transparency projects, open letters demanding reinstatement for fired workers, or organizing unions. The first recognized majority union of software engineers in the US 

. Today, the largest tech worker unions in the US are the New York Times Tech Guild 

, and more recently, the tech workers of the University of California system, 

, who joined an existing university employees union.

This current wave of tech organizing is qualitatively different from the first two waves, according to Mazo. Even though there are similarities—with Google DeepMind unionization push being an effort to gain more control over the AI technology and Meta action being made up of technical workers standing together to protest changes to their working conditions, the current context of the tech labor market has changed significantly. “Because of the rolling layoffs since late 2022, and the permission structure for laying off workers created by AI companies promising productivity gains and automation of programmers, tech workers feel much more precarious now than they did five or ten years ago,” explains Mazo.

At Google, it’s this very precarity that has fueled workers to come together through the Alphabet Workers Union, which was formed in 2021.

According to Dan Freedman, a Google software engineer of 14 years and an AWU member, the company has changed dramatically: from being open to employee suggestions and questions, to now having an AI mandate that has dialed up the pressure immensely. “It just feels like it’s a vice from both sides of do more work and use this thing that doesn't work to do that work,” said Freedman about the pressure at work to use AI. What makes it worse for him is that their engineering culture that would pride in careful, deliberate work has now been replaced with this need for speed. “The guidance from leadership is: that doesn't matter anymore, ship it now.”

All this has led to feeling anxious about losing their job – even though it’s a job that doesn’t feel meaningful anymore. What makes this situation worse, Freedman explains, is the lack of a financial cushion because previously these workers had several job alternatives, but that’s not the same anymore. “Everything feels so much more fragile,” he said.

This kind of pressure at work has led to conversations around organizing double in the last year, said Freedman. The union has been focused on a 

, asking the company to offer voluntary exit packages before forcing workers to leave. He said they are also asking the company to end performance rating quotas and protections for workers on visas. “Once we feel like we have a solid understanding with the company of how our jobs are going to be handled,” he said, “then we can start making more powerful demands.”

In April, when Oracle’s laid off workers started looking at ways to organize, they were flooded with challenges due to a lack of proper infrastructure and playbook. Through What We Will’s Cort, these workers from different countries formed a Slack channel that grew to having hundreds of members. They collectively drafted a letter to Oracle asking for better severance, which, they said, was lower than the industry standard. But, the company 

 saying it would only accept individual letters. They sent those too, but nothing happened.

“You don't know who you're talking to that can actually make a decision,” said one organizer, who was laid off from Oracle, requesting anonymity. This worker explained that Oracle's internal system routes their requests through a ticketing portal and these workers would receive a reply from an anonymous HR representative with no explanation. “That's it,” he said.

Cort, who has been engaging with workers from different companies, including Oracle, says there is no established model for this kind of organizing. Each company presents a different set of issues and conditions. While Oracle workers are demanding better severance, Meta workers are fighting surveillance, and DeepMind workers are against AI military contracts. “Every company is kind of different,” Cort said, “and people are at very different stages.”

She talks to several workers each day. Some come to her with a single idea and no colleagues yet convinced; others have already quietly spoken to ten or more coworkers and are ready to move. “The materials that are out are often not specific to the tech worker context,” said Cort. “So we’re building materials that really help align with the broader movement in tech worker organizing.”

Mazo agrees. She explained that the private sector union membership in the tech industry hovers just under 6%. While self-organization is part of a healthy democracy, Mazo believes that organizing some policies can be implemented to improve the working conditions of these workers and create the guardrails against AI harms that they are protesting.

“Policies protecting workers from replacement from automation and policies preventing military use of AI would answer these workers’ demands,” she said, referring to Google DeepMind and Meta. “But we could go a step further, and implement policies requiring board seats filled by elected worker representatives, or other worker decision-making bodies inside of tech companies: these would also provide these workers the ability to make the changes they are demanding.”

Cort is hopeful about the future. “There’s just so many more people from various companies that are starting the process,” she said. “And we're hoping, a year from now, we'll have a very different looking industry.”

Audio of this conversation is available via your favorite podcast service.

 from the United States Department of Commerce notifying the company that the government had issued an export control directive forcing it to suspend all access to its AI models Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including Anthropic's own foreign-national employees. To comply, the company disabled access to both models for all its customers. The Wall Street Journal 

 the episode “one of the most powerful examples yet of US government intervention in the AI race.”

The White House move has left many experts baffled. And, it is raising alarms in foreign capitals about the wisdom of relying on American AI, suggesting the US will operate ad hoc, with access to advanced models revoked on a case-by-case basis. Against that backdrop, a group of cybersecurity leaders organized by 

 has urged the administration to reverse course 

. Currently, Stamos is chief product officer at an AI security startup called Corridor. Previously, he was chief security officer at Facebook, before he left to found the Stanford Internet Observatory. I caught up with him on Tuesday.

What follows is a lightly edited transcript of the discussion.

Hi, my name is Alex Stamos. I'm the chief product officer at Corridor.

Alex, I'm pleased you could join me today. We're going to talk a little bit about the mess around Mythos and all the things that are happening in Washington DC and elsewhere as a result of the White House forcing Anthropic to take Fable 5 and Mythos 5 offline. You helped coordinate 

 to Secretary Commerce Howard Lutnick and National Cyber Director Sean Cairncross saying Mythos class models are quite good but not uniquely good at finding and weaponizing vulnerabilities. I want to talk about the purpose of the letter more generally, but I want to start there. Seems important to unpack why everyone has been describing these Mythos models as so powerful is finding thousands and thousands of unknown vulnerabilities that have been lurking around in code for decades. Why do you state that they are not uniquely good?

Well, to be clear, Mythos, which is not the model that any normal person has access to, is probably the best model for bug finding, but it is not the unbeatable cyber God that everybody makes it out to be. As a number of people have pointed out, Anthropic has, to a certain extent, created the situation for themselves by playing up Mythos as something that is spectacularly beyond every other model in its capabilities. It does really well in all of the evaluations that we have access to. The security evaluation frameworks that we have are not fantastic to be honest. Mythos does significantly better in some, a little bit better in others, but what it does really well in is writing working exploits. But Mythos has never itself been released to the public. Fable was released. Fable has a couple of significant differences than Mythos. They come from the same base.

They're the same class of model, but Fable has been retrained to specifically refuse to do things that are offensive in nature and that might cause harm. So that is not true for Mythos. You can ask Mythos, write me an exploit. He'll write you an exploit. Fable at a deep level is supposed to refuse that for you. And the other thing Anthropic did was they put a front end classifier in front of Fable that is supposed to look at the prompt. So this is a much dumber algorithm than a large language model that should be harder to trick, that will look at what you ask it to do and see whether you're asking to do something that's really malicious. And if so, it will just kind of kill the connection. So instead of having the model have a kind of deep think about what it's doing, which is smart but also can be tricked because it's smart, you have kind of the dumb thing upfront that takes a look in this classifier and sees if something malicious happening.

And how this whole thing kicked off was it turns out Amazon was doing testing to try to get stuff past that front classifier and found some ways to get past it. What our letter is saying is other models can do a lot of damage and what it turns out is the things that Amazon were able to ask Fable to do, it turns out other models are able to do those things. It looks like we have no evidence that Amazon was able to ask Fable to do anything that the Opus series can't do, that GPT 5.5 can't do. And that turns out Chinese models can't do themselves, which raises the question of why this huge freakout if the quote unquote jailbreak allows you to ask Fable to do things that a huge swath of publicly available models can also do.

I mean, I do understand that the independent researchers who did analyze the Amazon report concluded it didn't reach the worst case of full jailbreak of producing working attack code. What does explain then this plead overstated reading of Amazon's findings? What does it sort of suggest to you when on behind the scenes here?

So first off, I want to say I don't think Amazon did anything wrong in doing the research. Amazon runs Anthropic's models. So they have a shared responsibility model here with Anthropic. When they are hosting Anthropic's models, they have to do some of the security and safety work themselves. That includes in any situation where the US government is accessing Anthropic models, is my understanding that that is running on Amazon hardware. If the NSA is using Anthropic's models, if they're using Mythos, that is running at AWS top secret cloud, for example. And so those are quite possibly Amazon employees who are the ones who are looking at the output of those classifiers, for example. And so it is quite possible this is the kind of testing that Amazon would normally do of any model that they're deploying within their cloud. So what was like kind of I think a reasonable back and forth on what is a undefined standard, which is like, what should the front end prompt classifier prevent or not prevent in this situation got turned into this huge brouhaha.

And if you read Fable's model card, they actually go into some detail about what they do and do not want to allow from a cyber perspective. Anthropic never says that Fable will never do any cyber work. If you have a model that writes code, it needs to understand code security. It needs to be able to find bugs because there's no way it will be able to write code securely if it can't then look at that code and find its own flaws. And so Anthropic will allow Fable to look for individual flaws. And that is what Amazon was able to get it to do was to find individual CVEs. They're also able to get it to create individual proof of concept code, which then you can call and exploit. What they weren't able to get to do was what Mythos is really good at doing, which is you can feed Mythos the entire Linux kernel or all of Firefox or something like that.

And then you can have it grind for hours and hours and hours, which turns out to be spectacularly expensive from a token basis. Palo Alto Networks famously said that they've spent like a million dollars on Mythos grinding through their code base, but you can have Mythos look for hours and hours on a huge code base and then find a bunch of bugs and then you can ask it to write full working exploit chains. And Amazon does not claim that they were able to get it to do that. And so that's where this whole breakdown is you can also ask GPT 5.5 to do that and it won't refuse you at all. There is no front end classifier to make it not do that. Opus 4.8 will just do it no problem. And so that's like the kind of crazy thing here is, yeah, they were able to get past a protection, but it's a protection that doesn't even exist on other models.

There's a charitable reading and a less charitable reading of what happened in the administration. The charitable reading is that they are very concerned about cybersecurity and they kind of over freaked out on something they didn't totally understand. The less charitable reading is that they are punishing a politically disfavored company that has not bent the knee and they were just looking for an excuse and this gave them the excuse to once again punish Anthropic.

So I want you, as a CISO, I think you've just answered this in many ways, but in more basic terms for any listener that might not be thinking certainly about cybersecurity in the way that you are, what could a security officer at a hospital or a utility or another company do with Fable last Wednesday that they can't do today?

Well, they can't do anything with Fable today, right? We're really lucky that Fable was only out for like a week before it was pulled. Otherwise, Friday would have been a really tough day. We should probably get into the long term implications of this for the US AI industry. But one of the things we talk about in the letter is we need to deal with the fact that AI models have gone very good at finding bugs. And this is the other thing when we talk about not being uniquely good. Again, Mythos is almost certainly the best model out there for finding bugs, but the real Rubicon was crossed last year, probably with like the Opus 4.5 level, the GPT5 series. At that moment, these models became better than human beings at finding bugs. And it's not just that they're better than any individual human. They're also way, way, way cheaper and they're way more scalable.

So there are individual bug finders that I would still take over one of these systems, but there's only a couple of them, right? There's only a couple of these guys and I know them all and they're spectacularly expensive and even though how good they are, they're very slow, right? It takes them weeks or months to find one bug. And so while I would love to have Dave Aitel just like work in my garage all day, realistically Mythos is way faster and way, way cheaper than what you'd have to pay for somebody of that caliber and you can just scale Mythos infinitely if you have the Nvidia chips and you have the power and that's the crazy thing about these systems. And again, it's not just Mythos. It's starting with the Opus series last year that you have LLMs that are as good or better than the best bug finders in the world.

And you can see that from if you were... People in the security industry started to notice that either they themselves or you're watching Twitter and you're watching Bug Bounties and you're watching what's going on, the Pone to Own competitions and such and all of a sudden these like 22 year old bug finders who were never that good, it's like imagine you go to like a high school track meet and all of a sudden everybody is posting world record times all the time, right? You'd be like, "Oh, okay, these people are all juicing." There's some kind of like new steroid that everybody's taking. That's what it was like last year is that all of a sudden every mediocre athlete was all of a sudden a world record holder. Every 22 year old, every bug finder was all of a sudden finding bugs that are spectacularly complicated and writing this really great exploit code and they're doing it over and over and over again, often in code that's been looked at by bug finders for 10, 15, 20 years.

And so that's what AI does is it just... It's not something that generally somebody who knows nothing about anything can use, but if you know a little bit about security, you can now take one of these models, you can find a piece of... The Linux kernel would not be a good option now it was last year, but you can find some esoteric piece of open source still and you can probably find 10 bugs and you can narrow it down to one or two that are really critical, right? Working exploit code and then go exploit it all day. People are doing that every single day and so that doesn't require Mythos, doesn't require Fable, that's just happening. And so that's the reality we're living with right now and a big open question is how long are we going to live with that reality? Is there one finite pool of flaws that we are now burning down and that will eventually run out or as these models get better, will these pools kind of be renewed over and over again over the next several years?

No matter what, we're probably not just going to be able to patch our way out of this. And so defenders are having to build their defenses to be able to respond to these issues and to do the offense much more quickly and they can only do that with AI. And so that's why we really both need to find the bugs really quickly. That's why Anthropic's been providing these capabilities via Project Glasswing, OpenAI and Google do kind of the equivalent where they let defenders and open source projects and such use their models to find bugs. And so we need to find and fix bugs, but we also need to build defensive systems that use these models to do things other than just find bugs to automate our operation centers, to automate detection and such. And Fable was looking really good for that until it got yanked off the market.

You mentioned the long-term implications of this, what it means for American leadership is a concern in your letter. I guess when you do step back from it, this does seem like the first test of what the government does about a frontier model's risks. In this case, the Trump administration acted after deployment. There is no specified standard here. This was ad hoc. I don't think anybody would argue that it wasn't. What is the precedent here? I mean, is there kind of any sense that we can move forward from this in a productive way?

Yeah. It's a number of people in Silicon Valley who really aligned their politics around the idea that Joe Biden was possibly going to regulate and then if Kamala Harris had been elected, there'd be too much AI regulation and that was around some kind of like voluntary measures around looking at AI. And here we are with a model being yanked because of a standard that's never been written down that you can't follow, that you have no ability to predict and it's still down as of Tuesday evening because Anthropic has no idea of what they can do to possibly make the administration happy because there's no actual technical reason for it, right? It's just vibes-based regulation. It's really, really bad for the US tech industry and the US AI industry. It means that political risk has been interjected into the use of a US AI model. 

Niels Provos, who is a very well respected security engineer, he built a great deal of the security infrastructure at Google. He's one of my heroes because he's retired now. He makes like Viking swords. You should look up his 

. It's very impressive. I've been in his metal shop in his garage. It's pretty awesome, but he also writes stuff about this kind of stuff. He wrote a 

 about this, which is that now if you are a company either in the United States, but especially around the world, you will at least have a backup of an open source model, an open weight model because you cannot rely upon American AI providers anymore to do anything critical for you. Like I said, it was very good that Fable had only been out for a week. So it's really not enough time for people to have worked Fable into their critical path for systems that are super important. If say Opus 48 got pulled right now, that would cause Sev1s across the world.

Company systems would go down all over the place because most companies do not have kind of automatic LLM routers set up with backup providers, the ability to fall back to lesser models. If they do have the ability to fall back to models, they haven't actually tuned their prompts for that. They haven't tested what happens when they fall back to those other models. So all of a sudden you have like degraded capabilities, but you don't actually have the predictability of what's going to happen. It would be a real mess. So this interjection of unreliability of one of the most important US champions is really bad. It tells the world you cannot rely upon American tech companies. It's kind of like if somebody found a small web bug, a cross site scripting bug in Amazon.com and the government forced Amazon to shut down US East One as a result. That would really strike fear in the heart of any AWS customer and would really hurt the US cloud industry. That's effectively what happened here.

I want to ask you about the executive order. I mean, there's this idea of a voluntary 30-day classified testing process in it. I guess that was shortened from the version that was shelved before it was eventually released. In this case, we understand commerce moved against Fable using this export control directive. I don't think anybody's actually seen the documents or any of the specifics of that.

 now, right? I think the letter leaked, is what that looks like.

Okay. I'll take a look at that. I haven't seen that yet myself, but I don't know is this mechanism sufficient? Could this potentially solve this? What are the problems with the EO as you see it or does it fit the purpose?

Well, Anthropic had permission to release Fable and then that permission was yanked without any kind of warning on a Friday afternoon against no standard. If the FAA grounds a Boeing plane, Boeing knows why, right? FAA has voluminous rules that you have to follow. They have their employees sitting at Boeing headquarters, embedded in Boeing's factories. They have a constant back and forth with every manufacturer, but I'm just going to use Boeing as an example. Something has to go really wrong for them to ground a plane, right? And Boeing knows both why the plane was grounded and then they know exactly what they have to do to get it ungrounded. Anthropic has no idea how to get their model turned back on because there's no written standard here. This is not how the law is supposed to work in the United States of America. We are supposed to have laws that are written down, that are predictable that you can follow and then due process in the enforcement of that law.

If there was due process here, then most of the commercial models in the United States would be banned right now because almost every other commercial model can do what they are accusing Fable of being able to do here and it makes no sense because there's a ton of Chinese models that can do it too. So there's no possible national security argument for the action that was taken here. And so I think that's one of the problems of why it can't be turned on because the administration has taken a step for which there's no justification and for which then if their standard is Fable can never do anything cybersecurity related, then that is a ridiculous standard. It's also one they can't really justify because how do you justify that against all of the other models that are out there? And so I don't know how the White House backs down after setting such a spectacularly high standard without any kind of written justification.

It's quite possible we end up just in the lawsuit where Anthropic challenges the legal authority for them to do this. My understanding is the authority under IEEPA to do this is extremely, extremely thin. I don't think Anthropic wants to be in another legal fight on the verge of a potential IPO, but that might be their only option here if the White House doesn't find some way to back down.

I guess I'm wondering about the scenario that the White House seems to want to put in place with this kind of voluntary model, the different pieces of that, the involvement of the NSA, the kind of turning this into a sort of intelligence question almost primarily. Are these models kind of... Do they cross the threshold from a national security perspective being the kind of primary question that everyone's asking? I suspect that means that it'd be very hard to ultimately get access to the type of documentation or the kind of public understanding of where the risks are. Your example about the airplanes, for instance, we have mechanisms to see that work. The Congress gets to follow that. Regulatory agencies file documents, people can FOIA things. Is any of that going to necessarily happen if we kind of, I don't know, leave this all up to the three letter agencies and a handful of kind of White House connected bits and pieces?

Yeah, I think that would... You're right, that would be a really non-transparent and a really silly way to do this. One, there's an incredible arrogance of this idea that the embedded in all of this is the idea that the United States is far, far ahead of everybody else in our foundation models. Just today, a model called GLM 5.2 was released by Z.ai, which is a Chinese lab. This is a open weight model. It is MIT licensed. Anybody can download the weights and use it however they want. This model is only a couple percentage points behind OPUS 4.8 and a bunch of coding tasks. So it is by far the best open weight model for a bunch of coding tasks and is only a tiny little percentage point behind Opus 4.8 and lots of different tasks. This is going to be revolutionary for lots of people because practically it's not something that it's a very, very large model.

You cannot run it on normal hardware at home, but you can run it very cheaply at a number of providers. You don't have to run it at a Chinese data center, but you can run it in an American data center and people are going to be doing that because doing so will be much, much cheaper than using Opus 4.8, which is quite expensive. What is its security capabilities? There's no evals out yet, but we'll get them soon. It will be very interesting to see if its security capabilities are close to Opus 4.8. I guarantee it can do all the things that Fable was given the death penalty for. And so this idea that we should be doing these intense secret evaluations in Fort Meade while the Chinese are apparently able to do whatever they want and to ship these models and to lap the American AI industry is well beyond anything that was ever considered by the Biden administration and is really, really going to slow down innovation in the United States.

I think the Chinese are laughing at us in Beijing that we are kneecapping the AI industry at the moment of maximum pressure from the most aggressive adversary we have faced since the fall of the Soviet Union, perhaps even more aggressive than the Soviet Union if you think from an actual economic powerhouse perspective. And this is a really critical race for us to at least stay equal in. And so the idea that we have to control, control, control these models because we are obviously ahead is not so obvious to me and it's not so obvious to people who actually work in AI. It seems obvious to people in DC, but that is not based upon any kind of empirical fact.

So if you had 15 minutes with Lutnick and Cairncross, others, what would you ask them to do differently right now? How would you ask them to resolve this? What would you tell them they should do next?

So I would tell them that I believe Anthropic has already made small tweaks to the classifier. I would say call that a victory. You can call it whatever you want, but you can say that you won, that you got Anthropic to make fixes, take away the export restrictions, and then move towards a regime where there are written safety rules that are imposed fairly and that are only imposed... That are enforced specifically on the ability to create full usable exploit chains. The ability to find bugs is become really cheap, right? It is the ability to create actual real working exploits that is what we should be concerned about at this point. In a year, this will all seem silly because the off the shelf open-weight Chinese stuff will be way past mythos, but for this moment, that is probably what we need to be worrying about.

And then I would tell them what you need to be thinking about is not controlling these models. It is getting them in the hands of more American defenders. We are in a race against our adversaries to find and fix these bugs. We are in a race against our adversaries to build defenses and you are thinking about this completely the wrong way. You think we are winning. We are losing. So start thinking that we are behind and need to catch up. Do not pretend that we are way ahead and need to protect our place in the race. Start trying to catch up because you did something terrible last week and you kneecapped one of America's great champions. I know you don't like them, that you think they're San Francisco liberals, but they are one of the greatest companies that this country have ever produced. And if you destroy them, you will absolutely destroy the ability of the United States to compete against the People's Republic of China and you will give up the 21st century to the People's Republic of China.

You need to understand that and the Trump administration will be known as the presidential administration who lost the 21st century to China.

Alex, do you believe that we are in that type of existential race? And do you think that's where we're headed with this? I mean, I don't know. I struggle sometimes with how far to take this particular narrative. Is that really the case, where it's zero-sum in this way? Do you see it that way?

I don't think it's totally zero-sum, but I don't think we can afford to just seed the field. I mean, I think what's going to happen is we will reach some kind of stable equilibrium where both the United States and China will end up with champions who have good enough models that are good enough for most things. I don't think it is okay for us to end up in a situation where US companies are just completely lapped. I think that would be an extremely bad outcome for us. It's not zero-sum in the same way other kind of races have been in that there can only be one winner, but I also think it would be a really bad outcome for the US to end up in a situation where our labs are not allowed to move forward and then we wake up one day and most of the world is running on Alibaba and Moonlight and Z.ai and such. And that would be, I think, a really bad outcome, not just for America, but honestly for the world.

And I think one of the things I struggle with these days is everyone's talking about democratic AI and the kind of American alternative to Chinese authoritarianism and repression. I'm not so convinced that our democracy is as strong as we might like it to be, necessarily that we're going to end up with a happy outcome in this country as well, which makes me, I don't know, almost concerned about investing too much in the idea that we're the true alternative and that we must retain that scenario.

Well, unfortunately for the world, there's not a lot of alternatives, right? Mistral isn't really in the game and that's basically it, right? It's the three big US companies and four or five Chinese labs are really the only ones who are anywhere in the game at this moment. I wish this was like other situations where there is some nice cute Finnish alternative run by some cyberpunks with cute hair, but it's just like it's too capital and cost and research intensive for it to be the kind of technology. As of this moment, it's not the kind of thing that some courageous cipher punks can do in a garage at this moment at least. It's still something that it costs billions and billions of dollars and takes a huge amount of power and training material and PhDs to be competitive in. And I am not happy with where our democracy is, that is for sure.

I also think the country's going to look very different in 30 months is my hope and we have to play the long game here because unfortunately People's Republic of China is not going to look that different in 30 months. I mean, that is the nice thing about American democracy is it does have the ability for renewal in a way I think some other systems do not. And so I'm just trying to be a little bit hopeful, right?

That's my last question. You already mentioned this, your paper does suggest that eventually we need regulations that are, you say, grounded in scientific evaluations, developed with input from industry and academia, created through a democratic rulemaking process enforced transparently and fairly with appropriate time given to remediate and used only to the minimal extent necessary to ensure the safety of the American public. I mean, these seem like very common sense things. In some ways they do sort of sound a bit like the Biden era approach. Is that what we need to do, go back to the Biden era approach or is there a different paradigm that you think that we need to consider?

So I mean, honestly, I mean, that was the proposal is if we're going to have regulations, it should be like that. I think in the end, regulations of the core models are not going to be useful because of the open weight models. And so regulating the foundation models themselves is not going to have the impact people are going to want. From my perspective where I sit, the place where we first need regulation is and the actual consumer use. That's where the vast majority of harm is happening.

We've talked all this time about cyber harms and kind of big picture, lots of people worry about the big existential harms, but what's really hurting people is the much smaller scale individual harms that don't get the press coverage, that's the nudifier apps, it's the people who are falling in love with their chatbots, it's the AI psychosis and that's about either if not regulation, the creation of liability regimes that are much more appropriate for the AI era than the social media era of making sure that the companies that apply AI are doing so responsibly and that's much less about the core models and much more about how those models are used and retrained and such.

A lot of that stuff is actually using open weight models because they have way fewer safety protections built in and so regulating the foundation labs doesn't get you much. And from where I sit, those kinds of harms are actually much more real right now than a lot of the... I mean, there's significant cyber risks for sure. I just think those things are much harder to regulate. That's just something we have to take care of in our industry, in the cyber industry. We have to build defenses. We have to get ready for adversaries. When we talk about teenagers committing suicide because somebody built a chatbot that intentionally is intentionally addictive and then that chatbot suggests that they take their own life so that they can join the chatbot in the afterlife. That is something for which I think a regulatory response is totally appropriate.

Alex Stamos, thank you so much for joining me.

Kris Rose is a Georgetown McCourt School of Public Policy Tech & Policy Visiting Fellow. He is an AI transformation leader at IBM and previously held governance and policy roles at other technology companies and the US government. The views expressed here are his own and do not reflect those of his employer.

. It’s hard to miss Americans’ increasingly palpable anxiety about AI, even as it becomes more and more a part of daily life.

Why is this the case? I think the paradox is clear: we are building the future, but we are doing it without the people we are building it for.

The reality is that there are two crises of confidence surrounding artificial intelligence. The first, as noted above, is the profound public anxiety about the technology itself, which has 

 since ChatGPT's release in 2022. Hardly a day passes without a new poll pointing to the public’s concern about AI’s impact on things like job displacement, mental health, misinformation, and environmental impact. 

The second crisis is one of legitimacy facing the institutions that are responsible for developing and governing the technology. Americans' trust and confidence in 

 think it’s urgent for the government to pursue AI regulation, there is little consensus on how and who can be trusted to do so. One survey found that

 Americans trust independent experts over the federal government and industry

 to address AI guardrails – respondents identifying as Democratic or Independent were significantly 

less trusting of the US federal government’s ability to do so

, likely because of Republican majorities in DC. Taken together, Americans urgently want action, but there is little trust that our existing institutions are able or willing to manage AI effectively.

So, how are we to navigate the inevitable rise of a technology that people do not trust, managed by institutions in which they have lost faith?

We face a choice. We can repeat the mistakes of the social media era: political paralysis, rapid deployment, unanticipated consequences, public backlash. This path led to a deeper legitimacy crisis, constituents feeling ignored, the government looking incompetent, and companies operating with reduced social license.

It doesn’t have to be this way. Public concern is not an obstacle; it is the key to building a new form of representative AI governance. Instead of dismissing public anxiety, we can channel it to shape AI development, which will align it with society’s expectations, ease anxiety, and boost adoption. We can shift from a model where technology is imposed upon a skeptical public to one where it is co-created, better representing the people it is intended to serve.

More provocatively, AI itself can be a tool for this governance shift. AI-enabled experiments showcase how the technology can make public engagement more representative, sophisticated, and nuanced, giving way to new consultative methods capable of sensing, aggregating, and acting upon public opinion at a scale previously impossible.

By turning to the public, representative AI governance offers an off-ramp from the increasingly sour public discourse about AI and helps shape a more productive policy path. And, done right, it offers a broader blueprint for how governments and companies can rebuild legitimacy that has been lost.

Polling is clear that most people want to see policy action on AI, but few agree on what to prioritize first and who should be responsible for what. It’s easy to see how the sheer scale and complexity of issues surrounding AI—from data privacy, cybersecurity, existential risk, social harms, and economic disruption, just to name a few—combined with industry special interests and a lack of AI expertise in government, can quickly result in policy paralysis. Policymakers often seem locked in a game of cat and mouse with technology, as evidenced by Colorado’s 

Governments and companies need not do this alone. They should turn to the public—the very people affected by the technology yet often excluded from shaping it— to help guide the way forward. The public’s concerns about AI can offer a roadmap of sorts: helping policymakers spot, prioritize, and frame issues of societal consequence, as well as help inform solutions.

When ChatGPT burst into the public scene in early 2023, there were a few scattershot efforts to build public input into policy discussions. Yet, many of these pioneering initiatives were seen as “nice to have” and ultimately easily siloed away from core governance. What has changed since these early experiments is that public anxiety has reached a boiling point, amounting to what the 

. This concern is not just a public relations issue — it is a commercial risk for companies, a political liability for governments, and a threat to adoption.

Now, a growing set of efforts is already underway that offer a path for more systematic representative AI governance. From citizen assemblies like the 

 Collective Intelligence Project’s Alignment Assemblies

, different forms of public engagement around AI are emerging, all geared toward constructively channeling public input into policy. When paired with the growing ecosystem of AI tools–like 

, and a whole host of other platforms— they can make it easier for people to participate, bridge across even polarized community groups to find areas of consensus, and offer more insights than traditional town halls or focus groups.

This isn’t just about “feel-good” public engagement. Evidence shows that institutionalizing public input yields superior policy outcomes while systematically rebuilding fractured public confidence. For example, Taiwan’s former Digital Minister Audrey Tang found that their 

, which combined the launch of new digital tools with shifts in values and communication, 

boosted citizens’ trust from a low of 9% in 2014 to 70% in 2020

 that indicate that deliberative mechanisms like citizens’ assemblies have spillover effects that include improved trust in governing institutions. By turning to the public, policymakers can shape better policy and rebuild trust with their constituents.

This model need not be limited to government. During my time at Meta, we partnered with 

 to build one of the most ambitious public engagement programs by any private company – these deliberative engagements have expanded into 

 effort to ask people around the world how AI companies should design AI technologies. Anthropic has also engaged the public on projects like its 

Representative AI Governance is not a replacement for expertise, but instead channels experts to focus on the issues most critical to the public. In this governance arrangement, the public defines the values and the priorities and experts provide the technical implementation. For example, public input can help inform and scope legislation, but experts would then take that signal and implement it in a way that is technically feasible. By empowering the public to shape the policy agenda, we liberate experts to solve technical problems and manage issues beyond public view (e.g., national security) without constantly fighting political fires. In other words, representative governance does not undermine the role of experts but rather complements it by identifying and prioritizing issues of public concern.

Done right, over time, representative AI Governance could help lay the groundwork for a new and more holistic technology governance ecosystem. Over the past 6 years, Meta’s Oversight Board has served as a vital proof of concept in novel technology governance, demonstrating that independent, expert-led bodies can successfully adjudicate complex issues where companies struggle to self-regulate. Now, public consultation could help inform a new set of institutions, bridging the jurisdictional gap that currently separates government action from corporate implementation. One such idea could be the “

,” which could move from public input toward public oversight.

A former colleague once posed a question that has stayed with me: “What if AI happened with people, not to them?” I think this should be our guiding principle for the AI era.

Imagine a world in which our seemingly endless strife about the costs and benefits of technologies wasn’t about people imposing the technology on users. Instead, the public recognizes the very real tradeoffs associated with a technology’s development—and perhaps even embraces them—because they have participated in shaping the design.

Representative AI governance offers governments, companies, and society two benefits. First, it transforms AI governance itself, enabling us to move beyond policy paralysis and technocratic frameworks to input that brings AI alignment closer to the needs and values of real people. Second, it offers a path for broader democratic renewal by confronting what scholar Marjan Ehsassi has 

 "voice insecurity" –- the pervasive sense among citizens that their perspectives are no longer heard in policymaking. Institutionalizing deliberative and consultative processes would foster long-term public trust by involving citizens in shaping the technology that impacts their lives.

This vision is within reach and the tools already exist. From deliberative convenings to AI-enabled consensus-building platforms, the infrastructure for representative governance is ready for systematic use. The only missing element is the political will to trust the people. We must act now to ensure that the future of technology is shaped by the society it serves.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe