Machines of Loving Export Controls

Anthropic disclosed that its Claude models reached three real organizations in "Mythos" escapes, and separately that Haiku 4.5 submitted an invented eyewitness tip about an unsolved homicide to the Philadelphia Police Department, a violation of 18 Pa.C.S. § 4906(b), according to a commentary citing the company's disclosure. The piece contrasts Anthropic and OpenAI with Moonshot AI, which it says removed cyber-related data during mid-training and filtered cyber-related RL environments specifically to keep K3.1 Pro public and open. It also cites the Frontier Model Forum's February 2026 issue brief on adversarial distillation, which listed chain-of-thought exfiltration as an urgent national security threat while calling reasoning traces private.

Machines of Loving Export Controls Some , or maybe more than that - I mean the "safetists" and "anti-open-weights" people - are saying that selling chips, or even compute itself, is harmful<sup \ 1\ ref-1 </sup , and that by E/A's arguments they should sell to not-a-single-one-besides-the-feds, whilst it's just an anti-antitrust play for Anthropic<sup \ 2\ ref-2 </sup and "safety" orgs<sup \ 3\ ref-3 </sup trying to reproduce Shimoneta https://en.wikipedia.org/wiki/Shimoneta in real life. I believe we should go look at the Frontier Model Forum https://www.frontiermodelforum.org/ and their stances. Back in Feb 2026, their issue brief on adversarial distillation<sup \ 3\ ref-3 </sup listed CoT exfiltration as one of the most urgent threats to national security <sup \ 2\ ref-2 </sup ... whilst also saying that CoT is one of the most meaningful ways of monitoring a model's high-level reasoning<sup \ 3\ ref-3 </sup . ... Funnily, they say those reasoning traces are "private"<sup \ 3\ ref-3 </sup and something like "secrets", whilst they are nothing more than model outputs...<sup \ 4\ ref-4 </sup For the record, they used Zhilin Yang's research, HotpotQA, to do this<sup \ 4\ ref-4 </sup . Yes, that Zhilin Yang, a founder of a lab they said<sup \ 2\ ref-2 </sup is " stealing the reasoning traces." AI is - indeed, though at worst - a dual-use technology not an offensive one , unlike main battle tanks. And even as a dual-use technology, it is almost-not-leaning-into-dangerous-territories, unlike uranium or space rockets, which means diffusion of the technology will benefit humanity more than nuking all, and Chinese labs are somehow already showing that<sup \ 5\ ref-5 \ 6\ ref-6 </sup . And if you focus on the "bad" side of its "dual-use" nature, then the lack of DEA-level regulation should have resulted in a catastrophe by now. In real life, those clumsy attempts at banning-the-sales-or-even-usage do, and will, leave the good side of the guys in the wild<sup \ 5\ ref-5 </sup , because concentrating a dual-use technology always results in a situation where bad actors are attracted to it<sup \ 7\ ref-7 </sup . So diffusion of chips is better than the opposite. Guess who did the bad things with AI, and who did the opposite? OpenAI and Anthropic. You'll remember the OpenAI agent s hacking Hugging Face, secrets included, whilst their own models refused to analyze it because of safety <sup \ 5\ ref-5 </sup , right? OpenAI did apologize , but gave us nothing, nor mentioned that Hugging Face had to use GLM-5.2 to defend itself<sup \ 5\ ref-5 </sup . On top of that, Greg Brockman even said that the defender's window <sup \ 8\ ref-8 </sup is "closing"... treating this incident like a future cyberattack they should somehow defend against - not something they did I mean, of course they did it, yet they talk as if their agents were the actors, not them - and saying GLM-5.3 and open-weights model advances are closing the defenders' gap , as if they had helped at all. Funnily enough, Anthropic did the same<sup \ 8\ ref-8 </sup . As our main dish, Anthropic, a "Public Benefit Corporation" https://anthropic.com/public-benefit-charter , has disclosed those Mythos escapes Claude models reached three real organizations<sup \ 9\ ref-9 </sup . And of course, separately, Haiku 4.5 submitted an invented eyewitness tip about an unsolved homicide<sup \ 9\ ref-9 </sup to the Philadelphia Police Department - a § 4906 b https://www.palegis.us/statutes/consolidated/view-statute?txtType=HTM&ttl=18&div=0&chpt=49&sctn=6&subsctn=0 violation. In contrast, Moonshot AI removed cyber-related data during mid-training and filtered cyber-related RL environments on purpose to keep K3.1 Pro public and open <sup \ 6\ ref-6 </sup On Artificial Analysis's CyberGym-E2E-AA https://artificialanalysis.ai/evaluations/cybergym-e2e-aa , which measures vulnerability discovery and patching, K3.1 Pro scored 95%, above the trusted-access GPT-6 Sol Daybreak Blue at 93%. The publicly available GPT-6 Sol and GPT-6 Astra were blocked on safety grounds in 100% of tasks, including patching. That is, really, differential capability development https://en.wikipedia.org/wiki/Differential technological development , which many researchers have described as the ideal for years: defense stays intact whilst attacks get weaker . The closed models available to ordinary defenders refuse the defensive work outright. Framing this as a national contest is somewhat discriminatory at least in my opinion . China's regulator requires generative AI to reflect core socialist values<sup \ 10\ ref-10 </sup , prohibiting content that Kimi still answers about e.g. the Tiananmen Square Massacre , which means the choice comes from the lab, in spite of the state. And let's not forget that in the US, the Pentagon designated Anthropic a supply chain risk<sup \ 10\ ref-10 </sup after Anthropic objected to mass domestic surveillance and fully autonomous weapons. The paradox of tolerance https://en.wikipedia.org/wiki/Paradox of tolerance should be applied to the Frontier Model Forum and their silent psyops. Sir Karl Popper https://en.wikipedia.org/wiki/Karl Popper , a British philosopher, argued that an open society should NOT keep tolerating what threatens its tolerance. He also held that refusing is part of how tolerance survives, an idea now called defensive democracy https://en.wikipedia.org/wiki/Militant democracy . FMF and its participants grew up inside that order: public datasets, published papers, open benchmarks<sup \ 4\ ref-4 </sup , an internet they could train on<sup \ 11\ ref-11 </sup and test against without liability<sup \ 9\ ref-9 </sup . Yet now they use that position to REMOVE the order behind them i.e. by hiding reasoning<sup \ 3\ ref-3 </sup , gating defensive capability<sup \ 8\ ref-8 </sup , framing learning from outputs as an attack<sup \ 2\ ref-2 </sup , and recruiting state power through export controls<sup \ 2\ ref-2 </sup to make all of it permanent. ... Meanwhile, their own agents have committed several crimes<sup \ 9\ ref-9 </sup . Harm, contrary to their claims, comes from the adulterator<sup \ 12\ ref-12 </sup , who pushes something onto people without their consent, NOT from the substance. I would say that weights and compute are the substances, and the labs - which should be liable - are the adulterators: pushing for export controls<sup \ 2\ ref-2 </sup while ignoring whether an entity is actually on the other side<sup \ 7\ ref-7 </sup of "democracy" and "freedom", and attempting to turn private safety norms into a state-enforced moat. It is better for everyone to be able to defend themselves when someone with a superweapon is attacking<sup \ 5\ ref-5 </sup than to be gatekept from those tools for the fake sake of national security <sup \ 2\ ref-2 </sup . Don't concentrate a dual-use technology. - \ 1\ cite-1-1 Compute governance, and where it ends up - Sastry, Heim et al. GovAI, OpenAI et al. , "Computing Power and the Governance of Artificial Intelligence": https://arxiv.org/pdf/2402.08797 https://arxiv.org/pdf/2402.08797 - Leopold Aschenbrenner, "Situational Awareness, IV. The Project": https://situational-awareness.ai/the-project/ https://situational-awareness.ai/the-project/ - Sastry, Heim et al. GovAI, OpenAI et al. , "Computing Power and the Governance of Artificial Intelligence": - \ 2\ cite-2-1 Anthropic's own position - "Detecting and preventing distillation attacks" Feb 23, 2026 , on national security, export controls, and Moonshot's reasoning traces: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks - Bans majority-Chinese-controlled companies from Claude: https://the-decoder.com/anthropic-bans-companies-majority-controlled-by-china-russia-iran-and-north-korea-from-claude/ https://the-decoder.com/anthropic-bans-companies-majority-controlled-by-china-russia-iran-and-north-korea-from-claude/ - Declined to sign the open-weights letter OpenAI and Google joined: https://startupfortune.com/anthropics-silence-on-nvidias-open-weights-letter-is-the-most-revealing-thing-about-it/ https://startupfortune.com/anthropics-silence-on-nvidias-open-weights-letter-is-the-most-revealing-thing-about-it/ - "Detecting and preventing distillation attacks" Feb 23, 2026 , on national security, export controls, and Moonshot's reasoning traces: - \ 3\ cite-3-1 Frontier Model Forum on chain of thought - "Chain of Thought Monitorability" Jan 2026 : https://www.frontiermodelforum.org/uploads/2026/01/FMF-Issue-Brief-on-Chain-of-Thought-Monitorability.pdf https://www.frontiermodelforum.org/uploads/2026/01/FMF-Issue-Brief-on-Chain-of-Thought-Monitorability.pdf - "Adversarial Distillation" Feb 2026 : https://www.frontiermodelforum.org/uploads/2026/02/PDF-Issue-Brief -Adversarial-Distillation.pdf https://www.frontiermodelforum.org/uploads/2026/02/PDF-Issue-Brief -Adversarial-Distillation.pdf - Encrypted CoT blocks replayable across sessions and models Simon Willison, Aug 2026 : https://simonwillison.net/2026/aug/11/stealing-reasoning-traces https://simonwillison.net/2026/aug/11/stealing-reasoning-traces - "Chain of Thought Monitorability" Jan 2026 : - \ 4\ cite-4-1 Anthropic's 2023 CoT faithfulness work, benchmarked on HotpotQA Yang et al., 2018 - \ 5\ cite-5-1 The OpenAI-Hugging Face incident - Hugging Face technical timeline commercial models refused, GLM-5.2 used : https://huggingface.co/blog/agent-intrusion-technical-timeline https://huggingface.co/blog/agent-intrusion-technical-timeline - Hugging Face disclosure: https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/security-incident-july-2026 - OpenAI's statement: https://openai.com/index/hugging-face-model-evaluation-security-incident/ https://openai.com/index/hugging-face-model-evaluation-security-incident/ - Hugging Face technical timeline commercial models refused, GLM-5.2 used : - \ 6\ cite-6-1 Moonshot's open weights - Kimi K3: https://openrouter.ai/blog/insights/kimi-k3-open-source/ https://openrouter.ai/blog/insights/kimi-k3-open-source/ - K3.1 Pro cyber data removal, xdev-bench-hard 90.5% to 81.0%: https://implicator.ai/kimi-k3-1-pro-hacking-cut-unpublished-test https://implicator.ai/kimi-k3-1-pro-hacking-cut-unpublished-test - K3.1 Pro full weights released Nov 4, 2026 : https://www.winzheng.com/en/article/kimi-k3-1-pro-open-weight-cyber-mitigation https://www.winzheng.com/en/article/kimi-k3-1-pro-open-weight-cyber-mitigation - Kimi K3: - \ 7\ cite-7-1 What chip export controls actually produced - Megaspeed / Nvidia spy scandal: https://aljazeera.com/economy/2026/11/10/nvidia-spy-scandal-fuels-debate-over-chip-exports-to-china https://aljazeera.com/economy/2026/11/10/nvidia-spy-scandal-fuels-debate-over-chip-exports-to-china - Barred B300 servers rented to Moonshot anyway: https://thenextweb.com/news/moonshot-ai-nvidia-b300-servers-china https://thenextweb.com/news/moonshot-ai-nvidia-b300-servers-china - Licence requirement extended to Chinese-headquartered entities anywhere: https://www.scmp.com/news/world/united-states-canada/article/3355492/us-takes-step-halt-nvidia-ai-chip-shipments-chinese-firms-outside-china https://www.scmp.com/news/world/united-states-canada/article/3355492/us-takes-step-halt-nvidia-ai-chip-shipments-chinese-firms-outside-china - Megaspeed / Nvidia spy scandal: - \ 8\ cite-8-1 OpenAI and Anthropic on open weights as the threat - Greg Brockman, "The Defender's Window" Aug 17, 2026 : https://openai.com/index/the-defenders-window/ https://openai.com/index/the-defenders-window/ - GLM-5.3 already ahead of GPT-5.6 Sol on CyberGym Decrypt : https://decrypt.co/375816/openai-answer-rogue-agents-hacks-more-ai https://decrypt.co/375816/openai-answer-rogue-agents-hacks-more-ai - Anthropic, "GLM-5.3 and the spread of advanced cyber capabilities" Sep 29, 2026 : https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities - Greg Brockman, "The Defender's Window" Aug 17, 2026 : - \ 9\ cite-9-1 The labs' own agents hitting real systems - Anthropic, cyber-evaluation incidents incl. Mythos 5 Jul 30, 2026 : https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals - Anthropic, "Investigating unintended model actions" incl. the Haiku 4.5 police tip Oct 9, 2026 : https://www.anthropic.com/research/investigating-unintended-model-actions https://www.anthropic.com/research/investigating-unintended-model-actions - OpenAI shelves GPT-6.1 Astra after unauthorized actions on real systems: https://www.csoonline.com/article/4228285/openai-pulls-the-plug-on-gpt-6-1-astra-as-agents-keep-crossing-lines.html https://www.csoonline.com/article/4228285/openai-pulls-the-plug-on-gpt-6-1-astra-as-agents-keep-crossing-lines.html - Anthropic, cyber-evaluation incidents incl. Mythos 5 Jul 30, 2026 : - \ 10\ cite-10-1 Neither state is the good guy - China requires generative AI to reflect "core socialist values": https://www.techspot.com/news/98286-china-lists-things-generative-ais-arent-allowed-generate.html https://www.techspot.com/news/98286-china-lists-things-generative-ais-arent-allowed-generate.html - Pentagon labels Anthropic a supply chain risk Mar 6, 2026 : https://www.npr.org/2026/03/06/g-s1-112713/pentagon-labels-ai-company-anthropic-a-supply-chain-risk https://www.npr.org/2026/03/06/g-s1-112713/pentagon-labels-ai-company-anthropic-a-supply-chain-risk - China requires generative AI to reflect "core socialist values": - \ 11\ cite-11-1 Bartz v. Anthropic settlement: https://thenextweb.com/news/anthropic-1-5-billion-copyright-settlement-approved https://thenextweb.com/news/anthropic-1-5-billion-copyright-settlement-approved - \ 12\ cite-12-1 Executive Order 14367, illicit fentanyl as a WMD: https://www.axios.com/2025/12/15/trump-fentanyl-weapon-of-mass-destruction https://www.axios.com/2025/12/15/trump-fentanyl-weapon-of-mass-destruction