The US Tried to Switch Off Frontier AI. China Open-Sourced It Anyway.

In June 2026 the United States treated frontier AI like a weapon and switched it off. On 12 June the Commerce Secretary ordered an export license for Anthropic’s two strongest models, and because that license reached every foreign national on earth, even people standing on American soil, Anthropic could not screen users fast enough and simply suspended the models for everyone. Three days after a public launch, the best commercial AI in the world went dark for all of its users at once. Two weeks later the government hand-picked roughly one hundred “trusted partners” who were allowed to have it back, with no published criteria for who made the list. In the same window a Chinese lab shipped a model of comparable capability as a free download you could run on your own hardware. That is the whole story of where AI power actually sits in 2026: one side runs control theatre, the other side runs an apt-get install. If your product depends on a model that a single official can license out from under you overnight, you do not have a supply chain, you have a permission slip.

This is not a patch note and it is not a geopolitics hot take. It is a procurement warning. The lesson decision-makers should take from June 2026 is narrow and practical: capability is no longer the moat, availability is. A model you cannot be switched off from is worth more to a business than a marginally smarter one you can. Below is what actually happened, how the two approaches compare on the axes that decide whether you can ship, and why open-weight and self-hosted just went from a cost optimisation to a strategic hedge.

What actually happened in June 2026

Two events landed weeks apart and pointed in opposite directions. Washington export-controlled its own frontier models on national-security grounds and then let a chosen few have them back. Beijing’s ecosystem released a comparable model into the open with no gate at all. One is a story about control, the other about distribution, and the contrast is the point.

On 12 June 2026 US Commerce Secretary Howard Lutnick ordered an export license for Anthropic’s top models, Claude Mythos 5 and Fable 5, on the basis that they were capable enough at finding and exploiting cyber-vulnerabilities to count as a national-security concern. As CNN, Time, and Forbes reported, the license applied to all foreign nationals globally, including foreign nationals physically inside the United States. Anthropic had no way to verify every user’s nationality in real time, so rather than break the rule it suspended the models for the entire user base. This happened three days after Fable 5’s public launch on 9 June. The Financial Times reported that Amazon staff had identified the jailbreak that triggered the alarm and that Amazon’s CEO escalated it to Lutnick directly. The trigger was a demonstrated capability; the response was to switch the product off for everyone on the planet.

Around 26 June the government let Anthropic re-release Mythos 5 to roughly one hundred “trusted partners,” a mix of companies and federal agencies, under unspecified “appropriate safeguards.” CNBC reported the re-release; nobody published the selection criteria. There is no list you can apply to, no threshold you can meet, no appeal. Access to the best American model became a discretionary grant. Meanwhile the Chinese lab Z.ai, formerly Zhipu AI, released GLM-5.2 with open weights, running on Huawei chips, and it did not ask anyone’s permission because you download it.

US closed frontier versus China open weights

Strip away the politics and compare the two as an engineer choosing a dependency. On raw capability the American models still lead, narrowly. On every axis that decides whether you can actually build and keep building, the open-weight model wins, because it removes the one variable you cannot engineer around: someone else’s permission.

Read the last row twice. The entire risk of building on a US-controlled frontier model is that its availability is a policy variable, not a technical one. You can architect around latency, cost, and even model quality. You cannot architect around an export order that arrives on a Friday and applies to your users by name of nationality. That is the same structural argument behind EU data sovereignty for AI: the question was never only where the data sits, it is who holds the switch.

Control theatre: switching it off proved it was never yours

The suspension was framed as a security measure, and there is a real concern underneath it: a model good enough to autonomously exploit vulnerabilities is a genuine dual-use problem. But the mechanism revealed something more uncomfortable than the risk. When a single license order can take the best commercial AI offline for every paying customer three days after launch, the customers never controlled the tool. They rented conditional access to it, and the condition was politics.

Notice what the export logic assumes. It treats a frontier model like enriched uranium: a scarce, containable material whose spread you can police at the border. That framing is already obsolete, because the thing being controlled is a file, and the capability it represents was reproduced and open-sourced by another country within the same news cycle. You cannot export-control mathematics that a competitor is giving away. The control did not make anyone safer from the capability; it only made Anthropic’s own users the collateral. If you had built a product on Fable 5 that week, your outage notice was written by a government you do not vote in.

The re-release is the tell, not the fix

The part that should worry builders most is not the shutdown, it is the restart. Access came back for roughly one hundred trusted partners with no public criteria, which means access to frontier capability is now something you are granted, not something you buy. That is a different market. In a normal software market you pay and you are a customer with rights. In a trusted-partner market you are selected, and what is selected can be de-selected. A hand-picked allow-list is exactly the access model that least-privilege thinking tells you to be suspicious of when someone else holds the list and will not show you how they built it. If your roadmap depends on staying on that list, your roadmap has a stakeholder who never signed your contract.

China’s answer was a download, and it is close

While the US was deciding who could have its models, Z.ai shipped GLM-5.2 as open weights. On the Intelligence Index v4.1 it scored 51, the top open model on the board. On coding it beats GPT-5.5 on SWE-bench Pro, 62.1 to 58.6, and it near-ties Claude Opus 4.8 on FrontierSWE, 74.4 percent to 75.1 percent, at roughly one sixth of the token cost, per VentureBeat and Latent Space. Comparable capability, a fraction of the price, and no permission required. For a large class of real work, coding, extraction, summarisation, retrieval, that is already the better dependency, and the cost gap is the kind of margin that decides whether a feature ships at all.

Seven months is not a moat. It is a release cycle. And a lead measured in months, defended by export controls that a free download routes around, is not a strategic asset you can build a decade of product on. The gap that used to be measured in years, that justified paying any price for the one lab that had the magic, has compressed to the point where “slightly behind but yours forever” beats “slightly ahead but revocable” for anyone who has to ship on a schedule.

What this means if you build on AI

The strategic move after June 2026 is to treat model access as a supply-chain risk and to hedge it the way you hedge any single-supplier dependency. That does not mean ripping out the best commercial API. It means never letting your product become unshippable if that API disappears for a fortnight because of a headline you had nothing to do with. Concretely, for anyone building on AI, the hedge looks like this.

• Keep an open-weight fallback that actually runs. Not a slide, a deployed path. If your primary model is a US-controlled frontier API, have GLM-class open weights wired behind the same interface so a suspension is a config change, not an outage. The engineering is the subject of self-hosted AI versus cloud APIs.
• Abstract the provider, always. Route every model call through one internal interface so no business logic knows or cares which vendor answered. Switching providers should be a routing decision, not a rewrite.
• Own the parts that cannot be revoked. Your retrieval index, your evaluations, your prompts, your data pipeline. The model is the swappable component; the system around it is your actual asset, which is the whole point of a production retrieval pipeline you control.
• Match the model to the task, not to the brand. Most production work does not need the absolute frontier. A close-enough open model at one sixth the cost is the right call far more often than the marketing suggests, and it removes the switch entirely.
• If sovereignty is a hard requirement, self-host now. For regulated and public-sector buyers, an open-weight model on infrastructure you own is the path of least legal and political resistance, which is why the private-AI pilot pattern keeps proving out.

None of this is anti-American-lab. Their models are excellent and, at the very top, still ahead. It is anti-single-point-of-failure. The June suspension was a live fire drill for a risk that most AI roadmaps had priced at zero, and the teams that came through it calmly were the ones who had already read how to run the stack themselves. Everyone else spent three days discovering they had outsourced their kill switch.

The contrarian kicker

Here is the uncomfortable inversion. The export control was meant to deny frontier AI to adversaries and keep America ahead. What it actually demonstrated, in three days, is that the American frontier is a service that can be withdrawn, while the Chinese frontier is a file that cannot be recalled. Control was supposed to be the strength. It turned out to be the vulnerability, because a capability you can switch off is a capability someone else can route around, and they did, for free, before the license order had finished trending. The country that tried to lock the door proved the door was the weak point. The one that gave the keys away made itself impossible to switch off. If you are choosing what to build on, build on the thing nobody can take back.

Related reading

• EU Data Sovereignty for AI: Post-Schrems II Self-Hosting
• Self-Hosted AI vs Cloud APIs: Cost, Privacy, Control
• Securing Self-Hosted AI: Infrastructure Hardening
• What a Private-AI Pilot Actually Looks Like, Week by Week
• EU AI Act Compliance: What AI Builders Need to Know
• Most Tasks Don’t Need an AI Agent. Use a Pipeline.