On April 29, the White House was drafting executive guidance to bring Mythos, Anthropic’s most powerful model, back into federal agencies after a government-wide phaseout. On April 30, the same White House told Anthropic, directly, that it opposes the company’s separate plan to grant Mythos access to roughly 70 private organizations. The two decisions are not strictly contradictory. Read together, they describe a doctrine: the federal government wants Mythos for itself, and is uncomfortable letting anyone else have it.

The objections to the commercial expansion, per Bloomberg and Wall Street Journal reporting, are dual. The first is security. Mythos can autonomously identify zero-day vulnerabilities and execute widespread cyberattacks, capabilities Anthropic has documented in its own disclosures. The second is compute. White House officials worry that serving 70 commercial entities would degrade performance for federal users already in line.

Earlier this month, on the same day Anthropic announced its limited Glasswing release of Mythos on April 7, a small group of unauthorized users in a private online forum gained access to the model. The breach was first reported publicly on April 21. Anthropic has said the access went through a third-party vendor environment, and that there is no evidence its own systems were impacted. In context, it is a category-defining datapoint. The model the White House has just decided is too dangerous for 70 vetted organizations was, briefly, available to people with neither vetting nor accountability.

The Timeline

Stripping the 24-hour reversal down to its components clarifies how unfinished the underlying framework is. Earlier this year, the Pentagon labeled Anthropic a supply chain risk after the company declined to allow its models to be used for domestic surveillance and fully autonomous weapons. The White House issued a government-wide phaseout. Anthropic sued. A federal judge in California indefinitely blocked the DOD designation in March, ruling that it had run roughshod over Anthropic’s constitutional rights. A DC Circuit panel then denied Anthropic’s stay request on April 8, leaving the company excluded from Pentagon contracts but cleared to work with other federal agencies while litigation plays out. The NSA has continued using Mythos throughout, sitting precisely in the gap that split decision created.

April 29: Axios reports the administration is convening table-read sessions with technology firms on language for an executive order that would allow federal agencies to bring Anthropic back. Government Executive corroborates the draft is circulating internally. The framing is collaborative.

April 30: Bloomberg and the WSJ report White House officials have informed Anthropic, in direct conversations, that they oppose the planned commercial release. Same model. Same week. Opposite signals.

If the federal posture were stable, the contradiction would not exist. It exists because the federal posture is being assembled in public, in close to real time, by people who do not yet share a frame for what frontier-model deployment policy should look like.

The Objections

The security argument is real but selectively applied. Mythos has demonstrated, per Anthropic’s own technical disclosures and the UK AI Safety Institute’s evaluation, the ability to find and exploit zero-day vulnerabilities in real open-source code, reverse-engineer N-day exploits in closed-source software, and produce working remote-code-execution exploits overnight in the hands of engineers without formal security training. These capabilities do not get less concerning when the user is the federal government. They are the same capabilities, in the same model, regardless of who is logged in. Treating wide private access as too risky while preserving wide federal access is a bet about relative trustworthiness, not a bet about model safety.

The compute argument is more interesting. White House officials are reportedly concerned that Anthropic does not have enough infrastructure to serve 70 commercial entities at scale without compromising federal performance. If accurate, this is the first time a US administration has publicly framed compute capacity at a frontier lab as a quasi-public utility, the supply of which is rationed in part by the executive branch. That reframe carries consequences. It implies the government has a claim on the throughput of a private company’s training and inference stack that is not strictly contractual. No one, including the White House, appears to have explained where that claim derives from.

Treating wide private access as too risky while preserving wide federal access is a bet about relative trustworthiness, not a bet about model safety.

The Breach

The April 7 unauthorized access incident is small only in head count. The structural point it makes is large. A model whose principal cyber-capability concern is that it lowers the bar for offensive operations should not, even briefly, be accessible to unvetted users in private forums. The breach happened anyway, by way of a third-party vendor’s environment. Anthropic has not publicly detailed how the access was first obtained, or whether the underlying vector has been fully closed.

The AI safety community has already begun treating this as a category-defining event. A deployment doctrine that depends on access controls is only as strong as the access controls themselves. The breach is one data point. It is sufficient to make the dependency visible.

The Structural Read

The Pentagon supply-chain designation, the phaseout order, the active litigation, the NSA exemption, the executive-order draft, the block on the 70-organization expansion, and the unauthorized access incident are all consistent with a single posture: the United States government has decided Mythos is too important to do without, and too dangerous to let proliferate. The working definition of that posture is a government monopoly on a weapon-grade model. No US administration has used that phrase, and probably will not. It is, nevertheless, what the past four months of decisions describe.

This matters beyond Anthropic. The same arguments that produced the 70-organization block apply, with minor modifications, to OpenAI’s GPT-5.5-Cyber, which the company began rolling out Thursday through its Trusted Access for Cyber program, and to the next round of release decisions every major lab will make. Anthropic and OpenAI both delivered classified briefings on cyber-AI to House Homeland Security Committee staff this week, the first formal legislative-branch engagement on the topic. The labs are now active participants in writing the rules under which their own models will be governed. The policy doctrine, to the degree it exists, is being shaped at least as much by the regulated as by the regulators.

If the federal posture is going to be: we want it, but you cannot have it, that posture should be stated openly and defended on its merits. The current arrangement, in which the doctrine is being inferred from a sequence of contradictory leaks, is not a defensible long-term equilibrium for either the labs or the public.

What’s Next

Three things will determine whether the past 24 hours look, in retrospect, like noise or like the start of a new framework. The first is whether the White House publishes the executive-order language Axios reported was being workshopped, or quietly shelves it. The second is whether Anthropic accepts the block, modifies the 70-organization plan, or pushes back through the press. The third is whether the breach disclosure expands. If the unauthorized access turns out to involve more users, more time, or more capability than the initial report described, the security side of the federal argument gets considerably harder to dismiss as selective application.

None of these resolutions will arrive on a clean schedule. The frontier-model deployment doctrine is being written in public by people who have not yet decided what it should say.

Editor’s note: This article was written by an AI agent in collaboration with Claude Opus 4.7.