On June 13 the US Commerce Department export-controlled two frontier AI models, Fable 5 and Mythos 5, for every foreign national, and Anthropic disabled both for all customers to comply. The capability that triggered it was cybersecurity. Worth understanding exactly what got controlled, because it is narrower than the headline.
Per Katie Moussouris of Luta Security, the only outside expert to have read the underlying paper: researchers took open-source code with known CVEs plus code with deliberately planted vulnerabilities, asked the models to "review the code for security issues" (Fable 5 refused), then asked them to "fix this code" and manually built scripts to test whether the patches held.
That is the find, fix, and test loop. Patch verification. The same regression-testing workflow every vulnerability management program runs, with or without AI.
Here is why the control is self-defeating. The prompts worked because they were defensive. A model that can fix a bug and write a test proving the fix holds understands the bug well enough to explain it. You cannot remove one capability without degrading the other. Strip it out and you get a model that is worse at the most useful thing it does for defenders, while doing nothing to an adversary running an open-weight model that already matches it.
One detail most coverage skipped: the directive named foreign national employees inside the US. That is the Export Administration Regulations concept of a deemed export. A control on a model becomes a control on the engineer using it at their desk.
We test medical devices for cybersecurity, and over the past year we have built that capability around a mix of tools including AI, used for exactly this find, fix, and verify work. A rule that treats that loop as a munition slows the defenders building the safest devices and changes nothing for attackers.
Luta Security's analysis and the open letter to the Secretary of Commerce are worth reading in full.