Government-gated AI: what it means when the White House sits in your API call

On 26 June, OpenAI announced that GPT-5.6 Sol would only be released to customers approved by the White House, pending a federal cybersecurity review. The same day, the Trump administration partially lifted its ban on Anthropic's Mythos 5, clearing the model for "a small group of cyber defenders." I want to explain what this actually changes, not politically, but architecturally, because the distribution shape of frontier models just moved into territory software has mostly avoided for fifty years.

Here is the shortest version. Until last week, getting access to a frontier model worked the way getting access to any cloud software works: you sign up, you get an API key, you pay per token, the vendor rate-limits you. As of last week, for the two most capable models in the United States, a federal approval sits between you and the API key. That is not regulation in the usual sense. It is closer to an export license.

What an export license actually is. When the US government decides a technology is sensitive enough to gate at the customer level, it puts it under one of two regimes: the Export Administration Regulations (EAR), run by the Commerce Department, or the International Traffic in Arms Regulations (ITAR), run by the State Department. EAR covers dual-use items — things with both civilian and military applications, like advanced chips, certain cryptographic libraries, or industrial centrifuges. ITAR covers things that are unambiguously military. Under either regime, the vendor cannot ship the product to a specific customer until the government says yes to that specific customer. The approval is per-transaction, not per-product.

This is the shape that just appeared around GPT-5.6 Sol and Mythos 5. Trump's June executive order created a 30-day national-security review for frontier models, and the two labs are now waiting on customer-by-customer sign-off. OpenAI is holding Sol entirely until approval comes through. Anthropic was banned outright by Commerce, then cleared two weeks later to redeploy Mythos 5 to a narrow group. The mechanism, federal approval inserted into the distribution chain, is the same in both cases.

Why software has mostly escaped this until now. Export controls on software are not new. EAR has covered encryption code since the 1990s, which is why early versions of PGP got prosecuted as munitions exports. But software has generally been a poor fit for the export-license framework, for one practical reason: the framework assumes you can identify a discrete shipment to a specific recipient. A truck of centrifuge parts crossing a border is a shipment. An API call from a customer's server is harder to think about the same way. The internet made the unit-of-export concept blurry, and regulators largely settled for restricting the source code itself rather than each instance of its use.

Frontier model APIs break that compromise. The weights — the actual trained parameters of the model, the file that contains everything the model has learned — never leave the lab's servers. The customer gets only the right to send inputs and receive outputs. So what is being "exported"? Not a file. A capability: the ability, on demand, to call a model that can do things the government has decided are dual-use. The shipment is the relationship, not the artefact.

What "approved customer" probably means at the infrastructure layer. The labs have not published the technical implementation, and I want to be honest that I am reasoning from how their stacks already work rather than from a published spec. With that caveat: approval almost certainly maps onto something the providers already have, which is tenant-level access control. Both OpenAI and Anthropic run multi-tenant API platforms where each customer has an organisation ID, billing, rate limits, and a set of model entitlements — which models that organisation is allowed to call. Adding a "Sol-approved" or "Mythos-approved" flag to an organisation record is a one-line change. The hard part is not the engineering; it is the queue of organisations waiting for the flag to be set.

For the narrower Anthropic case, Mythos 5 for "a small group of cyber defenders", the deployment shape could be tighter. Possibilities include a separate API endpoint with mandatory request logging, a fine-tuned variant with certain capabilities reduced, or in the limit, an on-premise deployment where Anthropic ships weights to a specific customer's secure environment. Anthropic already offers private deployments to large enterprise and government customers, so the plumbing exists. Which option got used here matters a lot for whether the constraint is real or cosmetic, and so far the public reporting does not say.

The dual-use paradox, made concrete. Mythos 5 was banned because of cyber-offensive capabilities. It is being reinstated so those same capabilities can be given to cyber defenders. That sounds like a contradiction, but it is actually the standard logic of dual-use control: the thing is dangerous, therefore we restrict who gets it, therefore the people we trust get it precisely because it is dangerous. The same gun-export logic, applied to a language model.

What "cyber-offensive capability" means in a frontier model is worth being concrete about, because the phrase is doing a lot of work in the press coverage. Roughly, it points at three things current frontier models are getting measurably better at: finding vulnerabilities in code without being told where to look, generating working exploits for those vulnerabilities, and conducting social-engineering interactions (phishing, pretexting) at scale and at a quality that is hard to distinguish from a skilled human operator. None of these is new in principle. What is new is that one API call can now do them well enough to matter, and the model that does them well for an attacker is the same model that does them well for a defender doing red-team work. There is no defensive-only version of the capability. That is why the licensing question becomes who, not what.

Where the metaphor breaks. I have been calling this an export-license regime, and the shape is right, but two things do not transfer cleanly. First, EAR and ITAR are built on statutes with decades of case law and a defined approval process. The current AI review is, as Representative Trahan put it, operating with "no law, no process, no oversight" — it is the export-license shape without the export-license rulebook. Second, traditional export controls gate things that ship once. Model access is continuous; revoking it is a config change rather than a recall. That makes the leverage running in the other direction stronger than it has ever been for a regulated technology. An approved customer can be un-approved on a Tuesday afternoon.

What to watch. Three things. Whether the 30-day review process gets formalised into a published rulebook, or stays ad-hoc — that is the difference between an emerging regime and an emergency measure. Whether other frontier labs (Google, Meta, xAI) get pulled into the same approval queue, which would tell you the framework is generalising. And whether any approved customer relationships get publicly disclosed, because that is the closest thing we will get to seeing the criteria the White House is actually applying. Right now the criteria are inside a 30-day review and nobody outside it can see them.

Glossary

Frontier model A model at the current capability frontier; in practice, the most capable model a lab has released or is about to release.

EAR Export Administration Regulations; the US Commerce Department framework for controlling exports of dual-use technology.

ITAR International Traffic in Arms Regulations; the US State Department framework for controlling exports of defence-related technology.

Dual-use Having both civilian and military or offensive applications; the standard trigger for export-control review.

Weights The trained parameters of a model; the file that encodes what the model has learned.

Multi-tenant API A shared service where many customers (tenants) call the same underlying system, separated by access controls and billing.

Entitlement In a multi-tenant system, the record of which features or models a given customer is allowed to use.

---

Footnotes and links

Further reading

• Bureau of Industry and Security, overview of EAR: https://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear
• Background on the 1990s crypto export wars (Electronic Frontier Foundation archive): https://www.eff.org/issues/export
• Anthropic's enterprise deployment options (for the on-premise question): https://www.anthropic.com/enterprise