The Context
On Friday, June 13, 2026, the U.S. Commerce Department invoked national security authorities to order Anthropic PBC to suspend all access to its Fable 5 and Mythos 5 AI models by any foreign national—inside or outside the United States. Anthropic responded by disabling the models globally. The trigger was a jailbreak technique that bypassed Fable 5’s safety guardrails, exposing Mythos 5’s offensive cybersecurity capabilities. The U.S. government judged this residual risk unacceptable. The directive treated remote access as a ‘deemed export’ under the Export Control Reform Act of 2018 (ECRA) and the International Emergency Economic Powers Act (IEEPA). The cost of non-compliance? Civil penalties up to $300,000 per violation, or twice the transaction value. Criminal penalties: fines up to $1,000,000 and 20 years imprisonment per count. For directors personally, the numbers are stark.
The Risk
This is not a hypothetical. The liability hook is direct and personal. Under ECRA and IEEPA, any ‘person’ who ‘aids, abets, counsels, commands, induces, procures, or willfully causes’ a violation faces enforcement. That includes directors and officers who knew or were willfully blind to foreign national access to Mythos after the directive. The deemed-export doctrine extends liability to Anthropic’s own non-citizen employees. The governance gap is the audit trail: Anthropic’s internal risk assessment judged the jailbreak ‘narrow,’ but the government’s security threshold was lower. A board that failed to ensure an effective export-control compliance program—including robust jailbreaking testing and controls around foreign national access—may face derivative suits under the Caremark standard for breach of fiduciary duty of loyalty. The securities risk compounds this: if directors knew of the national-security vulnerability and did not disclose the regulatory shutdown risk in IPO documents or investor communications, they face personal exposure under Rule 10b-5 and Section 11 of the Securities Exchange Act. The dollar value of the shutdown? Anthropic warned a separate ban on government use could cost ‘billions in lost revenue.’ This is a mathematical certainty of liability.
The Control
The strategic solution is not to retreat from frontier AI, but to harden the compliance architecture before deployment. Boards must ensure that export-control compliance is treated as a ‘mission-critical’ risk, not a legal afterthought. This means: (1) a documented, independent red-team testing protocol that simulates government-level security thresholds, not just internal risk assessments; (2) a real-time foreign national access tracking system with automated suspension triggers; and (3) a disclosure framework that treats any known vulnerability with national-security implications as a material risk requiring immediate board-level escalation and, if relevant, public disclosure. The cost of inaction is calculable: fines, imprisonment, and shareholder litigation. The cost of action is a line item in the compliance budget.
The Challenge
These are the critical questions you should be raising at the board table:
| What is the documented process for identifying and escalating national-security vulnerabilities in our AI models to the board, and at what threshold of risk does the board expect management to suspend access proactively? | |
| Have we audited our current compliance program against the deemed-export doctrine, specifically regarding foreign national access to our most advanced models—including internal employees—and what is the gap analysis? | |
| What is the quantified financial exposure—fines, lost revenue, litigation costs—if a similar export-control directive were issued against our models, and is this risk reflected in our current D&O insurance coverage and securities disclosures? |