Washington takes the keys to America's best AI — as China gives its own away

The word “voluntary” over a locked door

Anthropic and OpenAI spent years deciding who could use their most capable models. They kept partner lists. They said yes and no. That was theirs to do.

This week it stopped being theirs. The US government now has to approve those lists, and the labs cannot ship their strongest models without that sign-off. A White House official called the arrangement “voluntary.” The word sits oddly over a door someone else now holds the key to. When “optional” describes a thing you can’t refuse, it isn’t describing the thing — it’s softening it.

An object’s owner is set by its category, not its maker

Here is the pattern worth carrying past today. Who controls a thing is decided less by who made it than by what category the thing falls into. A product belongs to the company that sells it. A weapon belongs, in the deciding sense, to the state. The line between the two is not in the object. It is in what the object can now do.

A cyber model that helps engineers is a product. The same model, once it can find and exploit weaknesses at scale, is something a government treats the way it treats missiles and encryption keys: a capability whose spread it wants to control. Nothing in the code changed. The category did.

The category can shift under your feet

That is what happened here. Anthropic built its Mythos model as a product it licensed. Then it became powerful enough to matter to national security, and it crossed a line — from a thing you sell into a thing the state licenses. The maker did not hand over the keys. The reclassification took them.

This is older than AI. The United States has long treated strong encryption as a controlled export. It has rules for anything that is useful to both a factory and an army. The word for such things is “dual-use,” and the whole point of the label is that the object’s peaceful face does not decide the question. Its dangerous face does.

The arrangement was already there

It is tempting to read this as a sudden power grab. It is closer to an old machine quietly extending its reach. The export-control regime predates every AI lab. It was built for chemicals, for centrifuges, for cryptography. What changed is that frontier models walked into its jurisdiction.

That machine poses as plain fact — “national security,” full stop — but it is a choice about which frame wins. A model can be read as a product to be sold or as a weapon to be guarded, and someone decides which reading governs it. The choice can serve the state that makes it and still shield people from real harm. Both are true. The point is not that the choice is wrong. The point is that it is a choice, wearing the costume of nature.

The same object, read the other way

Watch China the same week and the costume slips. Moonshot gave a frontier-class model away for anyone to run. Alibaba open-sourced the software that lets developers escape Nvidia’s chips. Xi Jinping told a Shanghai conference that no country should monopolise AI. Spread the tools, win the builders.

The columnist Ross Douthat reached back to the Cold War for the shape of it: America is treating frontier AI like a nuclear weapon, to be guarded; China is treating its models more like a technology to be shared. Eisenhower’s government helped build civilian nuclear programmes abroad the very year it executed the Rosenbergs for leaking bomb secrets. Spread the tech; hold the weapon. Same atom, two categories, one country holding both at once. The classification was never a property of the thing. It was always a decision — and different deciders decide differently.

No one holds the whole ring of keys

So who controls frontier AI now? The honest answer is that no single seat does, and that includes every seat that thinks it does.

The labs built the models and no longer decide who runs them. The government can gate the American labs, but it cannot gate Kimi — that model is already loose in the world, downloadable tonight, indifferent to a partner list in Washington. Each holder of a key can see only the door in front of them. None can see the building.

You are inside this too, further down than it looks. When a model you rely on is quietly gated, you will not get a notice; the tool will simply not be there, decided by a room you will never enter, under a category you did not get to argue. That is worth knowing, and it is worth holding loosely. The keys to a powerful technology are rarely held by one hand — they are contested, shared, and always slipping. Anyone certain they know who is in charge is looking at their own door and mistaking it for the lock.