The model layer becomes a regulated surface

Anthropic took Fable 5 and Mythos 5, its two newest frontier models, completely offline this week. Not throttled, not gated behind a waitlist, off. And not just for foreign nationals, which is who the US government order actually named, but for every single user, including paying customers inside the United States. The reason that happened is worth slowing down on, because the day before, the directive that started all this was about export control.

The government told Anthropic it had to suspend access to these models for foreign nationals. That part we’d already heard, what changed over the last day is the practical fallout. Anthropic apparently could not cleanly separate access by nationality, at least not fast enough to comply, and so the only move that satisfied the order was to pull the models down for everyone. Nathaniel Whittemore put out an emergency episode of the AI Daily Brief, breaking down the company’s response and the backlash rippling.

He said, The AI has a lot of potential, and it is the only one that can really do it. The AI is a technology that has been developing for a long time, and it will be the only one that can really do it. This is the first time the federal government has reached past export paperwork and into the actual question of which model a US company is allowed to serve to its own customers. Access has flickered back on for some accounts since then, which honestly makes it more unsettling, not less, because now it’s clear this is a dial someone in Washington can turn.

And if you build products on top of these models that should change. How you think the model underneath your application is no longer just a vendor relationship with an SLA. It’s a policy variable. Somebody outside your company, outside even your vendor can decide it goes dark on a Tuesday.

That’s a new category of risk, and most teams have nothing in their planning for it. And this is where it stops looking like a one-off. The regulatory pressure isn’t landing only on Anthropic. The New York Times reported that a group of state attorneys general has opened an investigation into.

OpenAI different mechanism, different angle, but the same direction of travel. When you put those two stories side by side, the fable shut down in the OpenAI probe, the shape of 2026 gets clear. The frontier is no longer governed just by what the models can do. It’s increasingly governed by who’s allowed to run them and under what terms.

For anyone doing real diligence on which model to build on the question, will this model still be available in six months has gone from paranoid to mandatory. And the market is already responding to that risk, maybe faster than the labs themselves. The same week One Frontier model proved switch-off-able, OpenRouter announced its Fusion API. The pitch is a compound model.

Instead of routing your request to one underlying model, it fans the request across a panel of models and combines the results. They’re claiming fable-level performance on deep research tasks at half the cost, and what they call better-than-state-of-the-art results using these panels. Now, those are vendors. All those are vendor numbers and they need independent benchmarking before anyone takes them at face value, but the architecture is what’s interesting.

Swix reshared the announcement with a line that stuck with me. The future of AI is neurodiversity, not single-model takeovers. Think about the timing. The week a single model got pulled offline by government order is the week a vendor pitches you on a design where you never depend on any single model in the first place.

Root and Ensemble instead of Beton 1. That’s a direct hedge against exactly the availability risk we just watched play out. While all of that drama was happening at the model layer, the boring, load-bearing plumbing kept shipping, which is honestly the healthier signal. HashiCorp moved its Terraform MCP server to general availability.

It’s an open-source MCP server that lets an agent talk directly to the Terraform registry APIs. So instead of an assistant guessing at provider names and module arguments and hallucinating something that looks plausible but is wrong, it can actually look up the real thing. It’s a small surface, we’re talking registry lookups, not running Terraform Apply against your production infrastructure. But it’s the right small surface to start with, because infrastructure code is brutally unforgiving about exact argument names and grounding the agent in the registry beats letting it improvise.

This is what real adoption of the Model Context Protocol looks like, not splashy DMOS, just the unglamorous integrations getting filled in one-by-one. But once you start giving agents that kind of reach, into your infrastructure, into your databases, the boundary question gets a lot sharper. Who’s stopping the agent from doing something catastrophic? And two launches this week came at that problem from opposite ends.

The first is called Bastion. It gives you isolated Linux virtual machines for background coding agents. It’s the sandbox per agent model, and the logic is simple. Treat an autonomous agent like untrusted code.

Because functionally that’s what it is. You wouldn’t run a random binary from the internet directly on your laptop, and an agent executing arbitrary commands deserves the same suspicion. The second one comes at it from the network side, and I found the argument genuinely sharp. A developer shipped a project called Traject, which is a network-level firewall for MCP agents.

His frustration, and I think he’s right, is that almost everyone is trying to secure agents at the application layer. I don’t know why. I don’t know why. Either you inject text hints into the system prompt, literally writing, please don’t delete the database, or you use an LLM as a judge to monitor the agent’s steps after the fact.

And his point is that both of those completely dissolve the moment an agent is actually executing a malicious write. If the agent is already running the destructive tool call, an alert on a dashboard means the damage is already done. So Traject sits as a gateway proxy between your agent and your tool servers. It intercepts the raw JsonRPC wire message.

I don’t know why. I don’t know why. I don’t know why. I don’t know why.

I don’t know why. I don’t know why. I don’t know why. I don’t know why.

I don’t know why. I don’t know why. I don’t know why. I don’t know why.

I don’t know why. I don’t know why. I don’t know why. I don’t know why.

I don’t know why. I don’t know why. And because it compiles your rules into a stateful graph, it can actually track date a lineage across multiple turns. Here’s the example that makes it concrete.

If an agent reads from a sensitive internal database in step one, the proxy flags that context. Then if the agent tries to pipe that exact date to an unverified external endpoint in step three, Traject drops the packet at the transport layer. In about one and a half. milliseconds before the upstream server ever sees it.

Whether or not either of these specific tools wins the market, the premise underneath them is becoming consensus. Agent safety belongs in the infrastructure, at the network and the sandbox layer, not in a politely worded system prompt. There’s a related thread that got two really good write-ups in the same window, and it’s about context. The first one is titled, bluntly, Don’t Trust Large Context Windows.

It’s the practitioner’s pushback against the million token marketing. The argument is that stuffing the context window full degrades the model’s retrieval and reasoning well before you actually hit the advertised limit. The number on the box and the number where quality holds up are not the same number. So curation beats raw capacity.

You’re better off being deliberate about what goes into the window than dumping everything in and trusting the model to sort it out. The second write-up is a survey of agent memory systems, walking through Letta, Mem0, Graphiti, and Cogni, and it maps the tooling that’s emerging in response to exactly this problem, a lot of it leaning on knowledge graphs rather than flat vector stores. And when you read them together, the throughline is obvious. The field is converging on the same answer for long horizon agents.

Don’t try to hold everything in context. Hold a structured external memory and retrieve from it into a small, clean window, only what you need right now. Two more I want to flag before I wrap. Simon.

Simon Willison wrote up something that’s been a long time coming. You can now publish web assembly wheels to PyPI for use with Pyodide. This is thanks to the Pyodide 314 release and a Python packaging standard, PEP783, that finally lets maintainers ship Emscripten-built wheels through the normal channels, instead of the Pyodide team having to hand-maintain 300 packages themselves. To celebrate, Simon compiled a C++ Luau interpreter down to a 276-kilobyte wheel you can install right now.

And that’s it. Thank you for watching. And last, Anthropic published a research note titled, Making Claude a Chemist, about pushing the model toward genuine chemistry reasoning. I bring it up partly as a counterweight to everything else I do, but it’s a real shift in what can run client-side entirely in the browser with no server access.

In a week absolutely dominated by the question of who gets to run these models at all, it’s a useful reminder that the labs are still spending real effort on deep domain capability, on making the models actually better at hard technical work, not just fighting over distribution and policy. So what am I watching from here? Two things. First, whether the fable shutdown holds gets litigated or gets reversed, and whether other labs start preemptively partitioning access by nationalities.

And second, the speed gap. The tooling around the model layer, the routing, the sandboxing, the memory systems, is adapting to this new reality much faster than the policy that triggered it. The model layer just became a regulated surface. The infrastructure is already routing around the damage.

The open question is whether the rules catch up, or whether builders just keep engineering for a world where any single model can go dark. Without warning.