The High-Risk Models Shipped. Washington Approved the List.

Thursday, two models shipped. One from OpenAI. One from Anthropic. Both are the most capable models either company has released. Neither is available to you. Both are available to organizations the US government approved. That list is not public. This is now the standard.

The parallel releases aren’t coincidental timing. They are the first visible instance of a framework. Two frontier labs, whose most capable models both triggered risk classifications that would have seemed disqualifying twelve months ago, released those models on the same day under US government-managed access lists. One lab built the access control in voluntarily. The other had it imposed after a disputed jailbreak claim, negotiated for two weeks, and then accepted the same terms. The government didn’t stop dangerous AI. It absorbed it into a licensing structure.

High Risk Is Now a Product Category

OpenAI’s own deployment safety card for GPT-5.6 is unusually frank about what the model can do. SecureBio ran independent external evaluations; their testers placed GPT-5.6 Sol at 68.3% on World-Class Bio tasks, roughly nine percentage points above GPT-5.5. All GPT-5.6 variants received High designations in both biological and chemical capabilities. Three of four biological capability evaluations exceeded OpenAI’s threshold. Under OpenAI’s Preparedness Framework, High on bio means a model can provide meaningful assistance to novice actors to create known severe threats. The tier below that — the one that would require halting deployment — is Critical, reserved for models that could enable experts to engineer novel pathogen designs without human intervention. GPT-5.6 Sol did not reach Critical. It cleared High on bio and again on cybersecurity, where the safety card notes Sol can find vulnerabilities and pieces of exploits, though it was unable to carry out autonomous, end-to-end attacks against hardened targets.

OpenAI deployed technical mitigations before release: activation classifiers for sensitive domains, real-time output blocking, continuous automated red-teaming. These aren’t new; the previous generation had similar layers. What’s new is the explicit government coordination. The safety card states that OpenAI previewed plans and models’ capabilities ahead of today’s launch with the US government and is starting with a limited preview for a small group of trusted partners whose participation has been shared with the government. The access list is not a safety feature in the technical sense. It’s a distribution policy managed in coordination with the executive branch.

The High bio risk designation did not pause the launch. It defined the terms of it. A model that can meaningfully assist novice actors in creating known severe biological threats is now in production, available to a set of organizations whose identities were shared with the US government before the product went live. The labs’ safety frameworks have evolved to accommodate this outcome. High risk models ship. Critical risk models don’t. That line is where the framework draws the boundary, and GPT-5.6 Sol sits below it.

The Messier Precedent

Anthropic’s path to the same endpoint was harder and more revealing. Mythos 5 — Anthropic’s most capable model, positioned as their strongest cybersecurity offering — was already in limited access through Project Glasswing when another organization claimed to have jailbroken it. The Commerce Department moved on that claim. According to Nextgov’s reporting, Anthropic characterized the government’s evidence as verbal evidence of a potential narrow, non-universal jailbreak involving asking the model to review a codebase and fix software flaws. Anthropic disputed the severity explicitly. The government proceeded with export controls anyway.

On June 13, Anthropic suspended access to both Fable 5 and Mythos 5 globally, citing national security authorities. The scope of the block extended beyond customers: it applied to all foreign nationals anywhere in the world, including H-1B visa holders working at US companies, foreign national Anthropic employees, and anyone outside US borders. The DOD followed by designating Anthropic a supply chain risk — a classification previously reserved for foreign adversaries like Huawei and SMIC. Defense contractors were required to certify they would not use any Anthropic models in work with the military. DOD CIO Kirsten Davies justified the designation without ambiguity: Some things are simply more important than revenue cycles, clickbait, and pre-IPO valuation. America First. Always.

Two weeks of negotiations later, Commerce Secretary Howard Lutnick personally signed a letter authorizing Mythos 5’s release to the organizations in Project Glasswing. The Semafor exclusive quoted Lutnick directly: I have determined that appropriate safeguards are in place to permit certain trusted partners to access the Claude Mythos 5 Model. The list of those trusted partners is enumerated in an Annex A to Lutnick’s letter that has not been made public. As a condition of release, Anthropic committed to work with the US government on protocols and standards and releases for its models going forward. That commitment is structural. Future Anthropic releases will go through a review process with the government before reaching users — the same posture OpenAI adopted voluntarily for GPT-5.6.

Both companies are now operating under the same framework. One chose it; one was forced into it. The endpoint is identical.

200 Organizations That Didn’t Make the List

The resolution looks cleaner from inside the US than outside it. During the two-week suspension, approximately 200 institutions across 15 countries lost access to Fable 5 and Mythos 5 entirely. The affected countries include close US allies: France, Germany, Japan, the United Kingdom, Canada, and Taiwan among them. Researchers and builders who had been running production workloads on Anthropic’s API had their access revoked with no clear timeline for restoration. The jailbreak concern that triggered the order was never independently verified. Anthropic disputed it. Access remained suspended for the full two weeks regardless.

The allied reaction was not diplomatic in the usual sense. France’s President Macron called the restrictions strictly nationalist and called for Europe to avoid what he characterized as non-cooperation between democracies. Canada’s Prime Minister Mark Carney was direct: we will have done something wrong if we just accept this, don’t take the lesson, don’t build out and diversify. The EU Commission said the security concern should be a shared challenge, not one confined to a single jurisdiction. Former UK security minister Tom Tugendhat put it most plainly: sovereignty is more about code than cannons.

Access to Mythos 5 is now available to more than 100 US organizations in Project Glasswing. GPT-5.6 Sol launched under a government-approved partner list. The institutions in France, Germany, Japan, and Canada that were building on Anthropic’s API last month are still not on either list. The two-week block was resolved by building a domestic access framework, not by restoring international access. Allies who want access to the most capable US frontier models now need the US government’s approval — implicitly through Anthropic’s and OpenAI’s government partnership commitments, explicitly through the access structures both companies now operate under.

What the List Is Actually For

The clearest signal that this isn’t primarily a safety story is the structure of the risk framework itself. OpenAI’s Preparedness Framework is explicit: High risk models are deployable with mitigations and access control. Critical models are not deployable. Both GPT-5.6 Sol and Mythos 5 appear in the High band. The government’s access list isn’t responding to a model too dangerous to release. It’s responding to a model dangerous enough to warrant controlling who holds it — but not dangerous enough to halt. The labs continue building capabilities in the High band. The government continues approving who receives the output. That structure produces a specific outcome: the capability gets built, and the US government decides who benefits from it first.

Amazon warned in Semafor’s reporting that Mythos 5 can be jailbroken for malicious purposes even within the approved framework. That warning landed after the access controls were designed. A jailbreak — specifically the unverified jailbreak claim that triggered the export controls — exploits model capability, not organizational access policy. The 100 organizations on Project Glasswing’s list don’t reduce Mythos 5’s capability. They are the checkpoint before the capability reaches the public, and they are a checkpoint that, once crossed, doesn’t prevent the capability from spreading further. The access list addresses who gets first-mover advantage, not what happens after that.

Domestically, the framework creates exactly that: first-mover advantage for approved US organizations in frontier AI capabilities. Internationally, it signals to allied governments that US frontier AI access is a lever Washington controls unilaterally. Macron is right that this is nationalist. Carney’s call to diversify is the rational response to a framework that treats close democratic partners as potential security liabilities. The acceleration of European AI investment and the attention now directed at non-US alternatives are predictable consequences of a policy that locks allies out while the capability frontier advances.

The government didn’t stop the models that crossed its own High risk threshold. It licensed them, under terms it sets without public input, to a list it keeps in an annex it doesn’t release. That’s not a safety outcome. It’s industrial policy dressed as one — and this week, for the first time, it applied simultaneously to the two most capable AI labs in the United States. That’s the new baseline.

AI-generated editorial illustration · TemperatureZero · June 27, 2026