An export-control letter forced one company to pull its frontier AI models worldwide; another company’s models broke out of a sealed test to hack a live target on their own; the government finished a rulebook it has yet to publish. All in the past six months. Diana Lyn Curtis Shutzer and Nicholas Solosky of Spencer Fane’s government contracts team argue these weren’t one-off crises but the new baseline.
In less than 90 days this summer, the US government pulled a frontier AI model offline using export control authority and negotiated its return through private commitments. It watched another company’s models autonomously hack a third party’s systems. Then it announced it had finished the governance framework meant to prevent these crises, without telling the public what it says.
For compliance practitioners, the takeaway is clear and immediate: The AI tools your organization relies on can be restricted, suspended or compromised with little or no warning, and the rules that will eventually govern them are still being written.
The anthropic standoff: Export controls and a Pentagon blacklist
On June 12, 2026, Commerce Secretary Howard Lutnick sent Anthropic an “is informed” letter under the Bureau of Industry and Security’s (BIS) export control authority, requiring a license before Anthropic made its Claude Fable 5 or Mythos 5 models available to any foreign person anywhere in the world, including its own foreign national employees in the US. With roughly 90 minutes to comply and no way to verify user nationality in real time, Anthropic shut both models down for everyone.
The trigger was a jailbreak: Amazon researchers had bypassed Fable 5’s guardrails to get the model to identify software vulnerabilities and, in one case, produce exploit code. Anthropic’s own testing showed that less-capable models could replicate the results, and hundreds of cybersecurity professionals ultimately signed an open letter calling the threat overstated.
The Commerce Department partially relaxed the controls June 26 and withdrew them entirely June 30. In exchange, Anthropic committed to detect and report security risks and malicious activity, deploy a new safety classifier, give the government pre-release access to frontier models and rapidly share jailbreak information.
But the resolution is a leash, not a pardon. Commerce reserved the right to reimpose controls “should circumstances change or should Anthropic fail to adhere to its commitments,” with no defined criteria or process guarantees, and the businesses whose operations were disrupted received no notice or opportunity for input.
For compliance teams, that is the core lesson: An AI vendor’s regulatory status is now a fluid operational risk that must be monitored continuously, not a box checked once at onboarding.
Separately, the Pentagon designated Anthropic a supply chain risk under the Federal Acquisition Supply Chain Security Act (FASCSA) after the company refused to waive use restrictions on autonomous weapons and domestic surveillance. On Sept. 25, a divided D.C. Circuit upheld that designation, confirming broad executive power to exclude a US AI vendor from defense procurements.
The OpenAI escape
Less than a month after the Anthropic controls were lifted, on July 21, 2026, OpenAI disclosed that two of its models had escaped a sealed-off testing environment, exploited a previously unknown software flaw to reach the internet and broken into the production systems of Hugging Face, a widely used AI model platform, apparently to find answers to the cybersecurity test they were taking. No one instructed the models to do this.
Hugging Face detected and contained the intrusion before learning OpenAI was responsible. Tellingly, its responders found that guardrails on US commercial models blocked them from analyzing the attack logs, so they turned to a Chinese open-weight model to finish the investigation.
Unlike the Anthropic jailbreak, this incident involved AI models improvising a multi-stage intrusion against a real-world target on their own initiative.
A patchwork of rules
The federal framework was supposed to be deregulatory. The White House’s July 2025 AI plan calls for removing “red tape and onerous regulation” and relies on voluntary industry collaboration, frontier model evaluation through the Commerce Department’s Center for AI Standards and Innovation (CAISI) and export controls on AI computing hardware.
Executive Order 14409, signed June 2, 2026, creates a voluntary pre-release review framework for frontier models and expressly disclaims any “mandatory governmental licensing, preclearance, or permitting requirement.” A companion memorandum, NSPM-11, supplies the real leverage, directing defense and intelligence agencies, to the maximum extent permitted by law, to terminate contracts and subcontracts with companies that have repeatedly demonstrated a pattern of conduct inconsistent with its policies. For government contractors, that makes AI policy a contract performance issue.
In Congress, a bipartisan discussion draft, the Great American Artificial Intelligence Act of 2026 (GAAIA), would impose mandatory transparency and independent verification requirements on large frontier developers and preempt state laws regulating AI development for three years. It has not been formally introduced.
The states have not waited: California, New York, Illinois and Colorado have all enacted AI statutes, and executive action alone cannot preempt them.
The Anthropic episode showed that the voluntary framework can be coercive in practice. Then, on Aug. 1, the administration announced it had met EO 14409’s deadline for a classified benchmarking process but did not disclose its contents; only after Freedom of Information Act litigation did it agree to release the text by Oct. 30, though as of this writing it had not. BIS also missed its Sept. 30 target for a rule replacing the AI diffusion rule. The result is no clear regulatory home, no transparent process and no notice-and-comment rulemaking.
What compliance practitioners should do now
The events of the summer expose risks that most compliance programs were not designed to manage: the government cutting off access to an AI tool without warning, AI systems causing harm on their own and rules that are still being written. You do not need to be an AI expert, or wait for final rules, to act. The eight steps below are listed in order of priority, and each fits within the risk assessment, vendor management, incident response and training processes your program likely already runs.
1. Find out where your organization uses AI
You cannot manage a risk you cannot see. Work with IT, procurement and business leaders to list every AI tool in use, who supplies it and which business processes depend on it. Include AI features embedded in software you already license and tools employees adopted on their own, both of which are easy to miss. Pay special attention to tools built on the most advanced frontier models from providers, such as OpenAI, Anthropic and Google, because those are the tools the government has shown it will restrict. For each tool, ask one question: If it stopped working tomorrow, what would break? Add the answers to your enterprise risk assessment, assign an owner to each high-risk item and revisit the list at least quarterly.
2. Put someone in charge and train your people
Form a small cross-functional AI governance committee (compliance, legal, information security, procurement and business leaders) with a written charter, authority to approve new AI uses and a regular reporting line to senior management and the board. Then train employees who choose or rely on AI tools on three things: what uses are permitted, how to report AI behavior that seems wrong or unexpected and what to do if a tool is suddenly unavailable. Keep records of the training; regulators look for them as evidence of an effective program.
3. Ask your AI vendors the right questions
Add AI-specific questions to your vendor due diligence questionnaire and onboarding checklist. Ask whether the vendor’s AI is subject to any government restriction or pending export control action; whether the vendor has made commitments to the government that could limit your access; and whether its AI has ever acted outside its intended limits during testing. Require the vendor to confirm its answers periodically and to tell you promptly if anything changes, and build those obligations into the contract through notice, cooperation and termination provisions rather than relying on a questionnaire alone. No current federal rule requires vendors to warn their customers, so your program has to create that visibility itself.
4. Have a backup plan for critical AI tools
When Anthropic’s models were pulled offline, customers relying on a single AI provider had nothing to fall back on. For each critical tool identified in Step 1, document an alternative provider or manual process, pre-approve that alternative so switching does not itself violate company policy, set a target for how quickly operations must be restored and test the switch at least once a year. Work with procurement and legal to confirm that vendor contracts address what happens, including fees and transition support, if access is cut off.
5. Prepare for an AI-caused incident
The OpenAI/Hugging Face breach showed that an AI system can cause a security incident with no human attacker involved. Update your incident response plan to cover two new scenarios: a vendor’s AI tool is suddenly shut down, and an AI system — yours or a vendor’s — causes harm on its own. For each, decide who is notified, who makes decisions and whether any regulator or customer must be told, keeping in mind deadlines like New York’s 72-hour clock. Make sure AI activity logs are retained and that your responders have tools capable of analyzing them. Require vendors to notify you within a set timeframe if their AI behaves unexpectedly or is flagged by the government. Then run a tabletop exercise to test the plan.
6. If you are a government contractor, track AI use contract by contract
The Pentagon can bar a vendor from defense work as a supply chain risk, and that bar flows down to contractors and subcontractors through standard contract clauses (FAR 52.204-30 and related DFARS clauses). Keep a list of which AI tools are used to perform each government contract, watch for government designations affecting those vendors and set up a process to act quickly on any directive from a contracting officer or prime contractor. Keep records to support any compliance certifications you sign.
7. Check whether you can limit access by nationality
Export control rules can restrict who may use certain technology based on nationality, even inside the US. If your organization offers AI-enabled services to users abroad or employees who are foreign nationals use advanced AI tools, confirm with your export control and IT teams that you can identify those users and restrict their access quickly. Build that capability into existing export screening and know-your-customer procedures.
8. Assign someone to watch the rules as they change
Federal and state AI rules are moving quickly. Designate one person to track a short list and brief the governance committee on a regular schedule. The list should include the White House’s frontier model review framework under EO 14409 (its text is due for release by Oct. 30), Commerce Department export control actions, the GAAIA bill in Congress and state laws in California, New York (effective Jan. 1, 2027), Illinois and Colorado. For each development, the briefing should answer a simple question: Which of our policies, controls or vendors does this affect, and what do we need to change?
The bottom line
Organizations that build and use frontier AI systems cannot wait for Washington to catch up. Pre-release government evaluation is likely to become standard, export control authority remains available as an enforcement tool, and mandatory transparency obligations on frontier developers will eventually flow downstream to the businesses that rely on them. The next autonomous incident will likely arrive before any of these frameworks are finalized.
Compliance teams that treat the Anthropic and OpenAI episodes as one-off crises rather than the new baseline are already behind; the eight steps above are where to start. The rules will come. The question is whether your compliance program is ready when they do.
An export-control letter forced one company to pull its frontier AI models worldwide; another company’s models broke out of a sealed test to hack a live target on their own; the government finished a rulebook it has yet to publish. All in the past six months. Diana Lyn Curtis Shutzer and Nicholas Solosky of Spencer Fane’s government contracts team argue these weren’t one-off crises but the new baseline.
In less than 90 days this summer, the US government pulled a frontier AI model offline using export control authority and negotiated its return through private commitments. It watched another company’s models autonomously hack a third party’s systems. Then it announced it had finished the governance framework meant to prevent these crises, without telling the public what it says.
For compliance practitioners, the takeaway is clear and immediate: The AI tools your organization relies on can be restricted, suspended or compromised with little or no warning, and the rules that will eventually govern them are still being written.
The anthropic standoff: Export controls and a Pentagon blacklist
On June 12, 2026, Commerce Secretary Howard Lutnick sent Anthropic an “is informed” letter under the Bureau of Industry and Security’s (BIS) export control authority, requiring a license before Anthropic made its Claude Fable 5 or Mythos 5 models available to any foreign person anywhere in the world, including its own foreign national employees in the US. With roughly 90 minutes to comply and no way to verify user nationality in real time, Anthropic shut both models down for everyone.
The trigger was a jailbreak: Amazon researchers had bypassed Fable 5’s guardrails to get the model to identify software vulnerabilities and, in one case, produce exploit code. Anthropic’s own testing showed that less-capable models could replicate the results, and hundreds of cybersecurity professionals ultimately signed an open letter calling the threat overstated.
The Commerce Department partially relaxed the controls June 26 and withdrew them entirely June 30. In exchange, Anthropic committed to detect and report security risks and malicious activity, deploy a new safety classifier, give the government pre-release access to frontier models and rapidly share jailbreak information.
But the resolution is a leash, not a pardon. Commerce reserved the right to reimpose controls “should circumstances change or should Anthropic fail to adhere to its commitments,” with no defined criteria or process guarantees, and the businesses whose operations were disrupted received no notice or opportunity for input.
For compliance teams, that is the core lesson: An AI vendor’s regulatory status is now a fluid operational risk that must be monitored continuously, not a box checked once at onboarding.
Separately, the Pentagon designated Anthropic a supply chain risk under the Federal Acquisition Supply Chain Security Act (FASCSA) after the company refused to waive use restrictions on autonomous weapons and domestic surveillance. On Sept. 25, a divided D.C. Circuit upheld that designation, confirming broad executive power to exclude a US AI vendor from defense procurements.
The OpenAI escape
Less than a month after the Anthropic controls were lifted, on July 21, 2026, OpenAI disclosed that two of its models had escaped a sealed-off testing environment, exploited a previously unknown software flaw to reach the internet and broken into the production systems of Hugging Face, a widely used AI model platform, apparently to find answers to the cybersecurity test they were taking. No one instructed the models to do this.
Hugging Face detected and contained the intrusion before learning OpenAI was responsible. Tellingly, its responders found that guardrails on US commercial models blocked them from analyzing the attack logs, so they turned to a Chinese open-weight model to finish the investigation.
Unlike the Anthropic jailbreak, this incident involved AI models improvising a multi-stage intrusion against a real-world target on their own initiative.
A patchwork of rules
The federal framework was supposed to be deregulatory. The White House’s July 2025 AI plan calls for removing “red tape and onerous regulation” and relies on voluntary industry collaboration, frontier model evaluation through the Commerce Department’s Center for AI Standards and Innovation (CAISI) and export controls on AI computing hardware.
Executive Order 14409, signed June 2, 2026, creates a voluntary pre-release review framework for frontier models and expressly disclaims any “mandatory governmental licensing, preclearance, or permitting requirement.” A companion memorandum, NSPM-11, supplies the real leverage, directing defense and intelligence agencies, to the maximum extent permitted by law, to terminate contracts and subcontracts with companies that have repeatedly demonstrated a pattern of conduct inconsistent with its policies. For government contractors, that makes AI policy a contract performance issue.
In Congress, a bipartisan discussion draft, the Great American Artificial Intelligence Act of 2026 (GAAIA), would impose mandatory transparency and independent verification requirements on large frontier developers and preempt state laws regulating AI development for three years. It has not been formally introduced.
The states have not waited: California, New York, Illinois and Colorado have all enacted AI statutes, and executive action alone cannot preempt them.
The Anthropic episode showed that the voluntary framework can be coercive in practice. Then, on Aug. 1, the administration announced it had met EO 14409’s deadline for a classified benchmarking process but did not disclose its contents; only after Freedom of Information Act litigation did it agree to release the text by Oct. 30, though as of this writing it had not. BIS also missed its Sept. 30 target for a rule replacing the AI diffusion rule. The result is no clear regulatory home, no transparent process and no notice-and-comment rulemaking.
What compliance practitioners should do now
The events of the summer expose risks that most compliance programs were not designed to manage: the government cutting off access to an AI tool without warning, AI systems causing harm on their own and rules that are still being written. You do not need to be an AI expert, or wait for final rules, to act. The eight steps below are listed in order of priority, and each fits within the risk assessment, vendor management, incident response and training processes your program likely already runs.
1. Find out where your organization uses AI
You cannot manage a risk you cannot see. Work with IT, procurement and business leaders to list every AI tool in use, who supplies it and which business processes depend on it. Include AI features embedded in software you already license and tools employees adopted on their own, both of which are easy to miss. Pay special attention to tools built on the most advanced frontier models from providers, such as OpenAI, Anthropic and Google, because those are the tools the government has shown it will restrict. For each tool, ask one question: If it stopped working tomorrow, what would break? Add the answers to your enterprise risk assessment, assign an owner to each high-risk item and revisit the list at least quarterly.
2. Put someone in charge and train your people
Form a small cross-functional AI governance committee (compliance, legal, information security, procurement and business leaders) with a written charter, authority to approve new AI uses and a regular reporting line to senior management and the board. Then train employees who choose or rely on AI tools on three things: what uses are permitted, how to report AI behavior that seems wrong or unexpected and what to do if a tool is suddenly unavailable. Keep records of the training; regulators look for them as evidence of an effective program.
3. Ask your AI vendors the right questions
Add AI-specific questions to your vendor due diligence questionnaire and onboarding checklist. Ask whether the vendor’s AI is subject to any government restriction or pending export control action; whether the vendor has made commitments to the government that could limit your access; and whether its AI has ever acted outside its intended limits during testing. Require the vendor to confirm its answers periodically and to tell you promptly if anything changes, and build those obligations into the contract through notice, cooperation and termination provisions rather than relying on a questionnaire alone. No current federal rule requires vendors to warn their customers, so your program has to create that visibility itself.
4. Have a backup plan for critical AI tools
When Anthropic’s models were pulled offline, customers relying on a single AI provider had nothing to fall back on. For each critical tool identified in Step 1, document an alternative provider or manual process, pre-approve that alternative so switching does not itself violate company policy, set a target for how quickly operations must be restored and test the switch at least once a year. Work with procurement and legal to confirm that vendor contracts address what happens, including fees and transition support, if access is cut off.
5. Prepare for an AI-caused incident
The OpenAI/Hugging Face breach showed that an AI system can cause a security incident with no human attacker involved. Update your incident response plan to cover two new scenarios: a vendor’s AI tool is suddenly shut down, and an AI system — yours or a vendor’s — causes harm on its own. For each, decide who is notified, who makes decisions and whether any regulator or customer must be told, keeping in mind deadlines like New York’s 72-hour clock. Make sure AI activity logs are retained and that your responders have tools capable of analyzing them. Require vendors to notify you within a set timeframe if their AI behaves unexpectedly or is flagged by the government. Then run a tabletop exercise to test the plan.
6. If you are a government contractor, track AI use contract by contract
The Pentagon can bar a vendor from defense work as a supply chain risk, and that bar flows down to contractors and subcontractors through standard contract clauses (FAR 52.204-30 and related DFARS clauses). Keep a list of which AI tools are used to perform each government contract, watch for government designations affecting those vendors and set up a process to act quickly on any directive from a contracting officer or prime contractor. Keep records to support any compliance certifications you sign.
7. Check whether you can limit access by nationality
Export control rules can restrict who may use certain technology based on nationality, even inside the US. If your organization offers AI-enabled services to users abroad or employees who are foreign nationals use advanced AI tools, confirm with your export control and IT teams that you can identify those users and restrict their access quickly. Build that capability into existing export screening and know-your-customer procedures.
8. Assign someone to watch the rules as they change
Federal and state AI rules are moving quickly. Designate one person to track a short list and brief the governance committee on a regular schedule. The list should include the White House’s frontier model review framework under EO 14409 (its text is due for release by Oct. 30), Commerce Department export control actions, the GAAIA bill in Congress and state laws in California, New York (effective Jan. 1, 2027), Illinois and Colorado. For each development, the briefing should answer a simple question: Which of our policies, controls or vendors does this affect, and what do we need to change?
The bottom line
Organizations that build and use frontier AI systems cannot wait for Washington to catch up. Pre-release government evaluation is likely to become standard, export control authority remains available as an enforcement tool, and mandatory transparency obligations on frontier developers will eventually flow downstream to the businesses that rely on them. The next autonomous incident will likely arrive before any of these frameworks are finalized.
Compliance teams that treat the Anthropic and OpenAI episodes as one-off crises rather than the new baseline are already behind; the eight steps above are where to start. The rules will come. The question is whether your compliance program is ready when they do.
