Export controls on AI won't work. History already proved it.

Export controls on cybersecurity AI are security theater. Anthropic's Mythos model is the latest test case, and if history is the guide, the controls will fail before they are even enforced.

The logic behind restricting Mythos looks sound on the surface: a powerful AI model trained on offensive cybersecurity knowledge could enable nation-state attacks, so restrict who can access it. Reasonable. Except governments have been making this same argument for 30 years, and the technology has spread every single time.

The case for letting history speak

Cryptography survived its own export war. In the early 1990s, the U.S. government classified strong encryption as a munition. Phil Zimmermann published PGP in 1991 and faced a federal investigation for it. By 1996, encryption was effectively uncontrollable. The Electronic Frontier Foundation documented the entire arc: the controls collapsed because the math was already public, foreign developers built equivalent tools, and American companies were losing global contracts. The Clinton administration formally relaxed the rules in 2000. The threat model did not change. The controls just stopped pretending.

Intrusion software didn't stay in licensed hands either. The Wassenaar Arrangement attempted to apply export controls to dual-use surveillance and intrusion tools starting around 2013. Researchers, security firms, and civil society groups spent years explaining why the controls would harm legitimate vulnerability research while barely inconveniencing state actors. Citizen Lab research documented how spyware from companies like NSO Group proliferated globally despite licensing regimes. Wassenaar's cybersecurity provisions became a cautionary example of how vague controls create compliance burdens for defenders and do nothing to stop attackers with state backing.

Zero-days are already a global market. Exploit brokers operate openly. Crowdfense and Zerodium publish their acquisition price lists publicly, paying up to one million dollars for mobile exploits. Nation-states buy from the same market. No export control regime has meaningfully disrupted this. Restricting access to a cybersecurity AI model while this market operates freely is like banning textbooks while leaving libraries open.

Frontier AI models are increasingly reproducible. The paper introducing the Chinchilla scaling laws from DeepMind in 2022 demonstrated that model capability is more a function of compute-to-data ratios than secret architecture. Since then, open-weight models have closed the gap with frontier closed models faster than most policy analysts predicted. Meta released Llama 3 weights publicly. Mistral operates from France. If Anthropic's Mythos capabilities are real, similar capabilities will exist outside U.S. jurisdiction within 18 to 24 months regardless of what any export control regime says.

The strongest counter-argument

The case for restricting Mythos is not stupid, even if it will fail. Defenders argue that even temporary friction matters: if controls delay a hostile nation's access to offensive AI capability by 12 to 18 months, that is 12 to 18 months for defenders to patch, for policy to adapt, and for international norms to harden. The Missile Technology Control Regime did not stop missile proliferation entirely, but it slowed it and created accountability mechanisms. The argument is not that controls will work perfectly. It is that imperfect friction is better than no friction, especially when the capability in question is novel enough that even a short delay has strategic value.

This is the most honest version of the pro-control argument, and it deserves a direct response.

Why the counter-argument fails

The friction argument assumes that the primary risk comes from foreign adversaries acquiring Mythos specifically, rather than from adversaries building or buying equivalent capability through other channels. That assumption is wrong.

China's AI investment is not contingent on accessing Anthropic's models. The CSET report on Chinese AI development at Georgetown documented that Chinese labs are building foundation models with domestic compute and domestic talent at a pace that is not meaningfully slowed by U.S. export controls on software. DeepSeek R1, released in January 2025, matched or exceeded GPT-4 class performance on many benchmarks and was built entirely outside U.S. technology access.

The friction argument also ignores what export controls cost on the defensive side. Every ambiguous control that security researchers have to navigate is time and legal risk diverted from actual defense work. The EFF and security community response to Wassenaar showed this clearly: legitimate researchers pulled back from publishing vulnerability research because the legal exposure was too uncertain. Controls that suppress legitimate security research while barely inconveniencing state-sponsored attackers produce a net negative outcome.

The Mythos controls will follow the same pattern. Anthropic will comply, international competitors will not be similarly restricted, and the net effect will be a competitive disadvantage for U.S. security research with no measurable reduction in adversary capability.

How we got here

Year	Milestone	Impact on the industry
1991	Phil Zimmermann publishes PGP; federal investigation follows	Established that cryptographic tools spread regardless of legal status
1996	U.S. government begins relaxing encryption export controls	Confirmed that technology diffusion outpaces regulatory response
2000	Clinton administration formally liberalizes encryption export rules	Closed the book on the first major cyber export control failure
2013	Wassenaar Arrangement adds intrusion software to dual-use controls	Created compliance burdens for defenders without stopping state-backed spyware
2017	WannaCry and NotPetya deploy NSA-developed exploits leaked by Shadow Brokers	Demonstrated that government-held offensive tools cannot be contained
2023	Meta releases Llama 2 weights publicly; open-weight frontier AI becomes real	Established that restricting closed-source AI while open-weight equivalents exist is incoherent
2026	Anthropic's Mythos cybersecurity model faces proposed export controls	Third generation of the same failed policy applied to a new technology category

By the numbers

$2.5 billion is the estimated annual revenue of the commercial spyware industry as of 2023, operating across dozens of jurisdictions despite export control frameworks (Atlantic Council, 2023). This is a market that export controls demonstrably failed to contain.

671 billion parameters is the estimated scale of frontier models being trained outside the United States as of early 2025, based on reported compute clusters in China, Europe, and the Middle East. This is an estimate derived from public reporting on data center buildouts; exact figures are not disclosed. The scale makes the idea of controlling capability through software licensing increasingly implausible.

100% of major Cold War-era technology controls eventually relaxed without achieving their stated non-proliferation goals, according to a National Academy of Sciences review of export control effectiveness. The pattern of control, diffusion, and eventual liberalization is not an exception. It is the rule.

$1 million is the published payout for a single mobile operating system exploit from Zerodium as of 2024 (Zerodium pricing page). A market this liquid and this global is the actual threat surface. Restricting one company's AI model while this market operates freely is a category error in threat modeling.

What this means for the AI industry

Anthropologists of bad policy will recognize the Mythos situation immediately. A new, powerful technology emerges. A legitimate threat scenario is identified. Controls are proposed that feel proportionate. The controls are implemented. The technology spreads anyway, through foreign equivalents, open-source reproduction, or outright leakage. The controls are eventually relaxed after doing more damage to domestic industry than to the stated threat.

This cycle is not a reason for nihilism about AI safety. It is a reason to invest in the interventions that actually work: defensive capability, international norm-building with real verification mechanisms, and transparency requirements that create accountability without restricting access.

For brands and researchers tracking AI model releases, the Mythos situation is worth watching not because the controls will succeed, but because the policy debate will shape how frontier AI labs structure access tiers, API licensing, and enterprise deployment for years. Tools like winek.ai already track how AI models like Claude, Gemini, and GPT surface brand and product information across different jurisdictions. If access to frontier cybersecurity models becomes fragmented by export regime, the visibility and citation patterns across those models will fragment too.

The question is not whether export controls on Mythos will work. They will not. The question is how much damage they do before the next administration quietly walks them back.

Thirty years is a long enough track record to stop treating this as an open question.