When a cutting-edge AI model lands in the middle of a decades-old policy debate, the outcome is rarely surprising. Anthropic’s Claude Mythos Preview, a model reportedly trained for cybersecurity applications and currently restricted to a limited set of trusted partners through the company’s Project Glasswing initiative, has reignited a familiar argument: can export controls on software tools ever actually work? Three decades of evidence from encryption battles to commercial spyware suggests the answer is almost certainly no.
The debate matters well beyond Silicon Valley. As AI systems grow capable of identifying software vulnerabilities, analyzing malware, and assisting security professionals at scale, decisions about who gets access to these tools have real-world consequences for organizations defending critical infrastructure, hospitals, financial networks, and government systems worldwide. Getting the policy wrong doesn’t just disadvantage American companies. It can leave legitimate defenders under-equipped while determined adversaries build their own versions anyway.
What makes the current moment particularly sharp is speed. Where past technology restriction battles played out over years, AI capabilities replicate and distribute in months. The policy frameworks being debated today were largely designed for a slower era, and security professionals are watching closely to see whether Washington learns from the past or simply reruns it.
The Encryption Wars Set the Template
The clearest historical parallel is the 1990s fight over cryptography export controls. In 1991, when developer Phil Zimmermann released Pretty Good Privacy, better known as PGP, the U.S. government classified strong encryption as a munition under the same export rules that governed missiles and tanks. The result was a years-long legal battle and a global scramble that ultimately achieved the opposite of its intent.
Activists responded by printing PGP’s source code in books, which were protected under First Amendment law, and mailing them internationally. Foreign developers built their own compatible implementations. By 2000, when the Clinton administration finally relaxed the restrictions, strong encryption had already spread across the globe. American companies had ceded market share to international competitors, and anyone who wanted encryption had it.
Offensive Security Tools Followed the Same Pattern
The pattern repeated when governments tried to control penetration testing software and exploit development tools. Security researchers responded by publishing the underlying techniques in academic papers and rebuilding the capabilities as open-source projects. Metasploit, today one of the most widely used security testing frameworks on the planet, began specifically as an open-source project to democratize access to capabilities that official channels were restricting.
Commercial spyware told an even more cautionary tale. Despite export licensing requirements under the Wassenaar Arrangement, an international agreement designed to control dual-use technologies, tools like NSO Group’s Pegasus spyware were documented by researchers at Citizen Lab in more than 45 countries, including many on restricted lists. The controls created compliance paperwork. They did not contain the technology.
Why AI Models Present a Harder Problem
AI models like Claude Mythos Preview present a structurally more difficult challenge than compiled software or physical devices. At their core, these models are mathematical weights and architectural configurations. The research describing how to build cybersecurity-focused large language models is already in the public domain. Academic teams have published extensively on using AI for vulnerability discovery, malware classification, and exploit analysis.
Restricting access to a specific company’s implementation does not prevent state-level actors from training their own models on the same publicly available security datasets, including sources like the National Vulnerability Database and open academic repositories that are accessible to anyone with an internet connection and sufficient computing resources.
The Competitive Calculus Is Complicated
Anthropic is far from alone in developing AI capabilities relevant to cybersecurity. Google’s Project Zero team has publicly demonstrated using machine learning to accelerate the discovery of zero-day software vulnerabilities. OpenAI and Microsoft have shown similar capabilities in adjacent areas. Restricting one company’s specialized model while competitors develop equivalent tools creates a market disadvantage without meaningfully slowing adversary capabilities.
Who Bears the Real Cost of Access Restrictions
The organizations most affected by access restrictions are often not the ones policymakers are worried about. Security teams at universities, smaller companies, and organizations in lower-income countries frequently lack the internal resources to develop their own advanced tools. Restricting access to AI-powered defensive capabilities, while assuming that well-resourced state adversaries cannot develop alternatives, produces a policy that disadvantages defenders more than attackers.
Anthropic has publicly positioned Claude Mythos Preview as available only to a small number of trusted organizations through Project Glasswing, explicitly citing cybersecurity concerns as the reason for its limited release. That caution reflects the company’s broader stated commitment to responsible AI deployment. The harder question is whether any access framework, however carefully constructed, can accomplish what three decades of similar efforts have not.
Arguments for a Different Approach
Some cybersecurity policy veterans have consistently argued that the more productive focus is on behavior and outcomes rather than technology access. A vulnerability scanner is a tool. What determines its impact is whether it is used to patch systems or to exploit them. That framing shifts the policy emphasis toward attribution capabilities, international accountability norms for offensive cyber operations, and consequences for misuse rather than attempts to prevent the spread of the underlying technology.
The Speed Variable Has Changed Everything
What is genuinely different in the current AI era is the pace of replication. PGP took years to spread globally through underground networks, academic channels, and book mailings. Modern AI models, once the underlying architecture and training approaches are published, can be replicated and deployed in months by well-resourced teams. The barriers to entry continue to fall, the research community is more globally distributed than at any point in computing history, and the economic incentives to develop offensive AI capabilities have never been higher.
That compression of timelines puts enormous pressure on policy processes that were not designed for this speed. By the time export control frameworks are negotiated, implemented, and enforced, the technology they target is often already widely distributed.
What Responsible Policy Might Actually Look Like
Anthropic’s cautious approach to Claude Mythos Preview reflects a genuine tension the company cannot resolve on its own. Releasing powerful security-focused AI without any restrictions invites legitimate concerns about misuse. Implementing access controls that history suggests will not contain the technology still creates compliance documentation and signals intent to regulators.
The more durable path forward, as a growing number of security policy researchers have argued, likely involves building international norms and accountability frameworks around the use of AI in offensive cyber operations, investing in transparency mechanisms that make misuse more detectable, and ensuring that legitimate defenders globally have access to the tools they need to protect critical systems.
Export controls on Claude Mythos Preview may satisfy near-term regulatory requirements. The historical record is consistent and clear on whether they will meaningfully slow adversary development of AI-powered cybersecurity capabilities: they will not. The more urgent question for security professionals worldwide is not whether adversaries will eventually access similar tools, but whether defensive organizations will have equivalent capabilities before the next major incident demonstrates that access restrictions were security theater.
The encryption wars ended when the controls became technologically irrelevant, not because they worked. The AI policy debate may be heading toward the same conclusion, only faster.
