Can the US Actually Make Mythos-Level Open Weights Illegal?

The enforceability problem, the constitutional problem, and why this ends worse than the Clipper Chip.

July 12, 2026

The moment we're in

This morning, Nathan Lambert published "6 months to live for open models". ... the direct provocation for this piece.

Lambert's core claim is that the White House is in serious conversations about a new executive order that would functionally cap open-weight models at roughly the GPT-5.5 / Claude Opus 4.8 / GLM-5.2 tier — with any release "meaningfully above" that level requiring some form of government review — and that the incoming action is likely within six months.

He points at the specific June 9 meeting, reported by The Information, where the licensing framework's treatment of open-source came up and a Reflection AI representative argued for capability-based exemptions.

He puts a name on the political-economic dynamic driving it: Anthropic has spent the last year running what he calls a "regulatory capture campaign" on distillation — detailed most incisively by Ben Thompson in Anthropic's Safety Superpower — and the industry has largely failed to develop a coherent counterweight.

His conclusion:

The most likely incoming action is to ban or indefinitely delay any open-weights model meaningfully above the capability level in the range of GPT 5.5, Claude Opus 4.8, or GLM-5.2. With the consistent capability gap, this should be within the next 6 months.

I take Lambert seriously. The political story he's telling is real, the timeline he's describing is real, and the White House discussions he references have been circulating in Washington for weeks.

What I want to do here is take his premise as given and ask the enforceability question directly:

Assume the executive order comes. Assume Congress backstops it with statute. Can the United States actually make a Mythos-tier open-weight model illegal in a way that changes what gets built, released, and used inside American borders?

The short answer is no.

The long answer is that the attempt would set a First Amendment precedent worse than anything the Clinton administration (driven by then-senator Biden) tried with encryption in the 1990s, and it would fail for the same reasons the Clipper Chip failed — plus a few new ones that the crypto wars didn't have.

Consider this the enforcement companion to Lambert's political-economy piece. He asks whether the ban is coming. I'm asking whether, if it comes, it works.

What is actually on the books right now...

Let's be precise about the current state of American law, because the discourse is a total fucking mess.

No federal statute today makes it illegal to release an open-weight model of any capability level. Every existing lever — export controls, entity listings, procurement bans — targets either specific companies (DeepSeek), specific chips (H100, H200, Blackwell), or specific closed-weight releases via existing Export Administration Regulations authority.

The BIS AI Diffusion Rule that the Biden administration pushed out in January 2025 and the Trump administration rescinded in May 2025 was actually structured around the opposite premise: it explicitly used the best available open-weight model as the ceiling for what needed a license, on the theory that you cannot control what is already downloadable from Hugging Face by 30 million people (BIS rescission announcement).

The relevant executive actions currently in force are three.

NSTM-4, "Adversarial Distillation of American AI Models," signed by OSTP Director Michael Kratsios on April 23, 2026. A national security memo. It signals policy direction and directs agencies to coordinate. It is not regulation (NYU RITS, IAPS follow-up, CNAS).

Executive Order 14365, "Eliminating State Law Obstruction of National AI Policy," signed December 11, 2025. It does not directly preempt state AI laws — under the Supremacy Clause, an executive order cannot override a validly enacted state statute. What it does is condition BEAD funding and discretionary federal grants on state cooperation and stand up a DOJ litigation task force to challenge state AI laws (White House, White & Case analysis).

The Mythos/Fable directive of June 12–30, 2026. BIS extended export controls to Anthropic's frontier models on the evening of June 12 at 5:21 pm Eastern. By June 26, controls were partially relaxed to about a hundred vetted US entities. By June 30, they were fully lifted (Anthropic, CNBC, Mayer Brown).

This is the point worth internalizing: the executive branch tried once, at maximum political capital, against a single American company with a single flagship model — and lost the political fight in less than three weeks. The Mythos episode is what the government's strongest current tool looks like in practice. It is the strongest case, cleanly executed, and it collapsed in eighteen days.

Lambert observes that this test happened "with minimal oversight." That's accurate, and it's also what makes the next round dangerous — the executive branch has now discovered that it can attempt model-specific export controls without prior legislative authorization, and it will keep testing that authority even after this loss.

The bills that would come closest to a real ban...

If Congress and the states are going to make top-tier open-weight releases actually illegal, they will do it through one or more of the bills below. Ranked roughly by how close each one comes to a genuine publication ban.

Massachusetts S.37, redraft S.2630 — Sen. Barry Finegold

This is the single closest thing in America to a law that would ban the publication of a top open-weight model. The primary sponsor summary is explicit: the bill would "ban developers from using or making publicly available models that have an unreasonable risk of creating a catastrophic harm." It would also mandate killswitches, require KYC for compute cluster operators, and empower the state attorney general to bring civil actions. Introduced February 2025, redrafted and forwarded as S.2630 on October 16, 2025 (Bill S.37, primary sponsor summary).

The killswitch requirement is what makes this different from every other US frontier AI bill. Every safety-framework bill in every other state requires transparency, testing, and reporting. Only Massachusetts contemplates the actual legal act of prohibiting the release itself on catastrophic-risk grounds.

S.321, Decoupling America's AI Capabilities from China Act (DAAICCA) — Sen. Josh Hawley

Introduced January 29, 2025 and sitting in Senate Judiciary. The Hawley bill would treat AI code and weights as export-controlled the moment a PRC-linked entity downloads them, with penalties of 20 years in prison and $1M for individuals or $100M for corporations. Lawfare called it "unlikely to pass" and pointed out the bill's practical effect would be to functionally criminalize open-source AI in America, since a public Hugging Face upload cannot be gated by the downloader's nationality (S.321, Hawley's own bill PDF, McGuireWoods).

Hawley's bill is the first legislative attempt in the AI era to explicitly extend the "publication as export" theory from the crypto wars. That theory lost in 1999 and has not been meaningfully revived since. More on that below.

H.R. 8283, Deterring American AI Model Theft Act — Rep. Bill Huizenga

Introduced April 15, 2026 with Chairman John Moolenaar as co-lead. Reported out of House Foreign Affairs 43-0 on April 22, 2026. This one is important precisely because it demonstrates what the current bipartisan consensus is willing to do: it targets distillation attacks (foreign parties extracting training signal from US frontier APIs without consent) using BIS Entity List and IEEPA authorities. It carves out consented distillation. In other words, this is a bill that clearly distinguishes theft from open-source publication and only criminalizes the former (Bill text, Huizenga press release, CBO estimate).

H.R. 2683 and S. 3519, Remote Access Security Act (RASA)

The cloud-loophole bill. Passed the House 369-22 on January 12, 2026 (Roll no. 13). Extends export controls to remote access to advanced US compute. Awaiting Senate Banking (House bill, Senate companion, McCormick release, Latham analysis).

H.R. 6875 and S. 4456, AI OVERWATCH Act — Rep. Brian Mast, Sen. Jim Banks

House Foreign Affairs advanced this 42-2-1 on January 21, 2026. Bans Blackwell exports to China for two years and gives Congress a 30-day veto over export licenses. The Senate version drops the congressional-veto provision (HFAC announcement, FDD alert, Punchbowl News on Banks changes).

Chip Security Act, H.R. 3447 and S. 1705 — Sen. Tom Cotton, Rep. Bill Huizenga

Passed House Foreign Affairs with bipartisan support in July 2026. Mandates on-chip location verification for ECCN 3A090, 3A001.z, 4A090, and 4A003.z. Explicitly prohibits backdoors, kill switches, and workload monitoring. This is the enforcement backbone any future open-weight training-compute restriction would ride on (Longterm Wiki with bill numbers, Cyber Express on HFAC passage, Atlantic Council).

Great American AI Act (GAAIA) — Reps. Jay Obernolte, Lori Trahan

269-page discussion draft, June 4, 2026. Preempts state AI laws for three years. Contains open-source security grants — a small tell that the drafters do not want to be seen as banning open weights (Obernolte release, Cybersecurity Dive, FPF comparison).

The state laws already enacted...

None of the enacted state laws bans open-weight releases. Only Massachusetts has even proposed it. But four are worth naming because GAAIA would preempt them and because the transparency requirements they impose are already reshaping what US labs are willing to publish about their models:

California SB 53 (TFAIA) — Signed Sept 29, 2025. Effective Jan 1, 2026 (CalMatters, Hunton).

NY RAISE Act (S6953B / A6453B) — Signed by Gov. Hochul Dec 19, 2025. Effective Jan 1, 2027. $100M compute threshold (Governor's release, Wiley Law, Carnegie).

Illinois SB 315 — May 2026. First US law mandating annual third-party frontier audits (Capitol News Illinois, Crowell).

Texas RAIGA (HB 1709) — Effective Jan 1, 2026. Deployment-focused, not frontier training.

The enforceability problem, laid out clearly...

Set aside constitutional questions for a moment and just think through the mechanics. Assume Congress passes Hawley's DAAICCA verbatim tomorrow, or the executive order Lambert describes materializes and Congress backstops it. What happens next?

The state of the open-weight leaderboard, April 2026 baseline. The BenchLM.ai top-five open-weight leaderboard reads: DeepSeek V4 Pro (87), Kimi K2.6 (86), GLM-5 Reasoning and GLM-5.1 (both 83), and Qwen 3.5 397B (79). All Chinese. Meta's Llama 4 family sits at 43 on the same scale. DeepSeek V3.2-Speciale took gold at IMO, IOI, and ICPC 2026. Kimi K2.5 leads MATH-500 at 98.0% (My Written Word rankings).

This is the specific fact that makes the ban geopolitically self-defeating. The top-five open-weight models in the world are not American. They are already published. They are already on every mirror. They will be downloaded and used in America regardless of what any US statute says, because the marginal cost of copying a file is zero.

As Lambert and Kevin Xu argued in their earlier op-ed, "if we alone ban the import of certain models, the global open-source community will continue" — and using China as the pretext will "backfire" by pushing the rest of the world toward Chinese open-source infrastructure. A US law banning "better than Mythos" open-weight releases is a law that binds only the American labs it was drafted to reassure.

Distribution is essentially free. A frontier model in 2026 is roughly 400GB to 2TB of parameter data. That is smaller than a modest game install. It has been established since the mid-1990s, in cases the government itself conceded, that once a body of digital material exists on a network of a few million machines you cannot recall it. Zimmermann's PGP was distributed as a printed book to defeat US export controls, then OCR'd back into source code in Europe (The Register). No plausible AI ban is going to be more effective than a customs regime that failed against a book.

The primary enforcement targets are unreachable. A US publication ban on a Chinese open-weight model has no defendant. A US publication ban on an American lab's open-weight release has one defendant, but that defendant can simply move first release to a jurisdiction that does not have the ban. Mistral is in Paris. There are non-trivial open-weight labs in Abu Dhabi, Toronto, Tel Aviv, and Singapore. If Meta cannot release Llama-N openly, it releases through a Zurich subsidiary. If Anthropic cannot open-weight a research model — a scenario nobody is claiming Anthropic wants — the research model doesn't get open-weighted, but the API stays up. The ban converts a compliance problem into a corporate structure problem.

APIs aren't magically secure, and this destroys the safety justification. Lambert makes this point cleanly and it deserves reinforcement, because it is where the whole "open bad, closed safe" framing collapses on the evidence. When Anthropic's Mythos was in its most-restricted private beta, Discord amateurs gained unauthorized access to it — not through some sophisticated attack, but by combining data from a Mercor breach with educated guesses about Anthropic's URL conventions. They then used the access to build simple websites, deliberately, to avoid detection.

The Wired reporting is worth reading in full because it describes the entire security posture of the frontier lab ecosystem: model weights sitting behind API endpoints whose access is gated by permissioning schemes that fail to a group of hobbyists working from a Discord server. If Mythos has capabilities dangerous enough to justify banning a hypothetical open-weight equivalent, then those capabilities have already been accessible to unauthorized parties for months.

Lambert's conclusion is the right one: if Anthropic has a truly dangerous capability, the only coherent action is not to host it in a directly queryable API — before any conversation about distillation or open weights.

The users are diffuse and unreachable in another way. Even if you drove the release offshore, the ban's second-order enforcement would require prosecuting Americans who download a banned model. This is the "millions of felons" problem. The user population of Hugging Face is somewhere north of five million monthly active US-based accounts by 2026, and every one of them can pull a model tarball with three lines of Python. You cannot prosecute a policy that a plurality of a profession is required to violate to do their jobs.

The chip-tracking backstop is a decade away, if ever. The Chip Security Act would install location verification on the training compute. Fine. But it is prospective, meaning the chip fleet that already exists outside the US is not covered. It explicitly forbids kill switches and geofencing. And location verification tells you where a chip is, not what it computed. A Chinese lab that already trained DeepSeek V4 on H100s obtained before controls tightened is not affected by any of this.

Compute thresholds age like milk. Every bill that tries to define "frontier" uses a compute threshold — $100M for NY RAISE, $500M revenue for Illinois SB 315, 10^26 FLOP variants circulating in draft form. Algorithmic efficiency is improving between 3x and 10x per year. Mixture-of-experts architectures, like the 397B-parameter Qwen 3.5 that activates only 17B per forward pass, break the threshold logic outright. A bill written today to catch Mythos-class models will, in three years, catch models a talented team of six could train on rented capacity.

The vetted-list model failed in 18 days. The Mythos/Fable episode was the strongest, most surgical version of the ban possible: one company, one country, one set of models, controlled distribution. Commerce still had to relax the controls to a hundred trusted US entities within two weeks and remove them entirely within three. The political economy of any broader open-weight publication ban is worse than that, not better.

The Clipper precedent, and why this ends worse

The strongest historical analogy here is not the export control regime of the 2010s. It is the Clinton administration's crypto policy of 1993 to 1999, which is the last time the United States government tried to ban a specific technology on the theory that publication itself endangered national security. That regime failed, publicly and expensively, and it produced a First Amendment ruling — Bernstein v. Department of Justice — that any AI publication ban will now have to overcome. It will not overcome it easily.

The Clipper Chip

In April 1993, the Clinton White House announced the Clipper Chip, a hardware encryption device with a mandatory key-escrow scheme: the government would hold a copy of every key, split between two agencies, and could decrypt any Clipper-encrypted communication with a warrant. The chip used the classified Skipjack algorithm. It was to be voluntary at first, and then, everyone assumed, mandatory (EFF Clipper archive, MIT OCW, The Register retrospective).

Clipper died three deaths within two years...

First, Matt Blaze published a protocol failure in the Escrowed Encryption Standard in 1994 showing that a 16-bit checksum could be defeated, allowing Clipper users to communicate without the escrow field being recoverable (EFF retrospective).

Second, the market rejected it. Nobody wanted to buy a phone with a government backdoor when unbackdoored alternatives existed.

Third, and this is the part that matters most for the AI case, the export-control theory that Clipper depended on to make sure alternatives didn't exist internationally collapsed in court.

Bernstein

Daniel Bernstein, a math PhD student at Berkeley, wrote an encryption algorithm called Snuffle and tried to publish the source code and an academic paper about it. The State Department told him that publishing source code counted as "exporting a munition" under the International Traffic in Arms Regulations. He sued, with EFF backing.

In 1996, Judge Marilyn Hall Patel held that source code is speech protected by the First Amendment (Bernstein I opinion). She then held, in Bernstein II, that the export-control regime as applied to cryptographic source code operated as an unconstitutional prior restraint. The Ninth Circuit affirmed in May 1999 on prior-restraint grounds, in an opinion by Judge Betty Fletcher that is worth quoting because every word applies to AI weights just as well as to Snuffle source code:

We find that the EAR regulations (1) operate as a prepublication licensing scheme that burdens scientific expression, (2) vest boundless discretion in government officials, and (3) lack adequate procedural safeguards. Consequently, we hold that the challenged regulations constitute a prior restraint on speech that offends the First Amendment.

And, more pointedly:

Cryptographers use source code to express their scientific ideas in much the same way that mathematicians use equations or economists use graphs.

The Ninth Circuit later withdrew the opinion en banc for reasons unrelated to the substantive holding (regulatory change had mooted much of the specific dispute), but the underlying finding was never reversed and the regulations themselves were rewritten to accommodate it. Encryption source code has been freely publishable in the United States, without a license, ever since. The entire modern internet is built on that outcome (EFF case archive, Britannica, MTSU First Amendment Center, Columbia Global Freedom of Expression).

Why Bernstein cuts harder against an AI publication ban than it did against Clipper

The best-argued position against extending Bernstein to AI model weights is that weights are functional in a way source code is not. This is the argument in a recent University of Illinois paper: model weights "should not receive First Amendment protection because they are predominantly functional machine-readable parameters rather than expressive content and are not used as a medium of human communication" (Illinois Experts). Lawfare made a similar argument in 2024 (Lawfare). And there is a note in a Nelson Mullins survey worth taking seriously: since 2000, every published opinion actually engaging the "code is speech" doctrine on the merits has ruled for the government (Nelson Mullins PDF).

But those arguments run into three problems in the AI case.

First, the accompanying materials are unambiguously expressive. No serious open-weight release ships raw weights alone. Every one of them ships alongside a paper, a model card, benchmark results, safety evaluations, training-data descriptions, and often source code for training and inference. All of the accompanying materials are core scientific expression of exactly the kind Bernstein protected. Any regulation that reaches the weights necessarily reaches the paper, because you cannot publish "DeepSeek V4 Pro achieves 87 on BenchLM.ai" without saying what DeepSeek V4 Pro is. This puts the government in the position of writing a prior-restraint scheme that somehow only touches the parameter file, which is not administrable.

Second, the prior-restraint analysis in Bernstein does not depend on whether weights are "expressive." It depends on whether the regulatory scheme is a prepublication licensing regime that burdens scientific expression, vests boundless discretion in officials, and lacks adequate procedural safeguards. Hawley's DAAICCA fails all three prongs on its face. Massachusetts's "unreasonable risk of catastrophic harm" standard fails the last two on its face. The nascent "White House AI model checker" Lambert names is, functionally, the exact prepublication licensing scheme the Ninth Circuit condemned in 1999.

Third, and this is the political point rather than the legal one, the crypto wars ended in a rout because the underlying technology worked and the government's alternative did not. People wanted secure communication and they got it. Any US ban on top-tier open-weight AI models finds itself in an even weaker position: the technology the government is trying to suppress works better than the alternative, the alternative doesn't exist (there is no "escrowed" version of an AI model), and the top of the leaderboard is already Chinese and already free.

The 1990s crypto wars produced the modern internet in part because the government lost cleanly. The AI wars, if they take this shape, would produce the same outcome by the same mechanism, and probably faster.

The regulatory-capture problem Lambert names

There is a piece of this that is not primarily a legal question and deserves to be said plainly.

Lambert's read of the distillation debate as a regulatory-capture campaign led by Anthropic is correct on the evidence available. The pattern he describes — Anthropic identifying foreign API abuse, publishing strongly-worded recommendations to lawmakers, sharing minimal technical evidence, and arriving at policy recommendations that would deliver Anthropic itself substantial economic security — is what regulatory capture looks like from the inside of the sector under discussion.

Ben Thompson's Stratechery piece makes the deeper structural point: Anthropic has aligned its safety mission with its commercial interest so seamlessly that the two are effectively indistinguishable, and the resulting policy posture flows from a genuine internal belief that Anthropic alone should be building at the frontier. Thompson's summary is worth quoting:

what should be blisteringly clear is that Anthropic does not think that anyone else other than them should even be making frontier LLMs.

Whether or not you find Thompson's read too sharp, the political mechanism is the one that would drive any US open-weight ban.

A frontier closed-weight lab experiences legitimate business harm from a foreign competitor distilling its outputs. The lab has policy shops, communications budgets, and access. Open-weight releases, by contrast, have no central economic champion. The resulting asymmetry produces legislation that binds the open ecosystem to protect the closed one.

The Discord Sleuths story is the empirical answer to the safety half of that argument. If Anthropic's own model was accessible to hobbyists during private beta because permissioning and URL guessing were enough to bypass their controls, the "open weights are uniquely dangerous" framing does not survive contact with the actual security posture of the closed alternative. Both distribution modes leak. The question is which regime creates better tools for defenders to keep up. Historically, in every prior technology-security debate, the answer has been the open one.

Nadella just said the quiet part out loud...

Something remarkable happened while I was drafting this. Earlier today, July 12, 2026, Satya Nadella published an essay on X called "The Reverse Information Paradox" (full text on snscratchpad). The CEO of Microsoft — the company that holds OpenAI's IP and operates one of the two largest closed-model businesses on Earth — argued, in his own words, that the closed-model business model as currently practiced is a one-way value extraction from customers to model providers.

His framing is worth quoting because it lines up almost exactly with the argument Lambert is making about regulatory capture, except from the top of the closed-model food chain:

While the great innovation that comes from model providers having fair use rights to train models on public data is needed, I find it ironic that the status quo is to then turn around and impose restrictive terms on distillation, and to reserve the right to learn from customer usage and interaction data. If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself.

Read that sentence twice. The CEO of Microsoft is publicly identifying the asymmetry that the distillation-restriction lobby depends on — closed labs claim fair use to train on the world's public data, then contractually prohibit their customers from doing the same thing to model outputs — and calling it what it is. He is calling for enterprises to demand "the rights to use model outputs to fine tune and/or train their own models," and framing it as "every firm's right to align models to their enterprise accountability obligations."

That is a direct rebuttal, from the most commercially aligned CEO in the industry, of the exact legal theory Hawley's DAAICCA is built on. If "restrictive terms on distillation" imposed by contract by a private company are, in Nadella's own framing, an unfair one-way transfer, then a federal statute criminalizing distillation with 20-year prison terms is that same transfer with the machinery of the state welded onto it.

Aravind Srinivas amplified the point by pulling out that exact line — "If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure" — and letting it stand on its own. When the CEOs of Microsoft and Perplexity are both signaling that the closed-lab distillation-restriction regime is a value-capture play dressed up as a safety concern, the political ground under a federal open-weight publication ban gets meaningfully softer.

I put the corollary bluntly: "Without explicitly saying it, Satya says the only way to protect your IP is to use open weights models (ideally self-hosted on your OWN air-gapped hardware, ideally by a platform that continuously orchestrates the latest SOTA open weights releases) as exclusively as possible."

That is the reading the closed-model providers do not want to be true, but it follows directly from Nadella's five-C framework — Control, Capability, Choice, Cost, Compound — which he described as "a real trust boundary for their human capital and token capital to compound." The only architecture that lets an enterprise fully own its own learning loop is one where the model itself lives inside the trust boundary. That means open weights, ideally self-hosted.

This is Nadella quoting Alex Karp in the same essay:

What the technical customers want is control over their compute, their models, their data stack, and their alpha. They want to know they own the means of production, and it's not being transferred to someone else.

"The current regime does precisely the transfer Karp and companies fear." Nadella's words, not mine.

The implication for the ban debate is the one closed-lab lobbyists least want made explicit. If enterprise IP protection requires open-weight models running on hardware the enterprise controls, then a federal law that caps open-weight capability at GPT-5.5 / Opus 4.8 / GLM-5.2 is not a safety measure against foreign adversaries. It is a moat around the closed-model providers, enforced by federal law, that forces every American enterprise to keep feeding its institutional knowledge into someone else's learning infrastructure. Nadella himself just described that outcome and called it a paradox that needs solving.

The most powerful CEO in enterprise AI is telling his own customers to build their AI stack on open weights. Six months before the executive order Lambert is warning about is likely to issue. That is a fact worth sitting with.

What would actually work, if the goal is real...

Say you take the national-security concerns seriously — because there are real concerns, and pretending otherwise is dishonest. Distillation attacks against US frontier labs are happening. PRC-linked entities are training on smuggled H100s. Adversarial fine-tuning of open weights for CBRN uplift is a legitimate research question. What can the US actually do?

The bills that make sense on this analysis are the ones that target the choke points that remain physical: chips, cloud access, and consented-versus-nonconsented distillation.

H.R. 8283, Deterring American AI Model Theft Act — targets nonconsented distillation, carves out consent. This is the shape of a defensible restriction.

H.R. 2683 and S. 3519, RASA — closes the cloud-loophole. This targets a genuine, controllable, physical resource.

Chip Security Act, H.R. 3447 and S. 1705 — creates provenance for the training compute itself.

AI OVERWATCH Act, H.R. 6875 — congressional review over export licenses for top-end training chips.

None of those is a publication ban on weights. Each targets a physical bottleneck or an act with a clear non-speech element — theft, remote intrusion, hardware diversion. The distinction the Bernstein court drew — expression versus functional conduct — maps cleanly onto this list.

The bills that do not make sense on this analysis are the ones that make publication itself the trigger.

Hawley's S.321, because it makes "publication where a Chinese entity might download" the trigger. Prior-restraint problem in its strongest form.

Massachusetts S.37's ban clause, because "unreasonable risk of catastrophic harm" combined with a "may not make publicly available" mandate, administered by the AGO with unfettered discretion, is the licensing regime Bernstein prohibits.

Any executive order that would install a "White House AI model checker" with prepublication authority over open-weight releases above a capability threshold. This is Lambert's warning scenario, and it is the one most likely to actually issue in the coming six months, because it can be tried without Congress. It would also be the fastest to lose in the Ninth Circuit.

The distinction the government keeps trying to blur is the distinction the Ninth Circuit drew in 1999: you can regulate people who do bad things with tools, and you can regulate the physical infrastructure that produces the tools, but you cannot maintain a prepublication licensing scheme over the tools themselves when the tools are also a medium of scientific expression. That was true of PGP source code in 1996. It is more true of AI model weights and their accompanying scientific artifacts in 2026, because the surrounding expressive material is denser.

What builders should actually watch...

Lambert's timeline — six months — is the one to plan against. Concretely:

The rumored open-weight executive order.Reported White House discussions suggest an EO limited to Chinese-origin models and government-adjacent uses. Read that scope narrowly for now, but understand that scope expansion is how these things always go. If the order issues and any part of it can be read to constrain American open-weight publication above a capability threshold, expect a Bernstein-style challenge from EFF or a coalition of academic plaintiffs within weeks.

GAAIA's fate. If the Great American AI Act passes with three-year state preemption intact, it wipes out CA SB 53, NY RAISE, IL SB 315, and Massachusetts's proposed ban. Whether that is good or bad depends on the federal framework that replaces them. Watch specifically for whether GAAIA's open-source security-grants provision survives to the final draft or gets stripped.

Whether the Chip Security Act clears the Senate. If chip-level location verification becomes law, every future export-control regime has an enforcement backbone the Mythos episode did not have.

Whether Massachusetts moves S.2630 to a floor vote. If Massachusetts becomes the first US jurisdiction to enact a publication ban on catastrophic-risk open-weight models, expect a legal challenge within weeks led by Bernstein.

Whether an American lab releases a Mythos-tier open model first. This is Lambert's "short-term off-ramp" and the strategic move that actually changes the political dynamic. If the Chinese-origin framing of the debate ("only DeepSeek is doing this") collapses because Meta, Microsoft, or Reflection ships something comparable, the political coalition currently forming around a ban loses the specific argument it depends on. Everything else — Bernstein, Clipper, the enforcement math — is downstream of that. And after Nadella's essay today, Microsoft is the name on that list worth watching most carefully. When the CEO of the company sitting on OpenAI's IP is publicly telling enterprises to demand rights over their own learning loop, the internal case for Microsoft to ship a self-hostable frontier open-weight model as MAI-Open just got much easier for someone inside Redmond to make.

The scenario in which the United States successfully makes releasing a Mythos-class open-weight model illegal requires all three of the following: a federal statute that survives First Amendment challenge, an international enforcement coalition that includes China, and a hardware regime tight enough to prevent training around the ban. As of July 2026, item one is unlikely on the merits, item two does not exist, and item three is at best a decade off.

The Mythos/Fable episode is going to be studied for years as the moment the US government tested this and blinked in eighteen days. The Clipper Chip is going to be studied for centuries as the last time it tried, and lost, in a comparable fight. Anyone drafting the next round of legislation should read the Ninth Circuit's opinion in Bernstein before they draft their standard, because the Ninth Circuit is going to read it either way.

Lambert closes his piece with a call to build the coalition. That is exactly right, and it is the piece a purely legal argument cannot deliver. Bernstein won because EFF filed the case, because academics signed the amicus briefs, and because publishers were willing to print PGP as a book to make the point. The AI equivalent is the coalition that has to form in the next six months to have anyone in the room when the executive order gets drafted.

This piece is my contribution to arming that coalition with the constitutional and enforcement case. Lambert's is arming it with the political one. Both are needed.

Inspired by and in dialogue with Nathan Lambert, "6 months to live for open models", Interconnects, July 12, 2026.