US Cybersecurity & AI Leaders Urge Revocation of Anthropic LLM Export Controls

Signatories argue that restrictions on Fable and Mythos models would disarm defenders while doing little to constrain adversaries

More than 200 cybersecurity and artificial intelligence executives, researchers and technical leaders from the United States and allied countries issued an open letter on June 14, 2026, urging U.S. Commerce Secretary Howard Lutnick and National Cyber Director Sean Cairncross to withdraw export-control guidance targeting Anthropic’s large language models, Fable and Mythos.

The signatories include Google engineers, faculty members from Johns Hopkins University, MIT, Harvard, Stanford and UCLA, as well as CEOs and chief information security officers from cybersecurity companies including Sophos, Zoom, Veracode and Chainguard.

Veterans of the security community also joined the letter, including Paul Vixie, often described as an internet pioneer; Philip Zimmermann, creator of PGP encryption; and Bruce Schneier, a Harvard University lecturer and prominent cybersecurity expert.

The Dispute: What Is the Problem?

The letter acknowledges that Anthropic’s Mythos family of models has shown strong performance in detecting software vulnerabilities and generating exploit code.

Its central argument, however, is that these capabilities are not unique to Mythos.

The signatories said they routinely use a range of models—including GPT-5.5, Opus, Sonnet and even China’s Kimi 2.7—for security auditing and red-team work. They argue that AI systems have already reached, and in some areas exceeded, human-level capability in identifying bugs and producing functional exploits.

On that basis, the letter challenges the premise behind the export controls: that Mythos offers a uniquely decisive advantage in offensive cyber capability.

The signatories also criticized the research that helped trigger the restrictions. According to the letter, the study focused on whether models could identify security vulnerabilities in code sections written by humans. That, they argue, is a basic capability that any model designed to produce secure software should possess—not an inherently offensive capability.

The letter further said Anthropic had embedded strong safeguards in Fable to prevent misuse for cyberattacks, describing the restrictions as so strict that they became a point of humor within the security community on the day of release.

The Central Argument: The Paradox of Disarming Defenders

The strongest claim in the letter is that the restrictions would weaken defenders rather than attackers.

Speed is central to cyber defense. Defenders must identify and patch vulnerabilities before attackers can discover and exploit them. AI is increasingly becoming a critical tool for finding flaws rapidly across vast codebases, including decades of legacy software.

Removing access to such tools from defenders, the signatories argue, would be equivalent to taking weapons from only one side in a battlefield where both sides already have access to similar capabilities.

The geopolitical imbalance is an even greater concern.

The letter argues that publicly available Chinese open-weight models are already only months behind leading U.S. systems. It also warns that the Chinese government may possess additional non-public capabilities.

The result, the signatories say, could be a situation in which U.S. defenders are denied access to frontier models while facing attackers who continue to benefit from comparable or undisclosed systems.

“If You Regulate, Regulate This Way”

The signatories are not uniformly opposed to AI regulation itself. Instead, the letter outlines four conditions that any legitimate regulatory framework should meet.

First, regulation should be based on scientific assessments informed by industry and academic expertise.

Second, it should be developed through democratic rulemaking procedures.

Third, enforcement should be transparent and fair, with sufficient time for affected parties to correct or adapt to new requirements.

Fourth, restrictions should apply only to the minimum scope necessary to protect public safety in the United States.

The letter argues that the current export-control approach meets none of these criteria.

Business and Policy Implications: Five Messages From the Letter

The open letter is more than a protest from the technology community. It highlights a set of structural questions surrounding AI governance, cybersecurity and industrial policy.

First, it raises a fundamental question about the effectiveness of AI export controls.

If multiple alternatives with similar capabilities already exist, restricting one particular model may do little to improve national security while limiting the competitiveness of the U.S. company that develops it. The letter brings this core policy dilemma into public view.

Second, it illustrates the paradox in which controls introduced in the name of security may weaken security itself.

Export controls on semiconductors and manufacturing equipment can create meaningful delays because they target physical supply chains. Software models, however, can be copied and distributed rapidly and at scale. The letter argues that the tool of regulation may not match the underlying nature of the technology being regulated.

Third, the issue creates market and trust risks for Anthropic.

Export restrictions can directly discourage enterprise adoption of Anthropic’s models. If regulatory uncertainty persists, companies may shift toward alternative models that appear more stable and easier to deploy. The participation of more than 200 industry leaders suggests that the uncertainty is already affecting real business decisions.

Fourth, the letter raises a question of procedural legitimacy in AI governance.

Its criticism is directed not only at the substance of the restrictions, but also at the method by which they were created and implemented. The principles it identifies—scientific evidence, public consultation, transparent enforcement and opportunities for correction—could apply to technology regulation more broadly.

In that sense, the letter can be read as an attempt to establish baseline procedural standards for AI governance beyond this particular dispute.

Fifth, the campaign signals the growing policy influence of the private cybersecurity community.

The fact that more than 200 operational security experts collectively issued a policy letter and created a dedicated channel, freefable.org, to gather additional signatures shows that cybersecurity is evolving from a purely technical field into an increasingly organized policy actor.

Similar forms of collective action may become more common as governments and industry clash over future AI-security policy.

The open letter was released on June 14, 2026, and remains open for additional signatures through freefable.org.