Narrative 1 

One camp told us that AI “models” might evolve into an autonomous, omnipotent life form and destroy us. Continued progress in the development of digital information systems, they claimed, might produce a superintelligence that was outside our control. Even those who didn’t anticipate human extinction spoke darkly of AI’s potential to create “catastrophic risks.” This threat became the groundwork for global society’s overwhelming focus on ”safety,” “guardrails,” and controls over the release of new AI models. 

Narrative 2 

The other camp told us that we were in a race to develop AI. AI will drive both economic growth and national power; thus, we should encourage and accelerate its development. The government must ensure US leadership in AI with subsidies here, protections and tariffs there, and a systematic attempt to block or handicap China’s digital capabilities. The contestants in the race, in other words, are not private firms competing for markets and profits, but nation-state-led systems of political economy. China is our opponent – our “adversary” — and must therefore be “beaten” in this “race.” 

It should be apparent that the policy implications of Narrative 1 and Narrative 2 are in direct conflict. Narrative 1 wants us to slow down development, if not abandon it altogether, and engage in global collective action to maintain control. Narrative 2 tells us to accelerate development unilaterally as a nation and dismisses ex-ante safety regulations as roadblocks. If AI really generates a race with a military and political adversary, our national security depends on running as fast and hard as possible.  

The weird thing about these two incompatible narratives is that many of the big players in the AI governance drama want to believe both at the same time.  

Converging Narratives 

What happened in the past two months (June – July 2026) was a remarkable collision between the two narratives. The Trump administration now wobbles between the two, unpredictably and incoherently. 

It started with the June 2 Executive Order (#14409) (no doubt inspired by Mythos’s ability to find software vulnerabilities). EO 14409 is a schizophrenic document. Section 1 speaks of the “enormous talent and innovation of our AI industry” and attributes that innovation to our refusal “to stifle this innovation with overly burdensome regulation.” Section 3, on the other hand, gives the Director of NSA and other representatives of the Department of War, the National Cyber Director, and the Director of the Cybersecurity and Infrastructure Security Agency the authority to review AI models before they are released. It asks the companies to “provide the Federal Government with access to covered frontier models … for a period of up to 30 days before they plan to release such models to other trusted partners.” The EO claimed that “Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.” 

A few days later, on June 12, the U.S. Commerce Department did exactly what the EO promised not to do. It applied mandatory export controls to Anthropic’s Claude Fable 5 and Claude Mythos 5 models to restrict access to foreign nationals, whether inside or outside the United States. Anthropic responded by suspending access to everyone. “Because the order took effect immediately and we had no reliable way to verify nationality in real-time,” the company explained, “we suspended access to both models for all users.”  

Although the ban was lifted June 30, the incident triggered a furious debate over review and licensing of AI models, and AI governance more broadly.  

• “Voluntary” an Unstable Compromise:  Critics argued that the program was voluntary in name only. As Anthropic’s experience with the Department of War showed, the government could retaliate against firms that did not cooperate. None of the big 3 AI firms could afford to ignore it, and enterprise clients might refuse to procure any model that had not cleared federal review. 

• Lack of Transparency and Due Process: Critics pointed out that the review mechanisms were not based on any written standards or well-defined criteria. The benchmarking process called for by the Executive Order was to be “classified,” opaque, and lacking any appeal process. 

• The China Competition. While this policy turmoil was going on, China’s method of competing by promulgating open source models began to bear fruit. Zhipu AI launched GLM 5.2, a 744-billion-parameter model briefly named the top-performing open-weight model on the independent Artificial Analysis Intelligence Index. Its inexpensive pricing led to enterprise adoption. On July 16, China’s Moonshot AI released Kimi K3, the world’s largest open-weight model.  And on July 26, DeepSeek V4 replaced older APIs, offering a massive 1-million-token context window. 

Anthropic and OpenAI executives raised alarms in Washington – privately. They warned that Chinese firms were closing the gap by illicitly “distilling” advanced U.S. models to train their own systems. Amidst talk of banning open source AI models, on July 24, 2026, Nvidia CEO Jensen Huang published an industry open letter titled “Open Weights and American AI Leadership”. The letter urged Washington not to restrict or ban open-weight models, arguing that an open ecosystem is vital for American tech leadership. The letter was signed by over 100 companies, including Cisco, Google, IBM, Microsoft, and Red Hat.  

Anthropic was conspicuously absent from the signatories. 

Global “Pacing”?

But Anthropic did sign another letter that came out two days later. Pacing the Frontier a letter signed by 1,324 employees of AI companies, revived 2023-vintage fears of an out-of-control AGI. It claimed that “there is a real risk that [AI] capability development rapidly accelerates beyond our ability to understand or control the resulting systems.” The letter asked policy makers worldwide to “build on work already underway to monitor frontier model releases” (i.e., Executive Order 14409), by requesting: 

“that the U.S. government support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.” 

Note that the letter realistically recognizes that competition in the market discourages frontier firms from slowing down development, and that any attempt to control or limit model releases would require globalized collective action, not national competition. This would require cooperation with China, the same country that Anthropic believes should be denied advanced semiconductors and is stealing their “intellectual property” via distillation. An international AI governance effort that does not include China? It’s hard to imagine a more incoherent policy stance. 

So where does that lead us? The safety paradigm asks us to slow down and control development via globalized governance. The race narrative urges American companies to stay ahead but also fosters a connection between national security and digital technology development that encourages the government to exclude foreigners from the market and even to review and license American AI development. So which is it – review and license or let her rip? All these issues came to a head in June-July 2026, when the leading AI firms and the U.S. government tried to square a circle by taking both sides. 

Narrative 3 

There is  a less ideological narrative about AI going on. Narrative 3 might be characterized as letting global digitization proceed under market constraints. This third narrative sees AI not as a special, isolated capability but as one of many expressions of a global digital ecosystem. It pays attention to news reports about the real-world digitization of the economy, finding some of them successful and others not. It consists of spotty and unsystematic reports about the actual application of AI to specific parts of the economy, as well as reports about how unrealistic predictions (such as massive job losses) are being debunked. It chronicles the capital expenditures and revenue generation of American and Chinese AI firms and the growing presence of Chinese firms as a competitive factor in the development of the industry, noting how AI capabilities are subject to market constraints just like any other industry.  

Narrative 3 is neither polarized nor polarizing. It focuses on real-world developments, real costs and benefits, not hopes and fears. One of its most interesting features is its recognition that, despite all the decoupling pressures, China and the US are, economically and technologically, interconnected parts of the digital economy. People who pay close attention to how AI is actually being used realize that both Chinese and American technologists and markets are driving progress in digital information systems and that users are picking and choosing from both ecosystems. 

Semiconductors are the third most traded item in the global economy, behind oil and autos. The supply chain is regionally centered in East Asia, and includes South Korea, Japan, Taiwan and China. Data and cloud services, too, are largely borderless. There is not really a national competition, in which the benefits and costs follow national borders, but a globalized digital information infrastructure, and a globalized market for the production and use of digital information systems. Competition, specialization and globalized market access, on net, show signs of benefiting all world societies. AI governance is, after all, just like Internet governance. And that’s because the Internet and AI are both part of the same interconnected, transborder digital information system. 

The post Colliding AI governance Narratives appeared first on Internet Governance Project.

Apple announced major price increases for its consumer products last week, but the same story affects Android phones, gaming devices, laptops, and a host of other consumer digital products. A story by Alina Maria Stan in The Next Web shows how the rising price of memory is stifling the global growth of the digital economy; it is “killing the cheap smartphone,” forcing budget smartphone makers like Transsion, Oppo, Vivo, and Lava to reduce their profits by 50% and reduce their shipments by 15% – 40%.

According to Stan,

In India, the sub-$100 smartphone market collapsed 59% year on year in Q1 2026. In Africa, where 81% of smartphone shipments were in the sub-$200 category in 2025, many consumers will simply be priced out of phone ownership entirely. The technology that connected hundreds of millions of the world’s poorest people to the internet is becoming unaffordable.

The standard story is that AI is responsible for this change. That’s partly true, but it is only half of the story. The real culprit is the United States’ attempt to securitize and de-globalize chip production by imposing export controls and import controls on China. This has eliminated a key source of additional capacity that could have ameliorated the sudden shortage of DRAM.

The Big Shift

Training and running AI models requires high-bandwidth memory (HBM). HBM profit margins are 70% or higher, whereas commodity DRAM margins are around 20% – 30%. In 2023, HBM accounted for 2% of memory makers’ wafers. By the end of 2026, it is expected to reach 20%. Instead of expanding their production capacity to meet the AI-driven demand for HBM, chip producers reallocated existing capacity. Every wafer pushed into HBM production removes capacity from the memory that goes into phones and laptops.

The DRAM market is highly concentrated. The “Big Three” suppliers, Samsung Electronics, SK Hynix, and Micron Technology, control roughly 90% of global DRAM revenue.

In this massive reallocation of DRAM production away from consumer electronics and toward AI data centres, Micron went the furthest. Late last year (December 2025), it completely discontinued its consumer-oriented Crucial brand, redirecting all its capacity to HBM and enterprise. One of three global DRAM producers simply left the consumer market.

The Antitrust Lawsuit

An oligopolistic market structure makes collusion easier. This helps to explain why a group of seventeen small electronics repair shops and consumer plaintiffs have filed a class action antitrust lawsuit against the big three. The plaintiffs allege that the defendants conspired to artificially restrict the global supply of conventional DRAM memory.

In a frictionless, globalized economy, however, a supply shortage in one region is naturally corrected by excess capacity in another. Right now, ChangXin Memory Technologies (CXMT) is aggressively churning out commodity DDR4 and DDR5 memory. In fact, reports from the broader market show CXMT components entering certain channels at prices drastically lower than the $300 to $400 global average in the Western market.

The point about CXMT is that the Big Three didn’t need cartel collusion to bring about this situation. The reason cheaper supply isn’t driving down costs for companies like Apple or Microsoft isn’t a lack of chips—it is because U.S. policy effectively bans the supply adjustment. By preventing Western buyers from accessing the world’s fastest-growing commodity memory producer, U.S. national security policies are directly protecting the pricing power of the established oligopoly, leaving Western consumers to foot the bill.

How US Policy Reinforces Supply Shortages

In January 2025, the U.S. Department of Defense designated CXMT as a “Chinese Military Company” under Section 1260H of the National Defense Authorization Act. This designation legally bars the U.S. military and federal agencies from purchasing any systems or hardware containing CXMT chips. While it does not criminalize private U.S. companies from buying them, it carries immense reputational risk. Major U.S. computer and device manufacturers (OEMs) generally avoid sourcing 1260H-listed components to protect their eligibility for federal contracts.

Even though buying CXMT chips is not illegal, major U.S. corporations are effectively blocked from this supplier by the threat of retroactive blacklisting through the more restrictive Entity List. If U.S. firms like Apple design their products around CXMT memory, a sudden shift in U.S. policy could move CXMT to the Entity List overnight. This would instantly freeze the supply chain and leave the U.S. buyer without components. There is also reputational and political risk of being publicly linked to a supplier labeled a “Chinese military company” by the Pentagon.

By keeping CXMT on the 1260H military blacklist and keeping the threat of the Commerce Department’s restrictive Entity List hanging over them, Washington has turned Western hardware manufacturers into a captive audience for Samsung, SK Hynix, and Micron. If Apple were free to sign a massive, multi-billion-dollar supply agreement with CXMT without facing catastrophic regulatory or reputational risk, the Western commodity DRAM shortage would collapse almost overnight.

The Price of Securitization

To see only collusion among the Big Three suppliers is to miss the real story. The operation of Moore’s law always relied on market competition. Moore’s law is being repealed by the China hawks. The underlying problem here is the attempt by the U.S. government to de-globalize the semiconductor supply chain, as part of its deeply confused mix of national security policy, trade policy and industrial policy. Add to this the exploitation of national security fears by domestic firms seeking protection from competition, and you are bound to get higher prices and shortages. Micron spent years lobbying Washington to blacklist earlier Chinese memory startups, such as Fujian Jinhua and YMTC. Now it is actively and aggressively lobbying the U.S. government to maintain and tighten barriers against CXMT and other emerging Chinese memory competitors, even as it shuts down its own DRAM capacity. Micron has also been identified as a key proponent and driving force behind the MATCH Act, legislation that significantly tightens U.S. export controls on the manufacturing tools made by American firms that will be purchased by Chinese memory manufacturers like CXMT and YMTC. By lobbying for this bill, Micron seeks to legally restrict CXMT’s ability to acquire the equipment necessary to scale up its capacity or advance to more sophisticated manufacturing nodes.

Semiconductors are indeed the key to the digital economy, but subordinating complex, globalized supply chain markets to geopolitical power games is a major disruption. The unintended consequences are just starting to play out.

The post Thank the China Hawks for Higher Prices of Digital Devices appeared first on Internet Governance Project.

To manage the volume of AI-generated threats, panelists focused heavily on the new executive order’s proposal to establish a centralized federal AI cybersecurity clearinghouse. This body is intended to deconflict and coordinate software vulnerability scanning, validation, and patch distribution across government and critical infrastructure sectors. Panelists widely agreed that some form of institutional mechanism is necessary to assist organizations currently overwhelmed by processing dozens of daily vulnerabilities across their software dependencies.

In what was an otherwise productive discussion, Ari Schwartz of Venable LLP urged Congress to reauthorize the sunsetting Cybersecurity Information Sharing Act of 2015 (CISA 2015), framing it as an essential legislative baseline for effective public-private response to the AI-cybersecurity nexus. 

A closer look at the empirical record, however, reveals a stark mismatch between Washington’s enthusiasm for CISA and the operational reality of these frameworks.

The Failed Promises of Centralized Information Sharing

CISA was passed in 2015 and expired in 2025. For over a decade, federal agencies and legacy legislation have operated under the assumption that CISA’s liability protections and flagship implementation of an “Automated Indicator Sharing (AIS)” capability was an essential element in national cyber defense. Since 2022, however, the failure of the program has been evident. It did not catalyze higher levels of threat information sharing. It was evaluated in recent Department of Homeland Security Office of Inspector General (OIG) and Interagency joint compliance reports. [1, 2, 3] As we wrote in January, the automated sharing ecosystem is plagued by severe decay and structural failure:

• Collapsing Participation: The overall number of federal and non-federal participants actively utilizing AIS has plummeted by a staggering 65 percent since its peak in 2020. By 2024, AIS was left with a mere 18 federal participants and 87 non-federal participants.
• Systemic Overreliance: While the total volume of shared cyber threat indicators (CTIs) superficially increased in 2024, a single private-sector platform’s contributions accounted for 89 percent of the public collection and 83 percent of the entire federal collection. This shows that the laws intent – to encourage and expand threat sharing – isn’t working.
• Technical and Structural Inertia: Federal entities remain notoriously reluctant to share operational incident data via machine-to-machine connections due to institutional bottlenecks, a lack of organizational resources, and policy constraints. Furthermore, downstream operators frequently choose to ignore or avoid uncategorized federal threat feeds because the shared indicators lack the specific operational context required to deploy fixes safely.

Furthermore, arguments that private firms need state-sanctioned safe harbors to circumvent antitrust liabilities when sharing technical data are largely hollow. As detailed by the Department of Justice (DOJ) and the Federal Trade Commission (FTC) in their joint antitrust policy statement, properly designed cyber threat exchanges are highly technical and distinct from competitively sensitive business data like pricing or output. The agencies have explicitly maintained for over two decades that legitimate cybersecurity information sharing does not violate antitrust laws. The legal roadblocks are a myth; the actual barrier is that government-managed clearinghouses simply fail to deliver timely, actionable value.

The Clearinghouse Trap: Centralizing Power, Stifling Innovation

In light of the chronic underperformance of existing automated frameworks like AIS, the 2026 Executive Order’s proposed AI cybersecurity clearinghouse is distinctly misplaced. Rather than modernizing defense, the mandate serves as a vehicle to expand state control over cutting-edge artificial intelligence.

The Executive Order additionally outlines a “Secure Frontier Model Deployment” framework that establishes a classified benchmarking process to designate advanced models as “covered frontier models”. Under the guise of being voluntary, firms are strongly incentivized to turn over their models to the federal government for up to 30 days before public release. The government then assumes the role of an arbiter, collaborating with firms to selectively hand-pick which “trusted partners” are granted early access to promote critical infrastructure security.

Taken together, this represents an unnecessary, centralized gatekeeping regime. Inserting a federal clearance step into the software pipeline slows down the deployment of capability equally valuable to defenders, introduces immense political and national security groupthink and opportunity for regulatory capture, and expands state visibility into proprietary algorithms and weights under the banner of deconflicting code scanning.

A Better Path: Decentralized Disclosure, Market Incentives, Transparent Process

The policy fixation on state-managed clearinghouses and review overlooks a far more robust, agile, and proven alternative to producing cybersecurity: the decentralized model of responsible disclosure governed by widely accepted norms, recommendations, standards, and guidance, which lowers coordination costs and is led by the AI ecosystem itself. 

The success of Anthropic’s “Project Glasswing” initiative offers an illustrative roadmap. Under Project Glasswing, advanced frontier models like Mythos were provided directly to diverse, private-sector security partners and system defenders. Rather than routing vulnerability details through a slow-moving government clearinghouse, this advanced access allowed operators to rapidly stress-test their own code, identify thousands of live flaws across complex dependencies, and patch systems in real-time before adversaries could weaponize them. While the Glasswing initiative shows it can be done, we’ve noted its club governance structure needs to evolve. Comcast’s Elizabeth Chernow similarly pointed this out in the panel, noting a recent paper promoting criteria for Responsible Advanced Access.

Decentralized, voluntary defense continues to succeed because it leverages the natural economic incentives of network operators. Critical infrastructure operators, enterprise businesses, and software maintainers possess an existential, bottom-line interest in protecting their own networks and customer data. When AI providers distribute advanced testing models that fundamentally reduce vulnerability identification costs directly to these stakeholders, they help unlock a massive, parallelized army of defenders using multiple models who are contextually aware and uniquely equipped to find flaws and develop and validate patches without breaking downstream dependencies.

As Google’s Kate Charlet observed during the panel, true long-term security will be achieved by embedding AI capabilities directly into standard software development workflows and cloud architectures, ensuring that insecure code is caught before it is ever compiled. This structural shift requires broad, open access to advanced tooling—not a restricted government gatekeeping system that funnels code to a federal clearinghouse and approval. 

Unfortunately, the administration doubled down last week, leveling export controls on Anthropic’s Mythos and Fable (Mythos with guard rails) large language models. Anthropic complied and stated they “believe the government should have the ability to block unsafe deployments, as part of a statutory process that is transparent, fair, clear, and grounded in technical facts.” Multiple cybersecurity experts questioned the rationale for the ban, argued “pulling the best capabilities away from defenders without a good reason when our adversaries are rapidly advancing is dangerous”, and called for an “open, scientific and transparent process of handling AI risk assessments in the future.” 

We agree. Rather than reviving failed information-sharing approaches via CISA reauthorization, bottlenecking frontier model access through federal directives, and hobbling the fast evolving production of cybersecurity, Washington should support defenders and innovation.

The post Defending Cyberspace: Cybersecurity and Frontier AI appeared first on Internet Governance Project.

A new report from IGP, sponsored by the Tech and Media Convergency (TMC), investigates an unfortunate divergence in Tanzania’s development. While internet adoption has climbed to roughly one-third of the population, the expected digital economic growth has failed to materialize. The research argues that the bottleneck is not a lack of infrastructure, but a self-reinforcing system of restrictive governance.

The Tanzanian Anomaly

As internet use rose from negligible levels in the early 2000s to approximately 31% today, Tanzania’s services sector contribution to GDP has actually contracted, falling from a 2001 peak of 49% to 29% in 2024 (black-dotted and red lines below).

The ICT sector itself has stagnated at 1.5% to 1.6% of GDP. Comparing Tanzania to Kenya, a neighbor with similar demographics and nearly identical internet penetration (~35%), reveals the scale of the under performance. Kenya’s services sector accounts for roughly 55% of its economy, nearly double Tanzania’s. In the broader digital economy, including fintech and platform commerce, Tanzania’s contribution is less than one-fifth that of Kenya’s.

In fact, the pattern runs similar for every one of Tanzania’s neighbors (figure below) where rising connectivity tracks with a growing or stable services sector. A positive relationship between internet adoption and services value-added appears everywhere except Tanzania, which moves in the opposite direction.

Wrong turns in digital governance

The study identifies three interlocking policy failures that, together, suppress the productive use of Tanzania’s growing connectivity.

Digital sovereignty: Mandates for data localization and local ownership force costly, redundant infrastructure and deter foreign investment without delivering any of the privacy or security benefits used to justify them.

Censorship, Surveillance, and Restrictions: A restrictive framework of content licensing, VPN registration, and internet shutdowns creates direct economic damage, including an estimated US$250 million in losses during the 2025 election period alone.

Cronyism: the most insidious factor aligning regulatory authority with private commercial interest. Here we find that sovereignty and censorship mandates are not independent policy choices but downstream instruments of a patronage system in which the ruling party, telecom operators, and regulators are bound together by shared interest using regulatory power to protect insiders from competition.

A maladaptive system

What makes the report distinctive is its insistence that these are not errors to be corrected with better technical advice. They form a self-reinforcing equilibrium that restricts growth. Restrictive policies create discretionary regulatory power; that power creates opportunities for extraction; and extraction creates vested interests in keeping the restrictions in place. Drawing on the political-economy framework of North, Wallis, and Weingast, we describe a “limited access order” a system in which a ruling coalition distributes economic privileges to insiders precisely to prevent outsiders from competing while using ICTs to stifle elections and free expression.

This is why we argue that incremental reforms under President Samia Suluhu Hassan have not changed the sector’s trajectory. The underlying incentive structure between regulator and regulated remains intact. The report also explains the widening gap between Tanzania’s ambitious strategic documents like its Vision 2050, the Digital Economy Strategic Framework 2024–2034, and the regulatory machinery that quietly continues to operate against them. The aspirational language of digital transformation has not replaced the architecture that suppresses it. The two simply coexist in a performative theater of legitimacy.

A way out that the state can live with

The report closes with ten concrete policy recommendations, but its framing is unusual for work in this space. Rather than calling for the ruling party to abandon the governance logic that sustains its dominance, (a clear political non-starter) we propose reforms calibrated to be politically survivable: revoking data localization mandates, introducing risk-based cross-border data rules, establishing judicial oversight for data access, liberalizing content licensing, opening up wholesale infrastructure, and replacing ownership caps with competition-based assessments.

Each recommendation can be justified on fiscal grounds alone. A larger, more dynamic ICT sector would broaden the tax base, attract foreign investment, and create jobs thereby offsetting the perceived loss of control with gains that accrue to all stakeholders, including the state. A more abundant and independent digital economy would even lower the stakes of political competition, making any future transfer of power less destabilizing.

Whether any of it happens depends on a race we can identify but not resolve, that is, whether the mounting economic costs of the current system will force change before an expanding surveillance apparatus from mandatory SIM registration and the forthcoming Jamii Namba digital ID, locks in a more durable architecture of control. For now, Tanzanians keep coming online. The question is whether being online will ever be allowed to pay off.

“The Political Economy of Digital Governance in Tanzania: Pathways to ICT Sector Growth” is an Internet Governance Project report sponsored by the Tech & Media Convergency. Read the full report here.

The post Tanzania Is Getting Online. Its Digital Economy Isn’t Following. appeared first on Internet Governance Project.

Three years later, machine learning applications have expanded in use and capability, yet humans are still around. Most AI doomers have retreated from saying that AI will wipe us out, reverting to the less apocalyptic but equally extreme claim that it will eliminate all human jobs, and yet unemployment remains low at 4.3% and the last three job reports showed significant growth. 

Nevertheless, Anthropic on June 4 resurfaced the call for a pause, this time with an apparently more rational set of arguments. The underlying concern is the same, however: “recursive self-improvement” in frontier models might increase the “risks of humans losing control over AI systems.” So: 

“If it were possible to effectively slow the development of this technology to give ourselves more time to deal with its immense implications, we think that would likely be a good thing. … Without a global coordination mechanism, companies and governments will have to make difficult decisions about safety while under competitive and geopolitical pressures. We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology.” 

IGP has published research challenging the claim that recursive self-improvement in AI software will lead to an autonomous, all-powerful AI system. Anthropic CEO Dario Amodei explicitly rejects doomerism, and the blog post admits that “recursive self-improvement is not inevitable,” but they still believe “it could come sooner than most institutions are prepared for.”  

We have also published research explaining why a global “pause” in AI development is not a viable governance solution. This passage was published in Telecommunications Policy nearly a year and a half ago: 

“…an effective moratorium would require every government and every firm in the computer industry to abide by it. And not all businesses or governments really want to pause. It is unlikely that the U.S., Israel, China, the European Union, Russia and India would trust each other enough to stop unilaterally. Nor would they be eager to expose their advanced software and hardware capabilities to inspection by other states or foreign businesses. Given the (alleged) military and business advantages of being the leader in AI technology, each state and business would have a strong incentive to defect from a moratorium. Even if noncompliance could be detected reliably, there would be no way for complying governments to enforce the pause agreement upon recalcitrant governments of sufficient size and power. “Pause AI” just does not work. But if it did, it would involve systematic surveillance and control of ICT capabilities worldwide. 

While Anthropic’s pause revival recognizes these collective action problems. their only response is that:  

“The Anthropic Institute will conduct research—in collaboration with many others—and take actions to help build the systems that a credible slowdown or pause would require.” 

Exploring verification methods might be helpful, but as we learned from our efforts to promote the creation of a neutral international cyber attribution organization, knowing what needs to be done is not the obstacle; it’s getting the actors, especially rivalrous nation-states, to commit to such an institution that is the hard part. If the new institution requires sharing data and possibly losing competitive advantages, it is unlikely to happen.  

The National Security Nexus 

What makes this quasi-doomer revival more interesting and potentially troublesome, however, is the growing nexus between geopolitical competition, the frontier AI model developers, and U.S. national security agencies.  

A Trump administration Executive Order that was issued only two days before the Anthropic blog post required relevant federal agencies to develop “a classified benchmarking process” to “determine the threshold at which an AI model should be designated a ‘covered frontier model.’” If a model meets or exceeds this threshold, then the AI developers would be able to provide the Federal Government with confidential access to the frontier models, to allow the Feds to review it “for a period of up to 30 days before they plan to release such models to other trusted partners.” 

Advocates of market-led AI development were happy with the voluntary nature of the program, and the reduction of the review period from 90 days to 30 days. An earlier proposal was considering potential AI rules comparable to the system used by the Food and Drug Administration to approve medicines. Still, the idea of prior review of communication and information technologies by a national government’s national security apparatus is not something to be taken lightly. Claude’s ability to find vulnerabilities in software does pose real cybersecurity risks – but those risks occur to any software user, not just the government.  

The real risk here is the militarization of AI. Anthropic’s own assessment of AI risks actually reinforces US tendencies to see AI as a weapon in its competition with China. We have seen time and again how national security claims privilege the power of the state over the rights and freedoms of the individual and the economic opportunities of innovators. A good example was the government’s decision to classify encryption technology as a weapon in the 1970s and its decades-long attempt to keep strong encryption capabilities out of the hands of civilians, to preserve its own ability to engage in surveillance.   

Is Anthropic sincere about gaining input? 

In its June 4 blog post, Anthropic’s policy staff expresses an intention to consult with a broader community to develop policy proposals:  

“In the coming months, [the Anthropic Institute] will organize conversations where policymakers, researchers, civil society, and other AI companies can help answer some of the questions this piece raises, especially around full recursive self-improvement and how to create better options for coordination and deliberation. We’ll publish what comes out of it.” 

IGP has been deeply involved in global digital governance discussions for two decades. If Anthropic is sincere about gaining all relevant perspectives, we look forward to being invited to these conversations. 

The post Anthropic Tries to Revive the “AI Pause” appeared first on Internet Governance Project.

Jensen Huang, CEO of Nvidia, debunked the argument that the US can contain Chinese AI development through export controls on computing power. He believes that chip control is futile because China can utilize its other advantages to aggregate and scale up its computing power, and the US will ultimately lose its global dominance on the global market by depriving its own leading companies of markets and profits. Huang’s rare, emotional expression struck at the core question: what is American technological leadership? Different answers to this question lead to divergence on chip export control policies.

The Biden policy of containment

In the Biden Presidency, the US government adopted a “Framework for AI Diffusion”, seeking to contain Chinese development of AI by controlling advanced computing power. This framework was based on an assumption that superintelligence is “imminent”, and computing power is the most important resource enabling it. At that time, the underlying premise of the “AI race” equated it with the race to build the atomic bomb: whoever gets it first would hold supreme power over the world. Hence, the U.S. must use its leading position in semiconductor production to carefully ration access to computing power or it will lose the race. Under this assumption, the Biden administration mandated BIS to develop targeted regulations restricting the export of chips to China, and Floating Point Operations Per Second (FLOPS), a measure of computer performance, became the critical metric for determining restrictions.

Yet Mueller (2025) and many others have debunked the whole theory of super intelligence.  There is no “race” to a defined finish line that brings ultimate power to the winner. There are only incremental, increasingly energy-intensive gains toward faster chips. And as Jeffrey Ding (2024) demonstrated convincingly in his book Technology and the Rise of Great Powers, it is a nation’s ability to put new technologies to work across its economy that matters most in competitions over wealth and power, not being the first to develop the technology.

Even if the rationale behind export controls is taken at face value, Murphy (2026) summarized its three loopholes: diplomatic cleavages created by tiered access categories, China’s own indigenisation efforts on computing, and the substitution of software and algorithmic innovations for compute requirements. These risks all indicate that computing diffusion control is not the right basket into which to put America’s eggs. Tellingly, the debate around export control has already shifted from whether chip control can contain Chinese development to “for how long” it can prolong the catching-up time.

Trump shifts gears, but Congress carries on

The Trump II administration has deviated a little from the “diffusion control” model. The July 2025 executive order on Promoting the Export of the American AI Technology Stack shifted focus from export restrictions to global market dominance. Under this approach, the costs and competitiveness of American companies became more of a priority. As a result, the BIS revised its license review rules in January 2026, shifting from a presumption of denial to case-by-case review. This does not mean that the Trump admin is returning to free trade; the MAGA trade doctrine still applies to chips, but chip exports are still allowed with certain caveats.

Not everyone in Washington agrees with this trend, however. The biggest opposition comes from Capitol Hill. From RASA to MATCH Act, the U.S. Congress has put forward bills to continue clamping down on the ability of American digital companies, which lead the world in size and scope, to do business globally. Five such bills are outlined below.

Why is Congress more aggressively restrictionist than the Trump administration? Three words: special interest lobbying. According to a Reuters article, Micron Technology (MU.O), the largest U.S. memory chipmaker, is a driving force pushing the U.S. Congress to pass the MATCH Act legislation, for example.

Leadership through market domination, or political control?

There are two approaches to sustaining a country’s technology leadership. One argues to keep strengthening America’s domination across world markets selling its advanced chips; the other side wants to build a wall around advanced chip design and manufacturing to restrict Chinese access to new chips.

If one were to steelman Dwarkesh’s argument, export controls are needed for the following reasons: 1) in a direct conflict with China, Chinese AI will provide a decisive advantage in a military conflict, and chip controls can prevent it; 2) The US has substantial leverage in terms of computing power and other layers of the computing stack, so why not use it to gain advantage?

On the other side, Jensen Huang seeks to sustain the American tech leadership by maintaining its central role in the semiconductor supply chain. This approach drives revenue to American companies and fuels the R&D and talent acquisition that drives innovation and better applications. Huang dismissed diffusion control as a “loser” mentality. Comparing chips to nuclear bombs is a “lousy” comparison, a product of fear-mongering. Naturally, Jensen’s judgment aligns with Nvidia’s interest as a private company. Nevertheless, there are real reasons to believe that it is more detrimental for the US to lose its dominance in global markets than to cave in to hyperbolic security risks about China’s AI capabilities.

From a theoretical perspective, this dilemma can be traced back to the popular theory of “weaponized interdependence,” a term political scientists Farrell and Newman popularized and a policy that many countries began to pursue years ago. Interdependence is said to be a source of asymmetric power, and states can weaponize such power to pursue their strategic goals. However, weaponization inevitably diminishes market domination, as the excluded party seeks to reduce their reliance on the original technology diffusion network.

What’s worse, it is evident now that export controls cost American companies more than Chinese firms. Economists from the Federal Reserve estimated that the export control since 2010 creates a total capitalization loss of $18 billion for Chinese targets, but for each affected American company, the average market capitalization loss reaches $1 billion, meaning a total decrease of $158 billion for American companies, along with an average revenue decline of 8.9%, and 7.3% decline in the total number of employees.

The war in Iran is making it clear that a simple technology and power advantage is not always sufficient for a strategic victory in a conflict. The US had faster chips, faster planes, better intelligence, more precision bombs, better missile defenses, but it was not enough to dislodge the Iranian regime or make it surrender, nor was it able to prevent the Strait of Hormuz from being blocked. Likewise, in a real-world US-China conflict, it’s hard to imagine how a 9 or 6 month lead in semiconductor power is going to make a decisive difference – for either side.

How China offsets the chip export controls

Predictably, chip export controls have pushed the Chinese companies away from any dependency on the American computing supply chain. They have undertaken the following efforts to achieve the goal.

• Fostering the domestic chips ecosystem: at many semiconductor production stages, domestic equipment shares have risen in the Chinese market. Per CSIS, overall domestic equipment share surged from 25% to 35% between 2024 and 2025, while domestic producers accounted for less than 15% of the domestic market before the US imposed export control. Noticeable progress came from the etching and thin-film deposition procedures, where local firms now supply about 40% of the domestic market. A recent harder push came from a new procurement policy in December 2025, requiring that Chinese fabs seeking approval for new capacity need to buy at least 50% of their equipment from domestic suppliers.

• Importing from non-US suppliers. Along with these self-sufficiency efforts, China’s semiconductor-manufacturing equipment imports reached a record high of $51.1 billion, almost five times the level of a decade earlier. But this new increase mainly came from increased imports from Japan, Netherland, and Singapore, while the import share from the US has decreased from 23% to 9% in the past 10 years.

• Using cloud and data center capacity in Southeast Asia: the tiered-category of America’s chip export control regime also compels Chinese companies to look for computing capacity outside mainland China, especially in Southeast Asian countries. For example, according to Reuters, by March 2026, ByteDance was working with Aolani Cloud in Malaysia on about 500 Nvidia Blackwell systems, totaling roughly 36,000 B200 chips, in a project costing more than US$2.5 billion. At the national policy level, China-ASEAN FTA 3.0 has positioned digital cooperation as a core pillar, specifically on digital trade, cross-border fiber optics, and data centers.

• Maximizing its advantages in energy efficiency: improvements in model efficiency and energy network can also offset the impact of computing power control. DeepSeek, along with other Chinese open-source models, are the most prominent case following this strategy; their innovations on model design reduces demands for computing power compared to American ones.

However, little attention has been given to a more fundamental advantage that China has been accumulating: the colossal national computing-energy network that reduces the energy price for computation. Since 2022, China has been constructing its “East-Data-West-Computing” (东数西算) project, linking data-abundant Eastern provinces with energy-affluent Western provinces. By the end of 2025, national hub nodes and data-center clusters under this national project took up 80% of China’s total 1.59 million PetaFLOPS computing capacity. All these improvements at the model and energy-computing layers result in comparatively lower token prices and dependencies on American computing devices.

All these efforts demonstrate China’s efforts to reduce reliance on the American computing network, but this does not mean that China has circumvented all the computing bottlenecks. But it is certain that China will continue to reduce its reliance on the US computing devices, undermining the very material foundation of imposing export control.

AI is not just about chips and models, it is a whole digital ecosystem that contains multiple parts. For Mueller, the ecosystem contains software, data, computing devices, and the network; In Jensen’s opinion, the AI ecosystem is a five-layer AI stack that also includes energy. Either way, competition in AI is a multi-layered game driven mostly by the market. Different states possess different advantages and leverage across the layers of the digital ecosystem. What’s clear is that the U.S. will not maintain its advantages by exclusions and restrictions on its own industry. That is a form of unilateral disarmament.

The post Running a Race Looking Backwards: US Digital Export Controls appeared first on Internet Governance Project.

Depending on who you read or talk to, the reaction has been split between measured optimism and alarm about the model’s capabilities. The UK’s AI Security Institute, for instance, found that while Mythos Preview can execute multi-stage attacks on vulnerable networks and discover and exploit vulnerabilities autonomously, its demonstrated capability is currently limited to small, weakly defended, and vulnerable enterprise systems, leaving open whether the model could successfully attack hardened environments with active defenders and detection tooling. On the other hand, Check Point warned that “the time-to-exploit window will collapse to near zero.” CrowdStrike’s CTO stated that “the window between a vulnerability being discovered and being exploited by an adversary has collapsed.” Thomas Ptacek, in an essay titled “Vulnerability Research Is Cooked,” argued that the economics of exploit development have been fundamentally altered. Anthropic itself frames the situation as a race: give defenders a head start before equivalent capabilities proliferate within six to eighteen months. But eventually, they “expect that defense capabilities will dominate: that the world will emerge more secure, with software better hardened.”

This last quote gets at the more interesting governance question beneath the headlines. Project Glasswing is an institutional response to a technological shift that could reshape the vulnerability management ecosystem. Understanding this requires tracing how the bottleneck in cybersecurity’s value chain is migrating from discovery to remediation.

The Discovery Premium Is Gone

Prompt: A recent article on Anthropic’s Mythos model touts its vulnerability discovery capabilities, with a red-team researcher ominously saying, “We basically need to start, right now, preparing for a world where there is zero lag between discovery and exploitation.” While increasing capabilities can certainly be used for malicious purposes, a very significant and functional bug bounty market exists today. Attached is some information about Mythos’ capabilities and costs to find vulnerabilities. Assuming an increase in the supply of vulnerabilities because of these new model(s), how would the more rapid discovery of vulnerabilities impact that market? 

The bug bounty market — valued at roughly $1.2 billion in 2024 and projected to grow to nearly $4 billion by 2032 — was built on a simple premise: vulnerability discovery was scarce. Finding a critical bug in a hardened codebase required elite human attention, deep domain expertise, and significant time investment. Organizations can pay large bounties per finding because the supply of people who can produce those findings is limited, and their opportunity costs are high.

The Mythos system card reports cost data that demolishes this premise. As noted, a full scan of the OpenBSD codebase — one thousand runs across the repository — cost under $20,000 and yielded several dozen findings, including a 27-year-old vulnerability in one of the most security-focused operating systems in existence. The specific run that discovered the critical TCP SACK bug cost under $50. A scan of FFmpeg, one of the most thoroughly fuzzed projects in the world, cost roughly $10,000 across several hundred runs and found a 16-year-old vulnerability that had been hit five million times by automated testing tools without being caught. Converting a known Linux kernel vulnerability into a working root privilege escalation exploit — a task that historically takes skilled researchers days to weeks — took the model under a day at a cost of under $2,000.

Given these economics, the per-vulnerability bounty model faces a classic supply shock. When the marginal cost of discovering a critical vulnerability drops from thousands or tens of thousands of dollars in researcher time to tens of dollars in API credits, the price structure that sustained the bounty ecosystem erodes. The low-hanging fruit that historically funded early-career security researchers will be found by AI first. The market won’t disappear, but it will bifurcate: commodity vulnerability discovery will be absorbed into automated scanning services, while the remaining human bounty work will concentrate on findings that models still struggle with — business logic flaws, social engineering vectors, and the complex interactions between systems that no single codebase can reveal.

The Bottleneck Migrates Upstream

Prompt: Let’s assume that Mythos and similar emerging models essentially are a substitute for identifying vulnerabilities. Presumably, these models can also be used for creating patches for those vulnerabilities, as explained in this work: https://team-atlanta.github.io/blog/post-patch-2026-ensemble/  The new bottleneck appears to be verification of patches.

If discovery is effectively commoditized, where does the supply bottleneck move? The obvious next candidate is patch generation — and here, recent work from Team Atlanta, a group of researchers from Georgia Tech, Samsung Research, KAIST, and POSTECH that won DARPA’s AI Cyber Challenge (AIxCC), provides important data.

Their evaluation tested ten agent configurations — combining four coding agent frameworks (Claude Code, Codex CLI, Copilot, Gemini CLI) with five frontier models — on 63 real crashes from the DARPA AIxCC competition. The results show that AI-generated patching has progressed remarkably fast. The best configurations now produce semantically correct patches for roughly 71% of real-world vulnerabilities, up from about 52% just one year earlier. Model choice matters more than framework choice, and the improvement trajectory is steep.

But patching isn’t the real bottleneck either. The actual bottleneck is *verification* — confirming that a generated patch actually fixes the root cause without breaking anything else. Even the best agent configuration in Team Atlanta’s evaluation still produces around 20% semantically incorrect patches. These are patches that pass every automated check — compilation, test suites, crash replay — but are actually wrong. The failure modes are revealing. The most common involves functionality being altered or broken: the patch fixes the bug but changes normal program behavior in unintended ways. The second most common is patching the symptom rather than the root cause — enlarging a buffer to prevent an overflow instead of fixing the underlying off-by-one miscalculation, or resetting a dangling pointer at the crash site rather than fixing initialization in the common API where the pointer should have been set. Other failures involve insufficient guard conditions, wrong API usage that violates trust boundaries, or fundamentally incorrect mitigation strategies.

Every one of these failure modes requires contextual judgment to detect: understanding the specification, the security model, the trust boundaries between components, and the upstream behavioral implications of a code change. Test suites validate behavior against existing expectations, not the correctness of the security property being preserved. This is precisely the kind of judgment that remains expensive, scarce, and stubbornly human (hey, hire a GT Cybersecurity grad!).

Team Atlanta’s “ensemble approach” — running multiple agents, collecting all patches that pass automated validation, and having a selector model choose the best one — improves semantic correctness rates. But it doesn’t eliminate the problem. And the researchers’ own methodology reveals the constraint: they manually reviewed all 630 generated patches and cross-validated 456 of them. The evaluation scope was limited by the human review bottleneck, not by computational cost. Models can find vulnerabilities and generate patches all day at a lower cost. For now, the constraint is judgment and having humans qualified to assess whether those patches are correct.

Glasswing as Transitional Institution

Prompt: In light of the anticipated impacts on the market, the announced institutional response, Project Glasswing, is interesting. It is unclear whether this approach would be a substitute for bug bounty markets or a complementary function, allowing vulnerabilities that enable zero-day exploits to be mitigated outside of the market mechanism.

This bottleneck migration reframes what Project Glasswing actually is. The conventional reading positions it as a vulnerability discovery initiative — Anthropic gives partners access to Mythos so they can find bugs in their systems before attackers do. But if discovery is cheap and getting cheaper, the scarce resource Glasswing actually organizes isn’t model access. It’s the institutional capacity to close the loop from discovery through *verified remediation*.

Consider the partner list. The twelve Glasswing organizations aren’t just large technology firms — they are the entities with the deepest institutional knowledge of their own codebases and application of AI to cybersecurity. Apple can verify whether a macOS patch preserves intended security properties in ways that no external researcher or automated system can replicate. The Linux kernel maintainers can assess whether a proposed fix to the TCP stack introduces subtle behavioral changes that would break upstream consumers. The value of the club isn’t only vulnerability identification; it’s the human and organizational expertise required for the verification step that AI can’t yet reliably perform.

This is a fundamentally different institutional form than the bug bounty market. Bug bounties are a “flow” mechanism: they provide continuous, decentralized incentives for independent researchers to find new vulnerabilities as software evolves. Glasswing appears to be addressing the “stock” problem — the accumulated backlog of undiscovered vulnerabilities in critical, long-lived codebases — through a coordination effort that integrates discovery, patching, and verification under a managed process. The system card’s showcase findings are paradigmatic stock problems: vulnerabilities that persisted for 16, 17, and 27 years despite decades of human review and automated testing.

But Glasswing’s institutional structure also reveals tensions. It concentrates several roles — discoverer, disclosure coordinator, and capability gatekeeper — in a single organization. In the bounty market, these roles are distributed across independent actors: the researcher discovers, the platform triages, the vendor patches. Glasswing bundles them. Anthropic acknowledges the resulting coordinated disclosure management challenge: fewer than 1% of discovered vulnerabilities have been patched, and they had to hire professional security contractors to manage the validation pipeline. The announcement that it “may become necessary to relax our stringent human-review requirements” is a direct acknowledgment that the verification bottleneck is binding even within Glasswing’s coordination.

What Comes Next

Prompt: Project Glasswing as an institutional response to technological change, i.e., the Mythos model, and the bottleneck migrating upstream from vulnerability discovery to patch verification.

The key analytical question is whether the verification bottleneck is permanent or transitional, and how it will be governed. Team Atlanta’s data shows semantic correctness improving from ~62% to ~80% in roughly one year. If that trajectory continues — and the general trend in frontier model improvement suggests it might — then verification too may become largely automatable within a few model generations, perhaps through adversarial model-on-model verification pipelines where one model generates patches, another red-teams them, and a third adjudicates like the Team Atlanta ensemble approach which already demonstrates that contrasting multiple candidate patches is informative for quality assessment.

If verification does become automatable, the entire discovery-patch-verify pipeline runs end-to-end with minimal human intervention. However, there remains a fundamental human role, a genuinely hard problem that none of this current work touches: deciding which vulnerabilities *matter*, how to prioritize remediation across an organization’s full attack surface, and how to manage the systemic risk of thousands of simultaneous patches hitting production systems. Those aren’t technically solvable problems.

In the near term, several market-level consequences seem likely. The bug bounty market won’t disappear but will restructure around verified remediation rather than raw discovery. Bounty programs that pay for a discovered vulnerability, plus a validated patch, plus reproduction steps, will be more valuable than those that pay only for vulnerabilities. The platforms that survive will be the ones that pivot from brokering human research to orchestrating AI-augmented scanning with human verification in the loop. The professional services market for patch verification will grow, favoring firms with deep codebase-specific expertise.

As Anthropic notes, Glasswing itself is best understood now as a transitional institution — an attempt to manage a capability discontinuity during the period when existing market institutions haven’t yet adapted. Its familiar club structure makes sense for the current moment: the capability is restricted, the verification bottleneck demands insider knowledge, and the urgency of burning down the stock of latent vulnerabilities in critical software infrastructure justifies coordinated action outside normal market mechanisms. But if Mythos-class capabilities proliferate as expected, the club model becomes untenable because the underlying capability is no longer scarce enough to restrict.

What persists after the transition will depend on whether Glasswing evolves into a durable networked governance structure that provides value by providing disclosure pipelines, deconflicting simultaneous discovery, building robust automated and human verification capabilities, and helping manage any systemic risks of producing AI-driven (in)security at scale. The history of similar arrangements in cybersecurity — early ISACs, the Conficker Working Group, M3AAWG, the Cyber Threat Alliance — suggests clubs can persist beyond their initial formation, but only if they provide ongoing coordination value that individual actors can’t replicate on their own or with market transactions.

The post AI, Project Glasswing, and the Changing Institutional Economics of Bugs appeared first on Internet Governance Project.

My study of blocking 

To understand the scale of website blocking in India, I queried the DNS servers of six major and regional ISPs to test the censorship of 294 million domains, representing nearly the entire visible domain name space. These tests were carried out over many months in 2025 and contribute to the largest study of DNS-level website blocking in India to date. The study quantifies what previous qualitative research on Internet censorship in India has shown. Despite receiving the same blocking orders, not all ISPs block the same websites. 

Inconsistent results 

Out of the total 43,083 blocked domain names found by the study, only 1,414 were blocked by all six ISPs. This is caveated by the fact that some of the ISPs surveyed may be using other abovementioned protocols to block these domains, which the study does not cover. What is clear however is that at least on the DNS layer, domains are treated inconsistently based on the category of content they host. Piracy, peer-to-peer file sharing, pornography and gambling websites make up the majority of what is blocked, yet blocks are not consistently enforced across ISPs. For domains hosting terrorism and militancy content, blocking consistency across ISPs goes up dramatically. Perfect consensus can be seen in certain sensitive cases, such as the blocking of China’s Weibo.com or the website of Srinagar-based publication The Kashmir Walla, showing that some orders are treated more seriously than others. Along with this, almost all ISPs appear to engage in arbitrary blocking in some form. 

While highlighting only some notable blocks, the study shows the haphazard way in which both regional and national ISPs are currently implementing blocking orders. In the absence of a standardised framework or guidelines, ISPs are left to their own devices, resulting in an inconsistent blocking landscape. A domain blocked by one provider may be freely accessible through another, undermining the stated rationale for blocking while still infringing on the rights of users served by the more aggressive ISP. Domains officially ordered unblocked continue to remain blocked by some ISPs in clear defiance of orders, but without penalty to ISPs or respite for operators of such websites. 

Needlessly opaque  

Inconsistency is not the only problem however. The regime is needlessly opaque. An ideal system would see disclosure of blocked domains from the source, with exceptions only for sensitive matters such as those concerning national security and websites hosting child sexual abuse material. A perfect example of this is the many malicious domains found blocked by the study, which is arguably in the public interest, but which cannot be distinguished from overreach without disclosure. The Supreme Court in Shreya Singhal v. Union of India (2015) upheld Section 69A but emphasised procedural safeguards, including a review committee and the right of affected parties to be heard. In practice, neither can operate meaningfully as long as the system runs like patchwork. 

Karan Saini is an independent security researcher from New Delhi, and the author of the “Poisoned Wells” report, available at dnsblocks.in 

The post India’s crude Internet censorship regime appeared first on Internet Governance Project.

The Secure and Trusted Communications Networks Act of 2019 required the FCC to maintain a list of communications equipment if someone in the government thinks it poses a risk to national security. Previous iterations of this list target specific corporate entities like Huawei, ZTE, or Hikvision. Last week’s action expanded the “Covered List” to include ordinary household internet equipment, not specific companies, based entirely on foreign origin. 

What is banned? 

The ban targets new Small Office/Home Office (SOHO) routers, Wi-Fi extenders, and mesh systems. These devices can be found in practically every American home. The import ban includes any device where the “critical manufacturing and firmware assembly” occurs within a jurisdiction designated as a foreign adversary (primarily the People’s Republic of China, Russia, and Iran). The leverage for the ban comes from the FCC’s Equipment Authorization process. No new models from these regions can receive the “FCC ID” required for legal sale in the U.S. The Defense Department or the Department of Homeland Security (DHS) can exempt a product by transmitting to the FCC a specific determination that a given router or class of routers do not pose such risks. 

As of March 23, 2026, the FCC ceases all new equipment authorizations for covered devices. Starting in September 2026, retailers are prohibited from importing new inventory of covered devices. A year from now, March 2027, the “Maintenance Waiver” expires, and even security patches for existing legacy devices must undergo a secondary federal audit if they originate from covered jurisdictions. 

Fortunately, this bit of security theater does not apply to hardware that is already authorized and currently in consumers’ homes, or in the retail channel. These products can continue to be a “national security threat.” It also does not apply to enterprise or carrier-grade equipment, which remains governed by previous specific-entity bans. Certain sub-components (like passive capacitors or casing) are exempt, provided the “logic-bearing” components (SoCs and Firmware) are not of foreign-adversary origin. 

Legal Authorities 

The primary vehicle for this action is the Secure and Trusted Communications Networks Act of 2019; the law passed after an orchestrated and sustained U.S. intelligence community campaign portraying Huawei equipment as a potential (but never actualized) Trojan Horse. Additionally, the Secure Equipment Act of 2021 prevents the FCC from reviewing or approving any authorization for equipment after it has been placed on the Covered List, effectively turning a “warning list” into a “market ban.” 

Just as this new move will prove to be very costly to consumers, the “Rip and Replace” program authorized by the 2019 Act generated a massive funding shortfall. While the law initially estimated costs at $1 billion, and Congress appropriated $1.9 billion, the actual requests from carriers totaled nearly $5 billion. Many small carriers started “ripping” without enough money to finish the “replacing,” leading to concerns about service outages in rural areas. In the years preceding this farce, not a single compromise of American telecom networks or data were attributable to the use of Huawei gear. On the other hand, dozens of Chinese-instigated compromises occurred by means of compromises of American-made software and phishing.

Factual Studies and Intelligence Reports 

To support its decision, the FCC cited two primary types of evidence.  

1. The “Typhoon” Campaign Reports: Intelligence from CISA and the FBI regarding Volt Typhoon and Salt Typhoon. These reports detailed how state-sponsored actors hijacked thousands of SOHO routers to create a “botnet” that obfuscated attacks on U.S. power grids and water systems. 
2. The 2025 Supply Chain Audit: A Department of Commerce study argued that the concentration of 85% of the consumer router supply chain in China creates a “systemic vulnerability” where a single firmware update could be weaponized to disable U.S. home internet access. 

Just as the Huawei and TikTok scares played on the general public’s ignorance of actual cybersecurity risks and vulnerabilities, the new FCC ban follows the same pattern. These reports do not provide evidence for the policy.

Deconstructing the “Foreignness” Fallacy 

The central logical pillar of the FCC ban is that the origin of manufacture is the primary determinant of risk. However, an empirical look at the “Typhoon” intrusions reveals a profound disconnect between this premise and the technical reality. 

Vulnerabilities vs. Backdoors. The FCC justifies the ban on the potential for “backdoors”—intentional entry points built at the factory. Yet, in the history of the Volt Typhoon and Flax Typhoon campaigns, not a single instance of a hardware-level manufacturing backdoor was identified. Instead, these actors exploited: 

• Unpatched Software Bugs: Standard coding errors (CVEs) that exist in software globally. 

• Weak Credentials: Default “admin/admin” passwords in cheap devices that users never changed. 

• Management Interfaces: Ports left open to the public internet due to poor user configuration or “Secure-by-Design” failures. 

The Geography of Code. The digital economy is global. A router “Made in the USA” likely runs a Linux kernel maintained by global contributors, uses Wi-Fi drivers written in Taiwan, and incorporates open-source libraries managed by developers worldwide. By focusing on the geographic location of the assembly line, the FCC ignores the logical supply chain of the software. A U.S.-assembled router with a poorly written UPnP (Universal Plug and Play) implementation is just as vulnerable to a hijacking as a foreign one. 

If one looks at the Cybersecurity Advisory issued by DHS, NSA, and other agencies about the botnets used by the Chinese, one finds that U.S.-based processor architectures were involved in over 90% of the compromises, and that vendors and products like Juniper, Apache, Linux, Fortinet, Atlassian and others not located or headquartered in “adversary nations” were exploited. 

Targeting New Devices instead of Legacy Ones?

Perhaps the most obvious lack of logic in the FCC’s policy is its exclusive focus on new equipment authorizations while leaving legacy devices in place. Empirical data from cybersecurity firms consistently shows that older devices are significantly more vulnerable than new ones. 

• End-of-Life (EOL) Status: The Volt Typhoon campaign specifically targeted “End-of-Life” routers because they no longer receive security patches. 

• Legacy Protocols: Older routers often use outdated encryption (WEP/WPA) and lack modern hardware-level protections like Secure Boot or Trusted Platform Module (TPM). 

By banning the sale of the newest, most secure Wi-Fi 7 and Wi-Fi 8 routers from dominant foreign manufacturers, the FCC forces the American public to pay substantially more for upgraded, more secure equipment or, what is more likely, to keep their older, more vulnerable devices for longer. 

If a consumer cannot easily or affordably replace their 2019-era router because the 2026 models are banned, the total attack surface of the United States actually increases. The ban targets the very devices most likely to have modern, auto-updating security features, while providing a “free pass” to the millions of insecure, aging devices that state-sponsored actors are currently exploiting. 

The FCC’s decision assumes that manufacturing origin is the primary risk factor. However, cybersecurity data suggests that device age and software support are far more critical indicators of whether a router will be compromised. 

All new Wi-Fi 7 and most Wi-Fi 6 devices utilize WPA3, which protects against common “offline” password-cracking attacks. Many legacy devices in homes rely on WPA2, which has known architectural flaws like the KRACK vulnerability.  Modern hardware is designed to only run firmware that has been digitally signed by the manufacturer. This would have prevented the “Typhoon” actors from overwriting the router’s operating system with a malicious one. Most legacy routers targeted by the KV-Botnet lacked this physical protection. CISA and the FBI noted that the Volt Typhoon campaign specifically targeted End-of-Life routers from Cisco and Netgear. These devices are technically “trusted” by the FCC because they were authorized years ago, yet they are the most vulnerable items on the network because they no longer receive security patches. 

Conclusion 

By blocking the importation of modern Wi-Fi 7 equipment based solely on its “foreignness,” the FCC actually worsens the security situation. Incentives to upgrade to modern, more secure hardware are reduced, and users are encouraged to keep using unpatched legacy equipment—the exact hardware that state-sponsored actors have successfully weaponized for years.  

Does this whole thing make any sense? It does it you see the FCC’s ban as an exercise in industrial policy disguised as cybersecurity. Netgear, a US-founded and headquartered company, has been lobbying the government on “cybersecurity and strategic competition with China.” Once again – as with the semiconductor export controls and the TikTok ban – we see the bootleggers seeking protection from competition hiding behind the religious banner of national security. While the risks of state-sponsored infrastructure attacks are real, the remedy chosen—a geographic ban on new hardware – prioritizes geopolitical decoupling over the immediate technical hardening of the American digital home. 

The post Fake Cybersecurity: The FCC Router Ban appeared first on Internet Governance Project.

While this framing is not entirely wrong, it misses what is most important. The real stakes lie not in whether Anthropic was right to refuse, but in what this confrontation reveals about the deeper structural challenges of governing AI in high-stakes environments. This post examines three of them. First, the Pentagon’s demands are dangerous not because they cross obvious legal lines, but because flexible AI use policies erode human judgment in ways that are hard to see and harder to reverse. Second, Anthropic’s understanding of AI safety as something built into the programming of the model created the paradox at the heart of this dispute. And third, why this confrontation reveals the need for governance frameworks that do not leave principled companies to stand alone.

What Happened?

In July 2025, Anthropic signed a $200 million contract with the U.S. Department of Defense (DoD), and it was the first lab to integrate its models into mission workflows on classified networks. Through partnerships with Palantir Technologies, Claude Gov was cleared for classified military and intelligence tasks and became deeply embedded in Pentagon operations.

On February 24, Secretary Hegseth delivered a formal demand to Anthropic to remove all usage restrictions, including domestic surveillance and fully autonomous weapons, and grant the Pentagon the right to use Claude Gov model  “for all lawful purposes”. The threatened consequences for refusal were termination of contract, designation as a supply chain risk to national security, and the potential invocation of the Defense Production Act of 1950. Anthropic CEO Dario Amodei refused, stating that DoD made virtually no progress on preventing Claude’s use for mass surveillance of Americans or to control fully autonomous weapons, and that the company “cannot in good conscience” agree to allow the DoD to use its AI models in all lawful use cases.

President Trump ordered the U.S. government to stop using Claude and the Pentagon moved to designate the company a national security risk last Friday. However, less than 24 hours after Trump’s ban was announced, the DoD deployed Claude to attack Iran on February 28.

What does the Pentagon Want?

We still do not know exactly what the Pentagon has done or wants to do with Claude. What we do know is that the Pentagon demanded Anthropic remove all usage restrictions and grant access to the model “for all lawful purposes”—with no exceptions. However, Anthropic’s refusal and the Pentagon’s stated concern that AI safety guardrails could impede military response in emergency situations allow us to infer the Pentagon’s intentions. The Pentagon is pursuing a higher degree of automation in both intelligence data processing and weapons systems—a vision in which AI operates with minimal human intervention.

Before advanced AI, raw data was simply too voluminous and fragmented to be useful for comprehensive surveillance. The government could purchase location data from smartphone apps, browsing histories from data brokers, or financial records from third parties—but analyzing it all at scale was difficult and time consuming. This is precisely the bottleneck the Pentagon seeks to eliminate. AI makes it possible to analyze massive datasets—geolocation, web browsing activity, financial transactions—and synthesize them into predictive portraits of individuals’ lives, automatically and at scale.

The problem is that U.S. law has not caught up with the capabilities of modern AI. Under current law, it is perfectly legal for government authorities to acquire massive amounts of data and use AI to analyze it—even though the result may, in effect, constitute mass surveillance of American citizens. For this reason, Anthropic asked the Pentagon to explicitly include contract language prohibiting the bulk collection of Americans’ publicly available information. The Pentagon refused.

The second red line concerns autonomous weapons. The Pentagon’s position is, in some respects, understandable. The realities of modern combat are fluid and fast-changing, and there are clear limits to human capacity for real-time decision-making in such environments. AI-enabled autonomous detection and strike systems are already operating on the battlefield in Ukraine, demonstrating three to four times higher target engagement rates with lower human costs—sometimes without meaningful human oversight. The Pentagon’s goal is to reflect these battlefield realities. Because future combat scenarios are unpredictable, the military wants the flexibility to operate without pre-imposed restrictions—and it insists that private companies should not be in a position to dictate the terms under which AI is used in warfare.

It is also worth noting that Anthropic’s use of the term “fully autonomous weapons” is technically imprecise. Fully autonomous weapons—systems capable of independently making the decision to kill without any human involvement—do not yet exist. The U.S. military defines autonomy as “a system’s ability to accomplish goals independently or with minimal supervision in complex and unpredictable environments,” where the system refers to a subset of a broader weapons platform, not a decision-making authority unto itself. They therefore speak not of “autonomous weapons” but of autonomous systems or unmanned systems. In other words, while automated systems can exist to assist in decisions to kill, no weapons platform is designed to make that determination entirely on its own.

If the Pentagon’s push for more unrestricted and flexible AI use is legally permissible, operationally advantageous, and does not formally exclude human oversight—does that mean there is nothing to worry about? There are two issues here; the first has not been mentioned enough in the public media.

Trying to build politics into technology

Key to Anthropic’s ethos is the idea that their model can be engineered to prevent bad uses of their product – whether by the military or anyone else. In other words, they have bought into that school of AI safety (and of Science, Technology and Society studies) that believes that technology itself has politics and that values and social controls can be reliably built into the technical system. This viewpoint focuses on technology design rather than social institutions to regulate human behavior with technology.

As controls on moral behavior, technology is a crude instrument. For example, reflecting its concern that Claude’s powerful programming capabilities might be used to develop bio weapons, the company programmed the model to refuse to handle the word “pathogen.” You can kill a Claude session dead by querying one of these refusal strings – a word or request that is considered so bad that it triggers a “hard off switch” that causes the application to stop dead in its tracks.

The problem with these kinds of controls is that they lack the contextual nuance of real-world social activities. The Center for Disease Control, for example, has every reason to be searching for the word “pathogen” or doing research work on pathogens, and found this Claude restriction an impediment to its work. The Pentagon’s unnecessary, excessively punitive “supply chain risk” designation aside, the DoD has a legitimate concern that one of these restrictions built into Claude might stop it from doing something it needs to do.

The risk of automation bias

On the other hand, Anthropic’s resistance to giving the DoD a blank check is justifiable. The more flexible the terms of AI use, the more likely human operators are to gradually defer their own judgment to the machine—a tendency known as automation bias.

During negotiations, Anthropic asked the Pentagon to include stricter safety language in the newly proposed contract. But the company found that “new language framed as compromise was paired with legalese that would allow those safeguards to be disregarded at will.” In other words, even when restrictions on the use of Claude exist on paper, ambiguous contractual language makes them easy to bypass in practice. Over time, even if human involvement remains the stated principle, fewer and fewer operators will feel compelled to exercise independent judgment.

Overly flexible AI use policies create conditions under which human operators become increasingly reliant on autonomous systems—and in doing so, introduce a risk that is not primarily technical, but human: the error born of over-reliance. As CEO Amodei emphasized, “frontier AI systems are simply not reliable enough to power fully autonomous weapons.” In high-stakes military environments, the combination of unreliable AI and under-exercised human judgment could result in lethal mistakes—unintended escalation, misidentified targets, or mission failure precisely when it matters most.

The risks are even more pronounced in the context of mass surveillance. The U.S. government has already announced plans to use AI, through Palantir, to support ICE operations targeting undocumented immigrants—tracking their real-time locations and financial activity. The concern here is not simply that the surveillance happens, but that without strict use guidelines, agents relying on this technology are far more likely to act on its outputs uncritically, increasing the risk of overreach and wrongful action. This is not hypothetical. In recent years, police departments that over-relied on AI-powered facial recognition arrested the wrong people on multiple occasions. The pattern is consistent as when the rules governing AI use are vague, the humans operating within those rules tend to trust the machine more than they should.

Anthropic’s decision to walk away from the Pentagon’s request was, at its core, a recognition of this institutional vacuum and fully within its rights as a private business. Without strict guidelines capable of meaningfully reducing these risks, no contractual arrangement could be trusted to hold. What is needed is better institutions—clear legal frameworks, enforceable oversight mechanisms, and organizational cultures that actively resist the pull of automation bias.

The Paradox of Anthropic’s Safety

Anthropic’s willingness to stand up for its own public interest principles deserves praise. But few have examined a deeper paradox: the safer and more reliable an AI system becomes, the more valuable it is for military applications.

Unlike ChatGPT or Gemini, Claude was not primarily designed for everyday consumer tasks or commercial applications even though it is still general-purpose model. It is widely regarded as strong in deep analysis, contextual reasoning, and complex coding tasks. Anthropic has also been recognized for its advanced capabilities in local AI deployment—technology that allows the model to operate on a user’s own servers without sending data to external systems. These features were developed in the name of safety, privacy, and reliability. But paradoxically, they are precisely what makes Claude so attractive for military and intelligence work.

In intelligence operations, agencies must process and synthesize information from multiple sources. Deep analytical reasoning is essential for handling this volume of intelligence data, identifying patterns, and generating actionable insights. Contextual understanding allows the model to interpret ambiguous situations—exactly what is needed for operational planning and battlefield simulation. Strong coding capabilities enable rapid development of custom tools for cyber operations. Claude’s local deployment architecture also allows classified information to remain in secure government networks, and external data never enters the analytical environment. In comparison, a model like Gemini, which is deeply integrated with Google’s broader ecosystem, remains vulnerable to inbound contamination—where external information pollutes or distorts the integrity of classified analysis.

In other words, the very qualities that make Claude “safer” for civilian use are the same qualities that make it indispensable for warfare. For the average user, this level of privacy and local deployment capability is a nice-to-have, not a necessity; most people are perfectly comfortable using cloud-based AI services. But for military and intelligence applications, these features are attractive. Anthropic built an AI designed to be trustworthy, and in doing so, built exactly what the Pentagon needed.

This is the paradox at the heart of the dispute. The company now finds itself in the uncomfortable position of having created a tool so well-suited for national security applications that the government is unwilling to accept any restrictions on its use.

Implications

The dispute between Anthropic and the DoD is not merely a corporate contract negotiation gone wrong. It offers important lessons for the future development of AI governance frameworks. One key implication is that private companies should play a larger role in AI governance than they currently do. This may seem counterintuitive—shouldn’t democratic governments, not profit-driven corporations, set the rules for powerful technologies?

In practice, companies’ internal safety policies are often far more detailed and technically grounded than most people assume. In many cases, it is the companies—not governments—that are most sensitive to AI risks and quickest to implement guardrails. Companies possess more granular information about their own systems and have strong incentives to understand the risks their products pose. Their business models depend on it. Anthropic is a case in point. The company recognized that the very features that made Claude attractive for military use also made it potentially dangerous if deployed without restrictions. Because Anthropic understood the lethality of its own model, it was able to refuse the Pentagon’s demands.

This suggests that AI governance should evolve not through sweeping state control, but through the strengthening of corporate safety frameworks—with appropriate transparency and accountability mechanisms to ensure those frameworks serve the public interest. But for such frameworks to hold, they cannot rely on corporate goodwill alone. The Anthropic episode demonstrates that a company willing to draw principled lines can be immediately undercut by a competitor willing to accommodate. What is needed, therefore, is not just better corporate guidelines, but institutional structures that incentivize and reinforce them—legal frameworks that reward companies for maintaining meaningful safety standards, shield them from retaliation when they push back against unreasonable demands, and raise the cost for those who abandon their principles under government pressure. Only then can companies like Anthropic stand their ground not as an act of courage, but as a matter of course.

The post What Everyone Is Missing About Anthropic and the Pentagon appeared first on Internet Governance Project.