The Fable 5 Shutdown Is a Harder Legal Question Than It Appears
The Fable 5 shutdown is becoming the Liebeck v. McDonald's of AI policy: a story everyone is sure they understand from the headline. The hot-coffee case is the punchline for frivolous litigation until you learn that Stella Liebeck suffered third-degree burns from coffee served at roughly 180 to 190 degrees. Fable 5 is the same kind of story, and the loud fight is almost entirely about who the villain is. One camp calls it government overreach: a disproportionate, legally murky control dropped on launched software, sweeping in allied nationals, with no prior process. Another blames Anthropic, arguing its own civilization-scale doom-marketing handed regulators the pretext (the argument being that if you spend months calling your model a civilizational threat, you cannot act surprised when the government treats it as one). The administration, for its part, says there is no villain at all: a real jailbreak surfaced, it gave Anthropic a fix-or-pull choice, and Anthropic pulled the models.
What the blame fight skips is the law, which is where this is actually decided. Three real questions remain, none with a confident answer right now. What legal authority did the government actually use? Does Anthropic have a defense, and where? Could it have complied without shutting the models down for everyone? Two facts sit under all three: the directive restricted foreign-national access, so the worldwide blackout was Anthropic's response and not the directive's command, and the government never named its statutory instrument. My own read is that both are real at once: the government's overreach, and Anthropic's choice to make the blackout worldwide. A directive this consequential, with no publicly stated basis, is itself part of the problem.
A word on what this is and is not. I do not represent Anthropic, have no inside knowledge of it, and no stake in the politics that have swallowed the discussion whole. This is an attempt to read a hard, unsettled legal problem in public, the way I would for a board that called on a Saturday. The honest answer to most of what follows is "it depends."
You almost certainly know the timeline already: the Friday-night directive, the weekend recall, who said what to whom, all of it reported to death. If you want to get caught up, the AP wire story carried by ABC is a clean place to start. I am going to skip the recap and spend our time on the law, beginning with one factual correction that the analysis turns on and that most of the coverage got backwards.
What actually happened, stated precisely
The fact almost everyone is getting wrong: the government did not order a worldwide shutdown. On June 12, 2026, Commerce Secretary Howard Lutnick sent Anthropic a directive, drafted with the Bureau of Industry and Security, requiring a license for access to its newly launched Claude Fable 5 and Claude Mythos 5 models by "any foreign national, whether inside or outside the United States, including foreign national Anthropic employees." That is the literal scope: it conditions foreign-national access. It does not, on its face, command that the models be switched off for everyone on earth. Anthropic did that part itself. By its own account it disabled both models for all customers worldwide to ensure compliance, the rationale being an inability to filter foreign nationals from US users in real time. The global blackout was Anthropic's chosen compliance method, not the directive's text. That distinction disciplines both loud camps and grounds the question that actually matters: whether a less drastic, still-compliant posture existed. Whether a narrower gate was feasible is a factual question the public record cannot resolve.
The two sides also characterize the trigger differently, and both characterizations stay attributed: the government treats it as a real dual-use vulnerability warranting action, while Anthropic calls it a "narrow," "non-universal" jailbreak whose underlying capability is "widely available from other models." I credit neither as a finding.
The problem nobody is solving: what is this thing?
An export-control lawyer's first reaction to this fact pattern is not "is the control valid": it is "what, procedurally, is this?" The reporting says the directive cited national-security authorities but does not name the specific statutory instrument. The directive letter is not public, and nothing that has been disclosed identifies a basis. That silence is not a gap in what an outside lawyer happens to know; it is part of the problem itself. A directive that recalls a model already in deployment and reaches a company's own foreign-national employees, with no publicly stated statutory authority behind it, is for that reason both hard to defend and hard to challenge. That is the tell, because the choice of instrument decides almost everything downstream.
Run the four-way characterization. A directive like this could be (1) a "Part 744 is informed" letter, the EAR mechanism by which BIS notifies a party that a transaction requires a license; (2) a Temporary Denial Order under 15 C.F.R. § 766.24, the EAR's emergency tool; (3) an interim final rule or classification under the Export Control Reform Act; or (4) an ad hoc, sui generis directive that fits none of those boxes cleanly. These are not interchangeable. A § 766.24 TDO carries its own procedural rails: it issues on an Assistant Secretary's finding that the order is "necessary in the public interest to prevent an imminent violation," for an initial period of up to 180 days, renewable. A published rule travels through notice machinery. A letter, on the present record, appears to have done the work of all three without the architecture of any. The confident takes on every side are arguing about an instrument no one has identified.
The fork that changes the whole analysis: ECRA or IEEPA?
Before you can analyze the control, you have to know which statute the government is standing on. It has not said. The two live candidates point in different doctrinal directions.
If the authority is the Export Control Reform Act and its implementing Export Administration Regulations, one set of doctrines governs: APA review is stripped, the EAR's published-software and deemed-export rules come into play, and a § 766.24 TDO is the proper emergency rail. If instead the authority is the International Emergency Economic Powers Act, the analysis shifts. The penalty caps differ: ECRA/EAR civil penalties run to the greater of $374,474 or twice the transaction value (50 U.S.C. § 4819), while IEEPA caps at $377,700 (50 U.S.C. § 1705). IEEPA also carries the Berman Amendment's informational-materials exclusion (50 U.S.C. § 1702(b)), which arguably reaches expressive software and would become a live defense. I am not going to assign a probability to which statute is in play. That is the point: the government's silence on its own authority is exactly why you cannot assume the analysis and run.
If it is ECRA: the export doctrine cuts against an easy control
Two EAR doctrines make a deployed, publicly launched model a hard thing to treat as a controllable export. Take them in order.
The first is the published-software rule. Under 15 C.F.R. § 734.7(a), unclassified technology and software become "published" (and cease to be subject to the EAR) once they are made available to the public without restriction, including by posting on the internet. Fable 5 launched roughly three days before the directive, and Mythos earlier still, under Project Glasswing. They were out. That is the export practitioner's instinct: this was already published. That said, the wrinkle is real. A paid, terms-gated, rate-limited commercial API is not obviously "available to the public without restriction" the way source code on an open FTP server was in the cases that built this doctrine. That makes for a harder § 734.7 case than open-weight posting. The argument is strong; it is not clean.
The second is sharper and less appreciated. A deemed export (the theory that reaches "foreign national Anthropic employees" inside the United States) is defined by 15 C.F.R. § 734.13(a)(2) to cover the release of "technology or source code (but not object code)." Model weights are not human-readable source code. They are a multi-gigabyte array of floating-point parameters far closer to a compiled object-code artifact than to anything a person reads or writes. A deemed-export theory built on that distinction has to reckon with the fact that the controlling regulation, by its own terms, does not reach object code.
Underneath all of it sits the classification gap. The only instrument that ever classified AI model weights was ECCN 4E091, created by the January 2025 AI Diffusion Rule for the parameters of advanced closed-weight models trained on 10^26 or more operations, under a presumption of denial; BIS rescinded that rule on May 13, 2025. As of mid-2026 there is no in-force ECCN that classifies model weights. The control, whatever it is, operates in a space the regulations no longer expressly occupy.
The government's best answer to all three of those problems is to stop arguing about the artifact and reframe the controlled act as a release. Under 15 C.F.R. § 734.15, a "release" of technology includes visual inspection by a foreign person that reveals technology, or an oral or written exchange with one, and a release requires the same authorization as an export. On that theory the wrong is not distributing a published file to the public; it is releasing the model's capability to specific foreign persons, which is precisely how the directive is worded, gating access by foreign national, including foreign-national employees. That framing may sidestep the § 734.7 "we already published it" defense, because the conduct controlled is access to identified foreign persons, not public distribution. That is the government's strongest hand, and it deserves a real answer rather than a wave-off. The answer is that it still has to clear the same two hurdles the rest of this section identifies: whether the underlying technology is even classified after 4E091's rescission, and the deemed-export rule's exclusion of object code. Recharacterizing the act sharpens the government's position without escaping the core "what is this, and is it even a controlled item" uncertainty.
The courtroom path: ultra vires is all you have
The statute is unkind to challengers. The surviving path is narrow, and narrowness is the point. 50 U.S.C. § 4821(a) provides that the functions exercised under this subchapter "shall not be subject to" the APA's procedural sections and its judicial-review provisions, sections 701 through 706 of Title 5, save two narrow exceptions. That strips the most familiar door to court.
What survives is non-statutory ultra vires review, and it is brutal. The D.C. Circuit's test in Changji Esquel Textile Co. v. Raimondo, 40 F.4th 716 (D.C. Cir. 2022) requires that the agency "plainly act[] in excess of its delegated powers and contrary to a specific prohibition in the statute that is clear and mandatory," a prong the court called "especially demanding," reserved for error "so extreme that one may view it as jurisdictional or nearly so." And Federal Express Corp. v. Department of Commerce, 39 F.4th 756 (D.C. Cir. 2022) closes the obvious workaround: that demanding standard applies even where Congress withdrew only APA review, so stripping the APA does not make ultra vires easier. FedEx lost for failing to show blatant error. Call ultra vires here what it is: a Hail Mary, not a likely win.
Even the door to court is contested. Sovereign immunity can fall away where an officer acts beyond legal authority (Larson v. Domestic & Foreign Commerce Corp., 337 U.S. 682 (1949)), but that exception is narrow, does not reach relief requiring affirmative action by the sovereign, and rests on a waiver-to-sue that is itself unsettled once the APA's § 702 waiver is stripped. Declaratory relief, too, is discretionary rather than a right; as the Declaratory Judgment Act says in the Supreme Court's words in Wilton v. Seven Falls Co., 515 U.S. 277 (1995), it "confers a discretion on the courts rather than an absolute right upon the litigant." Even a meritorious theory can be turned away at the threshold.
One doctrine people will reach for shouldn't be reached for directly. Department of Commerce v. New York, 588 U.S. 752 (2019), the census case where the stated rationale "seems to have been contrived," is an APA reasoned-explanation holding, so with § 4821(a) stripping APA review the pretext theory cannot be imported directly; it can only be re-channeled, uncertainly, through ultra vires or a constitutional claim. Pretext is a doctrinal category to analyze here, not a finding about anyone's motive.
The First Amendment angle, with the concession that makes it credible
There is a real prior-restraint shadow over any licensing scheme that gates the release of code, but the speech predicate is genuinely contested for model weights specifically, and pretending otherwise is the tell of someone who hasn't read the cases closely. Start with what the cases hold and what they don't.
In Bernstein v. United States Department of Justice, 176 F.3d 1132 (9th Cir. 1999), a panel held that encryption source code "must be viewed as expressive" and that the export-licensing regime was an unconstitutional prior restraint lacking the safeguards required by Freedman. Two caveats travel with that citation every time. The panel opinion was withdrawn on rehearing en banc, 192 F.3d 1308 (9th Cir. 1999), persuasive only and not binding. The panel itself drew the line that matters here: "We do not hold that all software is expressive. Much of it surely is not." Junger v. Daley, 209 F.3d 481 (6th Cir. 2000) protected source code as "an expressive means for the exchange of information and ideas about computer programming," while expressly recognizing its functional dimension, and Freedman v. Maryland, 380 U.S. 51 (1965) supplies the safeguards any licensing prior restraint must carry: prompt judicial review, with the burden on the government.
Now the concession. Bernstein and Junger protected human-readable source code precisely because it is an expressive medium humans use to exchange ideas about programming. Model weights are not that. They are non-expressive functional artifacts no human reads as expression, object-code-like on the very line Bernstein itself drew. The leap from "source code is speech" to "model weights are speech" is a step the cases haven't taken, and it runs straight into the functional/expressive distinction the cases built. That is the honest framing: the prior-restraint shadow is real, the speech predicate for weights is contested, and both things are true at once.
Why this is hard for everyone
The reason no one should be confident is that the strongest argument on each side is genuinely strong. The government's hand is better than the outrage suggests. Holder v. Humanitarian Law Project, 561 U.S. 1 (2010) instructs heavy deference "[g]iven the sensitive interests in national security and foreign affairs at stake," and that deference is the government's best shield. The EAR's residual "any other action" authority under 50 U.S.C. § 4813(a)(16) gives Commerce real running room. There is a jailbreak the government treats as a live dual-use risk. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, has also framed it publicly as a control issued reluctantly that lifts once the model is patched. In his words, "the ball is in Anthropic's court," which makes the action look narrow and curable. I attribute that characterization to Sacks; I do not adopt it.
The other side is also real, and it lives entirely in doctrine and procedure: the classification gap after 4E091's rescission, the absence of a written reasoned basis on the public record, the choice of a letter over a § 766.24 TDO, the published-software and object-code doctrines, the prior-restraint shadow, and the structural oddity that a directive conditioning foreign access produced a worldwide recall. A separate proceeding offers a small tell on judicial mood: in the pre-existing Defense Department "supply-chain risk" matter, a court rejected what it called "the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government." Different case, different facts, quoted only as context. But it marks a court already wary of branding a company an adversary for disagreeing.
What would change the analysis
If you want to know which way this tilts, watch for the events that would move it, not the headlines. Four benchmarks matter. If BIS issues a written reasoned basis invoking the § 4817 interagency process, the ultra vires argument weakens considerably. If a § 766.24 TDO issues, the whole posture shifts onto a TDO-appeal track with defined procedure. If a successor rule classifying AI model weights is published, the "no settled classification" pillar collapses. Should the government formally name its statutory authority, most of the uncertainty here resolves on the spot. Until one of those happens, anyone telling you how this comes out is guessing.
First three steps for counsel watching this
This is general and educational, not advice to any company. But if I were briefing a board in this space, three moves come first. Pin down the instrument and the statute before arguing the merits: a one-page characterization memo, not an abstract debate about "the export control." Separate what the order commands from what compliance requires: an access-conditioned directive is not a command to go dark, so ask whether a narrower posture is feasible before a total withdrawal. Map the surviving review paths soberly, building the record now. The value is in preserving options, not in promising an outcome.
Frequently asked questions
Can the government really do this to a US company's software? The government has real authority in this space, and national-security deference under Holder v. Humanitarian Law Project is substantial. Whether this particular directive fits within that authority turns on facts the government has not yet made public: chiefly which statute and which instrument it used. Until the government names its statutory authority in writing, no one can give you a reliable probability either way.
Did Anthropic have to shut down worldwide? The directive restricted foreign-national access. Anthropic disabled both models for all customers; the rationale it and multiple outlets gave was an inability to filter foreign nationals from US users in real time. The worldwide blackout was Anthropic's chosen compliance method, not a command in the directive. Whether a narrower, still-compliant restriction was technically feasible is a factual question the public record does not resolve.
Is this an export control or a content restriction? That is the unresolved question at the heart of it. The directive used export-control machinery, but the government has not publicly named its statutory authority, and the choice between the Export Control Reform Act and the International Emergency Economic Powers Act changes the analysis substantially, including which defenses (the Berman Amendment's informational-materials exclusion being the most obvious) are even available. Nobody can answer which statute governs until the government says so.
I serve as outside product, commercial, and IP counsel to technology companies across the product lifecycle: IP and content rights, copyright and training-data questions, platform terms, privacy, and AI governance, including the kind of export-control and product-risk questions a directive like this raises. If this touches your product, get in touch.
This article is general information, not legal advice, and should not be relied on as such; it reflects the law as of June 2026, and reading it does not create an attorney-client relationship. Liam J Penwell is the professional name of Jason Penwell, Esq. (State Bar of California No. 339157), licensed in California. Penwell Law · Burlingame, California · Contact.