Model access became a compliance field this week

The Commerce Department barred all foreign nationals from Anthropic's Fable 5 and Mythos models this week. In the same action, it revoked SK Telecom's access to Mythos by name, citing China-nexus concerns. No transition period. No grandfathering.

That is the story. Everything else on the tape today — the RAM shortage, the Seattle data-center moratorium, the Shai-Hulud npm worm — is either a second concentration-risk story or context for this one.

Model access is now an export-control field. The bill for a decade of single-vendor convenience is being presented.

What actually changed

Chip export controls restricted supply. Teams adapted by stockpiling and pre-ordering. You cannot stockpile a cloud API. Model-level revocation removes production infrastructure between one call and the next, and the SK Telecom precedent shows it happens without warning and at the company level, not just per-user.

The operational surface this touches is bigger than most orgs have mapped. Every place Claude gets called counts: product features, internal RAG, CI pipelines running Codex or Claude Code, notebooks a data scientist stood up in April, a Slack bot someone shipped for a hackathon. If the key is shared and any holder sits in a covered nationality category, the exposure is live. Under EAR deemed-export rules, SSO group membership does not carry the attribute that matters. Your identity provider almost certainly cannot answer the question Commerce will ask.

Yes, but — Commerce has softened export postures before under industry pressure, and the specific models named today may get licensing carve-outs by Q4. Fair. It does not change the near-term move, because the audit exposure exists whether the policy holds or not, and the abstraction work pays for itself against pricing volatility from the same vendors positioning for IPOs.

The three-part response

Three things belong in motion by Friday, not next sprint.

First, inventory every Anthropic call across the org. Not "the product team's usage." Every call. Local dev tools, CI runners, evaluation harnesses, agent frameworks, wrapper SaaS that quietly proxies to Claude. Anything a foreign-national employee can reach through a shared key is the finding. Shared service-account keys are the largest single liability vector, and they were the default configuration until this week.

Second, replace shared keys with per-user keys that enforce nationality-aware routing at the gateway layer. This is the enforcement point Commerce will accept. SSO group claims will not be, because they were never designed to.

Third, get a working model-provider fallback into the architecture. Not a design doc. A live routing layer that can fail over to an open-weight model — Llama, Mistral, whatever your evals justify — without a sprint of rework. Open weights lag the frontier on benchmarks. They also cannot be revoked. The tradeoff calculation used to be about HumanEval scores. It is now about which model you can still call on Tuesday morning.

The abstraction layer earns its keep three ways from one code path: compliance (route by nationality), cost (multi-model routing runs 30–60% cheaper on bulk workloads, task mix dependent), and resilience (the next revocation is not the last revocation). Build it once.

The pattern under the pattern

The reason this week matters beyond Anthropic is that three concentration bets broke at the same time.

GitHub dismissed two vulnerability reports from Deep Specter that are now being exploited by the Shai-Hulud worm across hundreds of npm packages. The platform responsible for code provenance failed to prioritize the disclosures that would have prevented the worm. That is a trust event, not an incident. Dependabot and GHAS run on the same triage process that produced this outcome.

Apple confirmed price increases from a global RAM shortage the same week Seattle imposed a unanimous one-year moratorium on new large data centers. Amazon shipped defensive water-efficiency numbers within 48 hours, which tells you the political pressure is sustained rather than a news cycle. Memory is the binding constraint for 2026-2027 infrastructure budgets, not GPU compute, and tier-1 metro capacity is capped in a way it was not last quarter.

Each of these was a defensible bet in isolation. The combination — one code platform, one model provider, one memory supply chain, one preferred cloud region — was not. It just took a week where all four cracked at once to make that legible.

What to do this week

One concrete move, measured on a deadline: by end of day Friday, produce a single document listing every system in your org that calls Anthropic APIs, who holds the credential, and what nationality attribute (if any) governs access. That document did not exist last week. It has to exist this week.

If you cannot produce it in four days, you have your finding. The remediation plan writes itself from there — per-user keys, gateway enforcement, an open-weight fallback wired to a real router. But the inventory is the gate. Everything downstream of it is guessing until it is done.

Audit exposure is not the worst outcome here. Discovering the exposure the week Commerce names the next model is.