The Kill Switch
What a letter to Anthropic taught Europe about its own AI
As you’ve probably heard already, last week on Friday evening, June 12th, at 5:21 PM Eastern, a letter arrived at Anthropic from the US Commerce Department. By the early hours, two of the most capable (allegedly!) models on the planet — Claude Fable 5 and Mythos 5, released barely days earlier — were dark. Neither throttled nor rate-limited — just cleanly disabled. For everyone, everywhere.
The reason, on paper, was national security. The actual mechanism is worth sitting with for a second, because it’s the kind of detail that sounds made up. We’ll get into that later — though it’s not the part of the story that matters most to me.
Here is the thing: the order didn’t ban the models in a country. It banned them for foreign nationals — a nationality test, not a geography test. The geography test as it is, is already a difficult thing to enforce (VPNs and all). A nationality test is roughly impossible to enforce with a scalpel. You can’t reliably serve one model to an American in Seattle and withhold it from a French engineer sitting at the next desk, or from Anthropic’s own foreign-born staff.
And so Anthropic did the only thing the order left it room to do. It pulled the plug globally. I guess you wouldn’t be wrong to read this as a story about Anthropic getting unlucky. I mean one could argue they’ve brought it upon themselves — for months Anthropic talked up Mythos as so dangerous it couldn’t be released publicly, and that drumbeat is precisely what drew the government’s eye.
That’s the obvious frame, and it’s not entirely false. There’s another angle to it, though.
The jailbreak or a regular feature
Here is what the government was apparently worried about, in Anthropic’s own telling. The dangerous “jailbreak” at the heart of the order “essentially consists of asking the model to read a specific codebase and fix any software flaws.”
Read that again. The catastrophic national-security capability is: the model finds bugs in code.
…
Well, one cannot help but think there is something else to that story (a quid pro quo, maybe?). The feud between Dario Amodei and the administration has been simmering for months — the Pentagon even branded Anthropic a supply-chain risk. Anthropic, understandably, pushed back hard. They noted the same capability is “widely available from other models (including OpenAI’s GPT-5.5), and is used every day by the defenders who keep systems safe”. They noted the government acted on “only verbal evidence of a potential narrow, non-universal jailbreak.” And they pointed out — this is the part that should make any frontier lab’s blood run cold — that if this standard were applied consistently, “it would essentially halt all new model deployments for all frontier model providers.”
A government reached in and switched off two commercial frontier models — globally, for everyone — on the strength of a verbal claim about a capability that amounts to reading source code. These two happened to be days old. The next one it reaches for might be the model your bank, your hospital, or your government already runs on.
The point isn’t whether this particular order was wise or even survivable — Anthropic is challenging it, dozens of cybersecurity veterans have signed an open letter against it, and these two models will likely be back. The point is that we just watched the switch get flipped. We now know it exists, where it sits, and whose hand is on it.
We’ve run this experiment before
Here’s the part where the tech industry’s famously short memory kicks in, so let me get ahead of it.
For years, the way a government controlled access to advanced computing was through chips. We built an extraordinarily long, extraordinarily fragile chokepoint stack and then acted surprised that someone might use it.
Start at the bottom: the machines that make the chips. Extreme ultraviolet lithography is a global monopoly held by a single Dutch company, ASML — effectively one building in Veldhoven, with no alternative supplier on Earth. One rung up: the chips themselves. Since 2022, successive US export controls — the BIS rules, then the “AI Diffusion” framework that sorted the entire world into tiers of chip access — turned Nvidia silicon into an instrument of foreign policy. The H20 saga, the country tiers, and the whole apparatus. (The Diffusion Rule itself was later rescinded before it ever took effect — a reminder that these levers get pulled and reversed at will).
Fabs, then chips. And now, with Anthropic, the third rung: the trained model itself.
So, it is not a novelty. It’s more of a pattern reaching its logical conclusion. Political scientists Henry Farrell and Abraham Newman gave it a name — weaponized interdependence — the idea that whoever sits on a chokepoint in a shared network can quietly switch the rest of us off. The US already controlled who gets the machines and who gets the chips — and the way it does that is itself a small lesson in how this game is played. ASML is Dutch, not American, yet Washington still dictates who it can sell to. The lever is the Foreign Direct Product Rule: because roughly a tenth of an EUV machine’s value is US-origin technology (down to the laser unit, made by Cymer, a US subsidiary ASML bought in 2013), the US claims jurisdiction over the entire machine — wherever it is built and whoever buys it. A ten percent stake, a hundred percent veto. The Dutch have spent years quietly trying to claw that control back.
Controlling who gets the model was always the next move. We just hadn’t seen it happen to a live one before.
“It’s just 1999 again”
Now, the steel-man, because we deserve one.
The contrarian case is that none of this is new and everyone needs to calm down — this is overreaction, export bans happen, the models will be cleared faster than most, the tech industry just has short memories.
And the history is real. In the summer of 1999, the United States classified the PowerMac G4 as a munition — a weapon — for crossing the one-gigaflop threshold, and banned its export to some fifty countries. Apple turned the absurdity into an ad: “For the first time in history a personal computer has been classified as a weapon by the US government.”
Go back a little further and strong crypto was literally classed as a weapon under US export law too — Netscape’s “International” build shipped a deliberately crippled 40-bit cipher that researchers cracked in days. Export controls on computing power are not new. They land, they make headlines, and they usually pass.
And on the narrow question — will these two models come back? — the contrarians are probably right. They likely will.
But the analogy quietly smuggles in an assumption. In 1999, a US export control landed on a continent that trusted the United States. It was an ally’s bureaucratic hiccup — annoying, temporary, fodder for a clever ad. The context made it small.
Sadly — and I am saying this as a European — that context is gone.
The number that matters more than the ban
Two days before the Anthropic block, the European Council on Foreign Relations published a poll across fifteen countries. Only 11% of Europeans now describe the United States as an “ally” — down from 22% in late 2024. In every country surveyed, majorities doubt the US would actually defend them if attacked.
If you have to ask why, you’ve spent the last year or so under a rock. It’s the backdrop of an 18-month rupture. “Liberation Day” tariffs that pushed the headline US rate on European goods to 20% — part of a salvo that lifted America’s average tariff to its highest level in over a century. A fragile 15% truce the European Parliament could only ratify by bolting on a sunset clause — because it didn’t trust Washington to honor the deal. Over $7 billion in EU fines on US Big Tech, answered by US visa bans on the European officials who wrote the digital rules. An $800 billion European rearmament plan. US troops coming home from Germany. Ursula von der Leyen, a year ago, calling it “a very strong wake-up call”; by Davos, calling for “a new form of European independence.”
A perfect storm.
So no, this is not 1999. In 1999 the switch belonged to a friend. The mechanism is identical; the meaning is quite different. The novelty was not the ban. It’s that the hand on the switch is no longer one Europe is sure it can trust.
The contrarians are right that export bans aren’t new. They’re wrong that this one is just another. The context has changed — the US is no longer an ally Europe can count on.
The sovereignty hair-trigger reflex
Europe’s response was immediate and predictable: build our own. The day the switch flipped, the Polish open-weight model Bielik — an Apache-licensed project built by volunteers at the SpeakLeash foundation and the Cyfronet supercomputing center in Kraków — quote-tweeted Anthropic’s own shutdown announcement with a single line: “Do you need a clearer argument for developing sovereign AI models?”
It is a good line.
And I believe the sovereignty reflex is the right instinct. But here’s where I want to slow down, because the reflex hides a trap that the cloud era didn’t have.
Think back to ten years ago, when the worry was cloud lock-in. If you got nervous about AWS or Azure owning your destiny, you had a real escape hatch: on-premise. Bring it back in-house. Buy your own servers, run your own racks. The migration was miserable, expensive, slow — but it was possible, and at the end of it you genuinely owned the alternative. Sovereignty was a purchase order away.
What’s the equivalent for a frontier model today?
The good news is better than you’d expect. Open-weight models — Llama, Mistral, DeepSeek, Qwen (and Bielik) — are now genuinely competitive: Qwen-family systems post SWE-bench Verified scores in the high seventies on real GitHub issue resolution. Closed Anthropic systems still top many public trackers — so the case for open models isn’t that they clearly lead, but that they’re becoming good enough for a growing share of enterprise work.
And increasingly, the thing that matters isn’t the raw weights at all — it’s the harness wrapped around them: the agent loop, the tool calls, the scaffolding that turns a model into something that actually does work. Claude Code is the obvious commercial example of the pattern; open-source harnesses are increasingly replicating it — replicable, and improving fast, which quietly tilts the math even further toward the open alternative. You can rent European GPUs, deploy the weights, and run the whole thing yourself. Open-source agent harnesses increasingly speak the same APIs as the commercial tools, so in principle you can run the entire loop locally — your code never leaving the building.
So we’re fine, right? We just self-host.
Not quite. Look at what you’re actually standing on. The open weights you’d fall back to are American (Llama) or Chinese (DeepSeek, Qwen). And whichever you pick, it runs on Nvidia GPUs — the very silicon that sits behind the chip export controls we just walked through. The fallback to escape US AI dependence is built on US AI hardware. No European AI accelerator exists on any credible timeline before 2030; the one new advanced fab on the continent, TSMC in Dresden, makes chips for cars, not for training runs.
With cloud, you could buy your way to sovereignty. With AI, you can only buy your way to less dependence.
The wall
Fine, says the optimist. Less dependent is still better. Build the European stack anyway — the models, the data centers, the whole sovereign rig. Throw money at it.
And this is where the story stops being about software, or even about chips, and becomes about something far more stubborn.
Because a sovereign AI is not only about software. It’s a physical thing that has to sit somewhere — in a building, drawing power, on a grid. The weights are portable. The machine that runs them is emphatically not. And the moment Europe tries to actually own that machine at scale, it runs headfirst into a constraint that no amount of capital or political will can conjure away on the relevant timeline.
Sovereignty, it turns out, isn’t blocked by software. It isn’t even, ultimately, blocked by chips.
It’s blocked by electrons.
Here’s what that means in practice. A data center can be built in twelve to eighteen months. Getting it connected to the electrical grid — the cables, substations, and permits that actually deliver the power — now takes seven to ten years across Europe’s major hubs. That gap is the real wall. You can pour concrete and rack GPUs at the speed of capital; you cannot conjure a high-voltage connection on the same timeline, no matter how much money or political will you throw at it.
And the load is not small. A single modern AI cluster draws as much electricity as a quarter-million homes. Anthropic expects one frontier training run to need five gigawatts by 2028 — the output of roughly five nuclear reactors, for a single model. To put that in perspective: Poland’s entire installed generating capacity is around 75 gigawatts, the UK’s about 115, France’s roughly 156. One training run is already a few percent of a mid-sized European country’s entire power system — and a serious sovereign-AI buildout means many of them running at once. In Ireland, data centers already eat more than a fifth of the entire country’s electricity, heading for nearly a third; official plans put future data-center demand at roughly the nation’s all-time peak. In the Netherlands, the grid is so congested that some new connections are being quoted waits into the mid-2030s. The grid is full, and the line is years long.
So the real race for AI independence in Europe is, underneath everything, a fight over power. The electrical kind.
And that’s a whole different story. A story that deserves another write up.