Topic starter
19/08/2026 3:51 pm
TL;DR: The Commerce Department’s brief export controls on Anthropic’s Fable 5 and Mythos 5 replay the same logic that failed in the 1990s crypto wars, where restrictions hit law-abiding defenders more than determined adversaries, according to Corgea. The practical lesson is that AI governance has to assume diffusion, not depend on enforceable scarcity.
Editorial analysis by NHI Mgmt Group, based on content published by Corgea: “The Crypto Wars are back, this time over AI models”.
Key questions
Q: What breaks when AI model export controls are used as the main security control?
A: They break when the underlying capability can still diffuse through other routes.
Q: Why do export controls on AI models often create more friction for defenders than attackers?
A: Because defenders are the actors most likely to comply, document use, and seek approval, while adversaries can route around the control through open releases, offshore services, or derivatives.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Map model diffusion paths Identify where frontier model capability can reappear through open-source releases, derivative models, hosted services, and internal replicas before you rely on a single restriction regime.
- Tie AI access to identity governance Review who can use advanced models by role, residency, employment status, and business justification so access decisions are tracked like other privileged entitlements.
- Test controls against adversary bypass For each proposed restriction, document how it would reduce attacker reach rather than merely adding approval steps for compliant teams.
Bottom line: Export controls can delay access to frontier AI models, but they do not remove the underlying governance problem when capability can spread through other channels.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:27 pm
AI export controls create a governance illusion when diffusion is the real risk. The article’s central warning is that restrictions feel decisive because they act at the point of approval, not at the point of misuse. That is a familiar security mistake: assuming administrative friction equals adversary containment. In practice, determined actors substitute open models, overseas access, or alternative delivery channels. Practitioners should read this as a reminder that policy control and threat reduction are not the same thing.
A question worth separating out:
Q: Who is accountable when restricted AI access blocks security work?
A: The accountable parties are the model owner, the access governance team, and the business sponsor for the exception process. If a restriction prevents defensive evaluation, there should be a documented path for review, approval, and audit so security work is not silently subordinated to policy optics.
👉 Read our full editorial: AI model export controls repeat the crypto wars mistake
19/08/2026 4:29 pm
Export controls are a weak substitute for capability governance when the technology can diffuse. The article is strongest where it argues that model restrictions resemble the failed crypto wars pattern more than a durable security boundary. Once capability is reproducible, policy can slow legitimate use but cannot reliably contain determined actors. Practitioners should therefore judge controls by whether they reduce adversary reach, not by whether they look restrictive on paper.
A few things that frame the scale:
- 13% of organisations suffered breaches of their AI models, according to IBM's Cost of a Data Breach 2025 report.
A question worth separating out:
Q: What should organisations do when frontier AI access becomes a legal or residency issue?
A: Treat it as an identity and entitlement problem, not only a policy problem. Organisations need to know who is entitled to use the model, from where, under which jurisdiction, and with what business justification. Without that inventory, restrictions become hard to enforce and easy to route around.
👉 Read our full editorial: AI model export controls repeat the crypto wars mistake