On June 12, at 5:21pm Eastern, a government recalled Anthropic's flagship models from every customer on earth. I wrote about what that meant for engineering teams: you cannot retry your way out of a jurisdiction problem, and the off-switch was never on your side of the glass.
Fourteen days later, on June 26, Mythos 5 came back to about a hundred institutions you've never heard of. Not to you. Commerce Secretary Howard Lutnick wrote Anthropic a letter: "I have determined that appropriate safeguards are in place to permit certain trusted partners to access the Claude Mythos 5 Model." Anthropic confirmed the model "can be redeployed to a set of US organizations" described as operating and defending critical infrastructure.
Fable 5, the model most of us actually used, stayed dark. No date given for it either.
The same week, a different lab learned the lesson before it had to. OpenAI previewed GPT-5.6, three new tiers called Sol, Terra and Luna, and shipped them straight into the identical arrangement: "a small group of trusted partners whose participation has been shared with the government." Not a recall this time. A gate, built into the launch before the public ever got a turn at the door.
That's the part worth sitting with. June 12 was a model getting pulled. June 26 was a model arriving pre-pulled.
The case for it isn't new
The legal scaffolding here was already public before any of this happened. Frontier models have sat inside the export-control regime since the 2025 BIS rule. The administration's executive order this month formalised a pre-release review channel: labs submit their most capable models up to 30 days before shipping, and the government decides who outside the building gets to touch them first. It used authority that already existed to move the checkpoint from "after a model misbehaves" to "before anyone outside a list finds out if it will."
The dual-use argument hasn't gotten weaker since June 12, either. A model that can read an unfamiliar codebase and find the flaws in it, the same capability Mythos 5 was marketed as being too dangerous to release back in April, is identical whether it ships to the public on day one or to a hundred vetted institutions first. If you accept that premise, gating the release is the same policy, running earlier in the pipeline.
Nobody can tell you what's on the list
What changed is the size and shape of the line you're not in.
Eighteen days ago, the gate only mattered if you were already a customer who lost something. Now it matters before you've ever had the chance to become one.
Nobody outside the process can tell you what gets an organisation onto the trusted-partner list. Not the criteria, not an application form, not who reviews it. Anthropic's hundred-plus institutions are described only as bodies that operate and defend critical infrastructure. OpenAI's partners are described only as parties whose participation "has been shared with the government."
Neither company has published a path for joining either list. You already know someone, or you wait for a press release announcing the gate has widened, on a timeline nobody commits to.
Even OpenAI sounds uneasy inside its own arrangement. Its statement on the rollout reads less like policy and more like a hostage letter: "We don't believe this kind of government access process should become the long-term default." Sam Altman put it more bluntly: "I just don't like the idea of the government picking the customers." Then OpenAI shipped the model into exactly that process anyway, because the alternative was shipping nothing.
The sharpest detail sits one level up from the companies. Dean Ball, the former White House AI adviser who has become the most quoted critic of this whole arrangement, is also about to join OpenAI. He calls it a de facto involuntary licensing regime built on safety standards nobody has actually written down. The person warning loudest that the rules are vague and the delays could run indefinitely is walking through the same gate he's criticising, into the company currently waiting behind it.
Frontier now means a tier you can't reach
This is the structural shift worth naming. For most of the last three years, "best available model" and "best model that exists" were close enough to the same thing that the gap didn't affect your planning. A new flagship landed, you had an API key within days, maybe weeks if you drew a waitlist.
That gap used to be a queue. Now it's a tier, and which tier you're in has nothing to do with what you're building, what you're willing to pay, or how good your use case is.
Mythos 5 sits with a hundred-odd institutions chosen for reasons nobody outside the room can audit. GPT-5.6's strongest tier sits with partners selected the same way. Gemini 3.5 Pro's delay to July is, for once, an ordinary product story rather than a government one, which only highlights how normal the other two have become.
Read a benchmark post about a frontier model this month and ask a question that didn't use to need asking: is this a model you can actually call, or a model that exists somewhere you don't have a door to.
Build for the tier you're actually in
Stop treating "coming soon" the way you'd treat a delayed product launch. A delayed launch is a date that moves. A gated launch is a door that may or may not open, on a schedule the company shipping it doesn't control and won't promise.
Plan against the model you can call today, not the one in the press release. If your roadmap assumes you'll have GPT-5.6 Sol or full Mythos access by next quarter, you're planning against someone else's government relationship, not a release date.
Treat trusted-partner status as a fact about your organisation, not a feature you can request. If you don't already operate critical infrastructure, or sit inside a list you can't see, there is no application form. Build as though you're not getting in this cycle, and treat it as a bonus if you do.
Watch which capability gets gated, not just which model. The pattern across both labs is identical: the part held back is the part that finds and exploits flaws in code. That tells you more about what's actually changing in these models than any benchmark score does.
The June 12 post ended on the off-switch never being on your side of the glass. Eighteen days later, the same switch turned out to gate both directions: who loses access, and who gets it in the first place. This time, you were never in the room where the guest list got written.