The Watch

What Happened

The US Commerce Department has barred foreign-national access to Anthropic's Fable 5 and Mythos models. Separately, the White House revoked SK Telecom's access to Mythos on China-nexus grounds. This sits on top of last week's disclosure that Anthropic placed roughly 6 engineers inside NSA, running Mythos for offensive cyber operations under Project Glasswing.

Models used in classified offensive work are now export-controlled. Most enterprise Claude contracts include the affected families.

Why This Is an Emergency for International Teams

Under the Export Administration Regulations (EAR), granting a foreign national access to controlled technology, including a non-US-person employed by the licensee and working on US soil, is a deemed export. SSO group membership is not a defense in a Commerce audit. The nationality attribute has to come out of HR, into the IdP as a claim, and be enforced at the AI-gateway layer.

If a non-US-person on the engineering team can reach a Claude endpoint that routes to Fable 5 or Mythos, the violation is current, not pending.

Enforcement Reality

The SK Telecom revocation came from the White House, not Commerce staff. That is the signal. Audit scrutiny is a question of months, not years, and multinational engineering teams on Claude enterprise are the obvious first cohort.

What You Need to Do

1. Identify exposure. Confirm whether the Anthropic enterprise contract includes Fable 5 or Mythos. If Anthropic has not sent written notice of which model families are controlled, request it in writing.
2. Wire nationality into access control. Pull the citizenship field from the HRIS (Workday, BambooHR, etc.) into the IdP as a claim. Enforce at the AI gateway or proxy, not at the application, where a developer can route around it.
3. Segment API routing. Where the gateway supports model-level rules, block Fable 5 and Mythos for sessions carrying a non-US-person claim. Route those users to uncontrolled model families only.
4. Document for audit. Commerce auditors want technical enforcement, not policy PDFs. Capture an access-denial screenshot from a test non-US-person account. Retain the gateway logs.

Strategic Implication

Anthropic is no longer a neutral SaaS endpoint. It is a dual-use vendor with models explicitly tasked for offensive operations and sitting under export control. Governance frameworks built on the premise that it is just an API need a rewrite. Expect the same access-control requirement to spread to other providers as more frontier models enter classified programs.

The Shadow AI Agent Problem

The threat this cycle: consumer-grade AI agents entering corporate environments through the same channel shadow SaaS has always used — employee self-service OAuth grants. The difference from a rogue Trello board is scope. An agentic AI with mailbox read/send, calendar write, and Drive access is a data-exfiltration channel wearing a friendly logo.

Six tools named across sources. Two flagged critical because they are agentic — they execute actions without human-in-the-loop approval:

Why This Is Different from Normal Shadow IT

The scope profile requested by agentic AI tools is identical to what APT29-style token theft campaigns go after: mailbox read/send, calendar write, file-store access. The distinction is that employees are granting these scopes voluntarily, from managed accounts, to third parties with no DPA and no SOC 2.

An employee granting Manus broad OAuth scopes from a work account is functionally identical to a successful consent-phishing attack — except the employee did it on purpose.

This connects to last cycle's supply-chain trust theme. GitHub's triage failures meant platform-native signals were insufficient. Employee tool choices mean perimeter controls are insufficient. Same lesson, different layer.

The Structural Fix

Admin consent workflow with default-deny for high-risk scopes is the single highest-ROI control for 2026. M365 supports it. Google Workspace supports it. If it is not enabled, any employee can grant any third-party app any scope, with no security visibility until a log query surfaces it weeks or months later.

Non-technical users now trust agents to execute financial transactions and run workflows autonomously. The trust pattern accelerates as Manus and Claude Cowork improve. The governance window is now, before adoption hits critical mass. After that, the conversation is about clawback, not consent.