The Board Room

What Changed This Week

The United States crossed a line it had been walking toward for three years. The White House directly ordered Anthropic to revoke SK Telecom's access to Claude Mythos, and the Commerce Department then barred all foreign nationals from accessing Fable 5 and Mythos. This is not a chip restriction. It is model-level, name-level, population-category-level control applied to software, at a specificity that has no prior example.

Export controls moved from the silicon layer to the inference layer. Access to frontier AI is now an instrument of trade policy, not just industrial policy.

Why This Is Qualitatively Different

Chip controls restricted supply. Organizations adapted by stockpiling, pre-ordering, or shifting to alternative architectures. Model-level revocation removes access to production infrastructure without notice. There is no stockpiling a cloud API. If a product depends on a frontier model served from a US provider, and a customer, partner, or engineering team sits in a covered category, access can vanish between one API call and the next.

The Bifurcation Thesis

A reasonable skeptic would say one week of policy does not make a regime. The reasonable skeptic is correct about the week and wrong about the trajectory. Both intelligence streams converge on the same structural conclusion. A bifurcated AI ecosystem is forming, with US-accessible frontier models on one side and everything else on the other. Open-weight models and local inference moved this week from research curiosity to strategic hedge.

The Architecture Decision

The immediate compliance question is straightforward. The question is which international teams, partners, and customers are currently running on frontier models that could be revoked. The three-year question is harder. The choice is whether to architect for a world where model access is stable, or one where it can be revoked by a policy change. The answer determines whether multi-model portability, edge inference, and open-weight fallbacks belong in the stack as production paths rather than experiments.

Cross-Source Pattern

This export control escalation arrives in the same week as GitHub's supply chain trust failure and physical infrastructure constraints. The convergence is not coincidental. It points at the systemic cost of concentration. One code platform handles most of the world's source. A short list of cloud AI providers handles most of the inference. Memory supply concentrates in a single region. Each was defensible in isolation. The combination was not, and this week made it impossible to dismiss.

The Pattern

Three independent events landed in the same week. The useful reading is not three separate risk stories. It is one story about what concentration costs when multiple failure modes activate at once.

• Code hosting: GitHub dismissed two vulnerability reports from Deep Specter researchers. Those vulnerabilities are now being actively exploited by the Shai-Hulud supply-chain worm, compromising hundreds of packages and developer accounts.
• Model access: Frontier AI model access is now revocable by executive order without notice.
• Physical infrastructure: A RAM shortage is driving Apple price increases, Seattle has imposed a unanimous 1-year data center moratorium, and Amazon has published defensive water claims.

Concentration was the right call for the last decade because the platforms were faster, cheaper, and better. That tradeoff has not reversed. It has acquired a tail in which a worm, a regulator, and a commodity cycle can each independently take a quarter off the roadmap.

GitHub's Trust Deficit Is New Information

We covered the Miasma worm in Microsoft repos last week. Shai-Hulud is a distinct escalation. GitHub's own disclosure process dismissed the two reports that became the exploit. The operative question is the second-order one. If triage produced this outcome on two documented reports, the count of other dismissed reports already in attacker hands is the unknown that matters. The platform responsible for code provenance is the platform that failed to prioritize its own security disclosures.

The Infrastructure Budget Problem

Tim Cook publicly confirmed what procurement teams already suspected: global RAM shortages are driving real price increases at the consumer level, which puts enterprise memory pricing on the same curve. Seattle's unanimous moratorium signals that community resistance is no longer a NIMBY nuisance. It is a capacity constraint. Amazon's defensive water-efficiency publication two days later confirms the industry reads this as a sustained political problem, not a one-city anomaly.

What This Means for 2027 Planning

A reasonable skeptic would point out that one bad week does not invalidate three years of planning assumptions. The skeptic is correct that no single event does. The complete reading is that most 2027 infrastructure decks assume stable memory pricing, available capacity in preferred metros, and uninterrupted access to current model providers. All three assumptions are now questionable. Organizations that re-forecast now have 18 months to adjust. Organizations that wait will find the gap in quarterly actuals.