The Watch

What Happened

The US Commerce Department issued an order barring all foreign nationals from accessing Anthropic's Fable 5 and Mythos models. Separately, the White House revoked SK Telecom's access to Mythos, citing China-nexus concerns. This is not a future regulatory risk — it is a same-day access-governance problem for any enterprise running Claude with international engineering teams.

Why This Is Different

Most AI governance discussions are about data classification and prompt-injection risk. This is about deemed-export liability. Under Export Administration Regulations (EAR), providing access to export-controlled technology to a foreign national — even on US soil — constitutes a deemed export. SSO group membership alone will not satisfy a Commerce audit. You need the nationality attribute wired from your HR system into SSO claims, enforced at the AI-gateway layer.

SSO group membership alone won't satisfy a Commerce audit — you need HR-system nationality attributes enforced at the AI-gateway layer before your next compliance review.

The Structural Problem

Enterprise AI gateway architectures were not designed with nationality-based access controls in mind. Most organizations route Claude API calls through a shared service principal or API key, with authorization handled at the application layer by role. That architecture is blind to nationality and therefore blind to deemed-export obligations.

Who Is Exposed

• Any organization with foreign-national engineers using Claude via enterprise contract
• Managed service providers with offshore development teams
• Companies that granted broad Claude access during the initial rollout and never segmented by model

Cross-Source Context

This development sits alongside the broader pattern of AI vendor platform trust erosion identified over the past week. Previously, Anthropic was a neutral SaaS endpoint. Now it carries export-control classification that makes its API a regulated technology — not just a productivity tool. Combined with last week's suspected cross-tenant output exposure during an Anthropic outage, the trust model for Claude in regulated environments is being renegotiated in real time.

Immediate Response Framework

1. Identify affected models. Confirm whether your enterprise contract provides access to Fable 5 or Mythos specifically, or whether you are on a lower-tier model unaffected by the order.
2. Map foreign-national exposure. Pull HR data for nationality attributes across teams with Claude access. This is not optional — it is the same diligence you would apply to ITAR-controlled data.
3. Wire nationality claims into enforcement. Add nationality as an SSO claim attribute and enforce model-level access policies at your AI gateway or proxy.
4. Document for audit. Commerce audits are retrospective. Even if you fix the gap today, document the window of potential non-compliance and your remediation timeline.

The New Shadow IT Vector

Both sources this week land on the same finding. Consumer AI agents are entering corporate environments through the shadow-IT side door, with employees authenticating these agents against corporate accounts outside procurement review and without a DPA in place. Six agents are named across today's intelligence:

Why This Matters More Than Typical Shadow IT

The agentic tools, Manus and Claude Cowork, are not SaaS apps that read data. They act. To be useful, they need OAuth scopes: mailbox read/send, calendar write, Drive access. That scope profile is what APT29-style token-theft campaigns target. Once an employee grants a third-party agent broad scopes from a personal account that bridges into work data, the enforcement boundary belongs to a startup's security posture.

An agent with delegated OAuth access to mail, files, or calendars is a data egress path that requests the same scopes nation-state token-theft campaigns target.

Jamie's Invisible Recording Problem

Jamie warrants separate attention. It captures meeting audio and generates transcripts without placing a visible bot in the meeting. Zoom and Teams recording governance relies on visible participant indicators, so it is bypassed. Compliance reviews scanning for recording artifacts in the platform will find nothing.

Cross-Source Pattern

One source names these tools from a consumer-productivity lens. The other frames them inside the broader supply-chain trust collapse, where single platforms (GitHub, Anthropic, npm) can no longer be treated as neutral infrastructure. The convergence: OAuth governance is the single highest-ROI security control for 2025-2026. It addresses shadow AI agent sprawl and agentic permission creep in one motion. The token-theft surface shrinks as a consequence.

Response Priority

1. Admin consent workflow with default-deny for high-risk scopes in M365 and Google Workspace, where not already active. This is the single control that addresses the entire class.
2. OAuth grant logs pulled for the past 90 days. Mature shops are flagging any third-party app with mailbox, calendar, or Drive write scopes that did not pass procurement.
3. All six named tools on CASB/SSPM watchlists. The open question is whether any are already pulling data from sanctioned tenants.
4. Legal briefed on Jamie's invisible-recording capability for jurisdictions with two-party consent requirements.