Truman Would Have Taken Over AI by Now

Anthropic announced the most powerful cyberweapon ever built last week and kept it, granting access to forty companies while the US government got a press release. Harry Truman, who nationalised atomic research inside three years, would not have stood for it.

Project Glasswing, Anthropic’s cyberdefence initiative, restricts Claude Mythos to a named coalition including AWS, Apple, Google, Microsoft, NVIDIA, and JPMorgan Chase, on the grounds that the model is too dangerous for public release.¹ Mythos finds vulnerabilities in every major operating system and browser autonomously, and in doing so it has already discovered a 27-year-old flaw in OpenBSD, a 16-year-old bug in FFmpeg that five million automated tests had missed, and a chain of Linux kernel vulnerabilities that allowed complete privilege escalation, though the details have held up less well under external scrutiny than they did in the press release. Anthropic holds the knowledge of how to find more, and it has decided who gets access to it.

Eight days later Anthropic shipped Claude Opus 4.7 to everybody else, with the cyber capabilities deliberately reduced during training: same lineage, defanged.² The dangerous version goes to the coalition, the distilled version goes to the paying public, and the gap closes as the capability diffuses. Anyone who read Kokotajlo’s AI 2027 forecast last year is watching it play out on schedule.³

Washington has responded by applying for access. Senator Coons called Project Glasswing “a landmark moment”, Senator Warner urged industry to patch faster, and Treasury Department staff ignored a standing ban on Anthropic products to queue up for Mythos access anyway.⁴ The picture is the same across the Atlantic, where the EU AI Act is in force and the UK AI Security Institute is active, but neither treats Glasswing as a challenge to state authority. Engagement, not confrontation, is the pattern on both sides, and it looks nothing like the response Truman gave to atomic research. He did not ask for a subscription.

Why This Is Not 1945

In August 1939, Albert Einstein signed a letter to President Roosevelt warning that German physicists might be able to build a uranium bomb. The letter had been drafted by Leo Szilard, a Hungarian émigré who had spent years trying to raise the alarm about fission, and carried into the Oval Office that October by an economist named Alexander Sachs. Sachs failed to get Roosevelt’s attention on his first visit, came back the next morning, and read the letter aloud over breakfast. Roosevelt said “this requires action”,⁵ and the Advisory Committee on Uranium was set up within weeks.

The committee moved slowly until Pearl Harbor, after which everything accelerated. The Army Corps of Engineers had the weapons programme by June 1942, and by September the job had a single commander: Brigadier General Leslie Groves, a West Point engineer fresh off supervising the construction of the Pentagon. Groves was given draft authority over American physicists, blank-cheque spending, and the mandate to buy whatever land and materials he needed; he hired Oppenheimer to run the science and bought Oak Ridge and Hanford to run the production. By the time Trinity fired in July 1945, fission research had been inside the federal government for three years, and private actors had never got a chance to hold the keys.

Truman did not have to nationalise anything because everything was already national: the scientists were on government contracts, the plants were government-built, the material was government-owned, and the secrecy was federal law. Atomic energy transferred to civilian control under the McMahon Act of 1946, but the transfer was from one arm of government to another.⁶ Private custody never existed.

AI did not arrive that way.

Fission in 1939 was pre-commercial. Fermi’s pile at Columbia and Szilard’s calculations were academic work, published openly, with no company selling chain reactions to anyone, so when the government stepped in there was no market to displace, no shareholders to compensate, and no proprietary intellectual property to seize. AI is the opposite shape. Anthropic, OpenAI, xAI, Meta, and Google are businesses selling AI as a service, with revenue, customers, and commercial contracts protecting the capability as an asset. Confiscating a market is a far harder act of state power than absorbing a research programme.

Even if the state tried, the capability would not stay put. Nuclear weapons required rare fissile material, centrifuge cascades, and a supply chain you could map, so nationalising the enrichment nationalised the bomb. AI capability lives in model weights, training data, and published research, already diffused across Anthropic, OpenAI, Google, Chinese labs, open-weight projects, and a growing tail of smaller teams. Meta’s Llama weights are public, fine-tuning infrastructure is widely available, and open-weight models will approximate a substantial fraction of Mythos’s capability within eighteen months. Taking over any one lab contains the companies you can reach but not the capability itself.

Nor could the state run the thing if it seized it. Groves commanded Manhattan with unlimited budget, draft authority, and the entire American physics community already mobilised, and the state today has none of those. Frontier AI labs run on research talent the state has not cultivated, compute it does not own, and feedback loops from deployed products it has no experience operating, so taking over Anthropic would mean seizing an entity the government cannot run, staffed by engineers who would leave before the transition completed.

Race dynamics compound the picture: Manhattan was a sprint against Nazi Germany, the AI race is framed the same way against China, but the prevailing Washington view is that private competition is the fastest path to dominance, which makes state consolidation politically impossible in the near term. Dual use compounds it further, since nuclear weapons were bounded between weapons and reactors while AI is bounded by almost nothing, and restricting it means restricting search engines, coding assistants, and every product that processes language, which is less taking over a technology than taking over the economy. AI company chief executives sit in Oval Office meetings, which nuclear physicists in 1942 did not, so policy has been shaped by incumbents from the start.

The Discreditation Makes It Worse

All of this assumes Anthropic’s benchmarks mean what Anthropic says they mean, and in the ten days since the announcement, security researchers have been picking the numbers apart. The headline 72% exploit success rate collapses to roughly 4% once you set aside two now-patched bugs that dominated the sample, on the remaining categories Mythos is not statistically distinguishable from Claude Sonnet 4.6, and many of the most quotable discoveries required full source-code access to open-source projects that Anthropic’s own write-up admits cannot be substantiated publicly.⁷

Mythos is probably less unique than Anthropic said, and the Glasswing coalition is more marketing than containment. That makes the private-frontier problem worse rather than better, because if a previously shipped model could have found most of these vulnerabilities with enough effort, the capability has been in the wild since those models shipped, which is the cleanest possible demonstration that it will not stay put, and that Washington’s instinct to subscribe rather than seize is the equilibrium, not an accident.

Unstable By Design

None of these reasons are permanent, and each has historical precedent for collapsing under sufficient shock.

The crypto wars of the 1990s began when the US government classified strong encryption as a munition under arms export controls.⁸ For eight years, American companies shipped products with deliberately weakened encryption abroad, while the same algorithms were published in books, taught on university courses, and downloaded from foreign servers, until the controls collapsed in 1999 when the Ninth Circuit ruled that source code was protected speech, by which point the capability had escaped. Once political panic sets in, governments restrict private capability regardless of whether the restriction works.

Standard Oil is the antitrust precedent worth watching. Rockefeller built a refining monopoly by 1880, the Sherman Antitrust Act passed in 1890, and the Supreme Court ordered the breakup in 1911, fragmenting Standard Oil into thirty-four companies,⁹ a forty-year gap between private power emerging and state remedy arriving. Anthropic, OpenAI, and Google are a decade into a similar arc, and “break up the AI labs” becomes a mainstream position the first time a frontier model is implicated in something that damages a lot of people.

A major cyber attack traced to leaked model weights would do it, since the core claim of the private frontier is responsible stewardship and a leak refutes that claim in one news cycle. A state actor caught using a US lab’s model against US infrastructure would do it by turning the China story inside out. A foreign acquisition of a struggling frontier lab would do it by crystallising the sovereignty argument more sharply than any white paper. A catastrophic autonomy failure would do it by turning capability questions into safety questions, and the safety question does not respect private-equity timelines. An election-scale AI incident that both major parties agreed had damaged democratic function would do it by creating rare bipartisan alignment on intervention. None of these are black swans, several are already happening at small scale, and any one of them at sufficient scale ends the private-frontier arrangement inside six months.

What Leaders Should Do Now

Make these five moves now. None are expensive, and all are useful even if the takeover moment never comes.

Decouple From The Labs

Write your prompts, evaluations, and orchestration logic so that swapping one frontier lab for another is a configuration change rather than an architecture change, because this is cheap to do now and expensive to do after the fact. The same trap exists at the harness layer. Claude Code, Gemini CLI, and the rest deliver real productivity today, but every team workflow, system prompt, and skill built on top of one vendor’s harness becomes a migration cost the day you need to move, so keep an eye on where the stickiness is accumulating even while you let your teams adopt the tools. The companies inside the Glasswing coalition are building capability on specific access, and they are the ones who get hurt worst if their primary provider is seized, export-controlled, or broken up, so lab-agnostic infrastructure is the cheapest insurance policy on the market.

Keep The Receipts

In a post-takeover world, export controls on training data are plausible, as are domestic provenance rules, particularly if a major incident is traced to scraped personal data or copyrighted material. If you are building on a proprietary model, check the provider’s training-data disclosures against what regulators are already asking for; if you are fine-tuning a model yourself, keep a plain-text manifest alongside the model listing provider, model version, training-data disclosure level, your fine-tuning corpus source and dates, and prompt templates held in version control. A one-page manifest versioned alongside your code, covering every model, version, and dataset touching production, is cheaper to keep current than to reconstruct later.

Draft The Seizure Plan

Your vendor-failure runbook probably already covers Anthropic going down for an afternoon, but almost certainly does not cover Anthropic being taken over, acquired, export-restricted, or forcibly broken up. Write the one-pager this week. Five headings fit on a side of A4: exposed products, graceful-degradation paths, hard-dependency features, the decision owner, and provider alternatives, with one line per product or feature. Date it, park it in the incident playbook next to “what happens if AWS us-east-1 is gone”, and you have what you need for the week the news breaks.

Integrate, Don’t Just Rent

If your product’s competitive advantage depends on having Mythos-class capability routed through a single lab, you are building on unstable ground. The precedent is the app stores and the super-apps, where the value of the distribution channel is set by the platform and the platform owner eventually takes most of the economic surplus back, and proprietary-model moats are particularly fragile because the capability behind them distributes faster than any platform has done before. Build your moat on integration, not access: what you connect the model to, the data you own, the distribution you control.

Audit The Cyber Prompts

If your engineers are using AI to find vulnerabilities in your own stack, you are building exactly the capability that made Mythos too dangerous to release, which is fine for now but first on any future regulatory list. The Glasswing announcement is explicit that Anthropic will gate cyber capability first and most carefully, so assume the state will eventually do the same for everyone else. Keep a log of every AI-assisted vulnerability-hunting prompt that touches your stack, with sensitive context kept out of prompts that go to third parties.

The Bet On The Table

The bet Anthropic and the other frontier labs are making is that no takeover moment arrives before the private equilibrium becomes politically unthinkable to reverse. The economy absorbs the tools, the labs accumulate institutional relationships, and employees and investors and customers become constituencies that make state takeover more expensive than the alternative. History suggests time often is on the side of private capability, since the state reasserts control eventually, as it did with Standard Oil and the East India Company,¹⁰ but eventually can be a long time, and by then the shape of the industry is fixed.

One bad week could end the private equilibrium, whether through a leaked set of weights, a state-actor incident, or a catastrophic autonomy failure, and the crypto wars would play out at national scale. Technical leaders who build as though the private frontier is a permanent feature are exposed to that scenario in a way they do not have to be. Build your AI strategy as though Anthropic loses the bet. If they win, you have paid a little for insurance you did not need and can move more easily to other models. If they do not, you have the runbook.