Dangerous Software: Open-Source AI Is About to Wrecked

On Friday, the U.S. government ordered Anthropic to disable Claude Fable 5 and Mythos 5 -- its two most capable models, released the previous Tuesday -- for any foreign national on earth. The directive swept in researchers, customers, journalists, allied governments, and Anthropic's own foreign-national employees. Three days after launch, the most powerful publicly available AI in the world was, by federal command, switched off for most of the planet. Anthropic complied. Then it sued.

This is the cleanest test case the frontier AI debate has ever produced, and it is worth saying out loud what just happened. The government did not regulate a misuse. It did not penalize a sale. It reached into a private company's product surface and toggled access off, on national-security grounds, for everyone outside a citizenship category. The first reaction, in the lab and in Washington both, is that this is what responsible stewardship of dangerous technology looks like: closed weights, controlled API, export-style restrictions on who is allowed to type into the box. That instinct is not crazy. It is the same instinct that gave us classified cryptography in the 1990s, locked nuclear designs in the 1950s, and ITAR-restricted satellite components in the 2000s. Dangerous capabilities exist. Concentrated stewardship buys time.

The problem is that the strategy has an expiration date, and the date is set by the moment the capability stops being a service and starts being a file. Fable lives behind Anthropic's API, which is precisely why the government could throw the kill switch. The next frontier-class model that matters will not. Llama-class weights, DeepSeek-class weights, Qwen-class weights, and whatever ships out of Paris or Abu Dhabi next quarter will sit on Hugging Face, on BitTorrent, on a USB stick in a graduate student's backpack. At that point you are not regulating a company anymore. You are regulating a download. And American law has never figured out how to do that without colliding into the First Amendment at full speed.

Which is why the most important AI regulation story of the next five years is not going to be written in Washington or Brussels. It was written, in rough draft, by a twenty-five-year-old anarchist in Austin in 2013. His name was Cody Wilson, and the thing he understood -- earlier and more clearly than the people now drafting AI export controls -- is that once a sensitive capability is just bytes, the fight over those bytes is the only fight that matters.

The file, not the gun

The real issue in the Wilson case was never the gun. It was the file. In May 2013, a law student in Austin uploaded a small .stl file to the internet. It described the geometry of a single-shot .380 pistol he called the Liberator. Within days it had been downloaded roughly one hundred thousand times. On May 8, the State Department sent Wilson a letter ordering him to take it down, on the theory that posting a CAD file constituted an unauthorized "export of a defense article" under the International Traffic in Arms Regulations. The litigation that followed lasted five years and settled, in July 2018, on terms favorable to Wilson. The federal export-control theory was abandoned. The deeper doctrinal question -- when, if ever, the government may restrict the distribution of functional code -- was left open.

That question now has the most consequential answer in a generation. On February 12, 2026, the Third Circuit decided *Defense Distributed v. Attorney General of New Jersey*. The opinion concerns ghost guns, but its doctrinal weight will land somewhere else. It supplies the legal vocabulary that the next great fight over downloadable software -- open-weight AI models -- will be argued in.

What the Third Circuit actually said

A brief detour into the law, because the doctrine here is the whole ballgame. For roughly twenty-five years, the controlling intuition in U.S. courts has been "code is speech." Two cases set that line. In Bernstein (9th Cir. 1999), an academic cryptographer won the right to publish his encryption source code over the State Department's objection; the court treated the code as protected expression. In Junger (6th Cir. 2000), the Sixth Circuit agreed. Those two opinions are why strong cryptography is now infrastructure rather than contraband, and they are the quiet legal scaffolding the open-source AI community has been standing on without quite realizing it.

The Third Circuit's new decision does not knock that scaffolding down. It saws off one corner of it. Judge Cheryl Krause accepts that some code is protected speech. She then offers a five-factor test to sort the protected from the unprotected, and her key analogy is to aeronautical charts -- functional documents that convey information but are not treated as speech. "Laws that prevent the distribution of destructive viruses or ransomware," she writes, "are not per se unconstitutional on the ground that they infringe upon coders' freedom of expression."

A few caveats are worth flagging before anyone overreads the case. It is a Third Circuit decision, which means it is binding only in Pennsylvania, New Jersey, Delaware, and the Virgin Islands; other circuits could disagree, and the Supreme Court has not weighed in. It is also a ghost gun case, where the regulated artifact is a CAD file whose only realistic use is to manufacture an untraceable firearm. AI model weights are, on their face, more general-purpose -- they write code, translate Sanskrit, summarize MRI reports, and occasionally do things their developers would prefer they did not. A future court could conclude that a foundation model is closer to a textbook than to a virus, and the "code is speech" line would hold.

Still, the direction of travel is unmistakable. For the first time, a federal appeals court has drawn a line inside the category of "code" and said: this side gets the First Amendment; that side does not. Once that line exists, the only remaining question is where future courts choose to draw it. A seventy-billion-parameter weights file, sitting on a server, doing nothing until someone runs it, is exactly the kind of artifact a motivated prosecutor could try to push onto the unprotected side -- closer to a navigational chart, or a virus, than to a poem about a virus. Whether that argument wins is contested. That it can now plausibly be made is not.

The scaffold is already going up

The state has begun building the rest of the scaffold. In January 2025 the Commerce Department's Bureau of Industry and Security published the Framework for Artificial Intelligence Diffusion as an interim final rule, extending the Export Administration Regulations to advanced compute and to a defined class of model artifacts trained on it. Within days, the Chinese laboratory DeepSeek released DeepSeek-R1, which reached the top of consumer app store rankings. In February 2025, Representative Josh Gottheimer and seventeen co-sponsors introduced H.R. 1121, the No DeepSeek on Government Devices Act. In April 2025, the House Select Committee on the Chinese Communist Party issued a report calling for investigations into whether U.S.-controlled chips had trained the model. The Trump administration's BIS suspended enforcement of certain layers of the diffusion rule in May 2025, but preserved and reaffirmed the November 2023 license requirements governing advanced computing exports to Country Group D:5. The NTIA's July 2024 report on dual-use foundation models stopped short of recommending restrictions on open weights, but its framework -- monitor first, restrict later -- left every lever intact for the moment a sufficiently visible incident creates the political demand.

Two lessons from 2013

Two features of the 2013 episode are worth carrying forward, because both will recur.

The first is the futility of upstream restraint. By the time the State Department sent Wilson its letter, the Liberator file had been mirrored on Pirate Bay, on GitHub forks, on Mega, and on private hard drives across at least three dozen jurisdictions. Removal from DEFCAD was, in operational terms, irrelevant. The same dynamic will govern any frontier open-weight release that meaningfully clears the bar of usefulness. Llama-3, DeepSeek-R1, and Qwen-3 have already cleared it. Once a weights file propagates to BitTorrent, regulatory action against the original publisher functions principally as a signaling device.

The second is the migration of enforcement from federal to state forums. After the federal export-control theory faltered in 2018, attorneys general in New Jersey, Washington, and New York built parallel state-level prohibitions on the distribution of digital firearm files, several of which generated the litigation the Third Circuit just resolved. The same pattern will govern open-weight AI. The visible federal debate -- California's vetoed SB 1047, Colorado's Artificial Intelligence Act, the general-purpose model provisions of the EU AI Act -- is consequential but slow. The faster mechanism will be consumer-protection and public-nuisance theories advanced by state attorneys general against U.S. model publishers, on facts that do not require congressional consensus and that can be litigated one defendant at a time.

So what now

Three things follow from all of this, and they are uncomfortable in different directions.

The Wilson analogy is right in structure and wrong in scale. In 2013, the Liberator was a curiosity. The moral panic outran the demonstrable harm by a comfortable margin -- a single-shot plastic pistol was never going to reorder American violence. Frontier open-weight models are different. The December 2025 RAND assessment of foundation models and biological-weapons risk is a real document, with real numbers. So are Anthropic's own Frontier Red Team reports on measurable uplift in biological-threat task performance. The 2013 plaintiffs did not have to argue against a factual record like this. Today's open-weight defenders do. The Fable kill switch and the new biology guardrails on Claude are the closed-model expression of the same pressure that will, sooner than people think, arrive at the open-weight door.

The doctrine is ready to bend. Bernstein and Junger marked the high-water line for unconditional speech protection of functional code. Defense Distributed v. AGNJ is the first appellate decision to give a court a workable way to draw a line inside that category. When the first serious AI-publication case arrives -- an EAR enforcement action against a U.S. publisher, a state attorney general's subpoena targeting a hosted weights file, a tort action against a platform that distributed a model later used in an attack -- the controlling vocabulary will not be "code is speech." It will be Judge Krause's five factors. That is ground a federal prosecutor can plausibly hold, and a thoughtful judge can plausibly bless.

Defenders of open weights need a better argument than the one they have. The 1990s slogan was enough for its era. It is not enough for this one. The defensible position is narrower and harder to articulate, which is part of why it is correct: the public distribution of model weights, like the public distribution of strong cryptography, matters constitutionally because of the capabilities it places in the hands of ordinary people without asking permission. That is the case worth making, and it is not the case being made. The costs of upstream restraint are systemic, durable, and largely invisible. The benefits are episodic, local, and easy to photograph. A regime of selective, jurisdictional, retroactive enforcement against publishers is not a policy. It is a tax on dissent.

Coda

In 2013, Cody Wilson printed a gun on a desktop machine in a rented Austin apartment and watched the State Department try, in real time, to put the file back in the box. They lost. Twelve years later, the box is a Hugging Face repository, the file is a hundred gigabytes of floating-point numbers, and the State Department's modern equivalent is a Friday email to Anthropic. The case Wilson brought has been resolved. The argument he started has not. It has just changed venues -- and the new room is the size of the internet.