America Is Exporting AI To Allies: It Needs Rules For Turning Access Off – Analysis

Key Takeaways:

• China’s July 2026 launch of the World Artificial Intelligence Cooperation Organization creates permanent institutional machinery for international AI cooperation, especially with the Global South, while the U.S. still relies mainly on technology export without matching consultation rules.
• The June 2026 Anthropic shutdown, ordered by the U.S. government over a reported safeguard bypass and later partially reversed, showed how a domestic security decision can abruptly cut off allied users of American frontier models.
• Washington needs an Allied Frontier AI Access Compact covering shared risk categories, graduated restrictions, crisis notification, continuity plans and joint evaluation so partners can depend on U.S. systems without exposure to opaque, sudden interruptions.

China has built an institution around AI cooperation. Washington’s June Anthropic shutdown showed that U.S. allies still lack consultation, evidence-sharing, and continuity rules when frontier-model access becomes a security decision.

On July 16, representatives from 29 countries signed the agreement creating the World Artificial Intelligence Cooperation Organization in Shanghai. China is doing something strategically important even after the diplomatic language is stripped away: it is putting permanent institutional machinery around the promise of international AI cooperation.

The United States enters that contest with a different advantage. Washington hosts many of the world’s most capable frontier-model providers, and the White House has made exporting secure, full-stack American AI packages to friends and allies an explicit national policy. Hardware, models, software, applications, cybersecurity measures, financing, and standards are all part of the offer. One question remains unresolved: what happens when Washington decides that a model it encouraged partners to build around must suddenly be restricted?

The answer arrived unexpectedly on June 12. The U.S. government directed Anthropic to suspend foreign-national access to its newest frontier models, Claude Fable 5 and Claude Mythos 5. Anthropic said it had no reliable way to verify nationality in real time, so it disabled both models for all users. The security concern involved a reported method for bypassing a cyber safeguard. The directive immediately turned a domestic security judgment into a cross-border availability shock.

The episode lasted less than three weeks, but the resolution is as important as the shutdown. Anthropic trained a new classifier aimed at the reported bypass, and U.S. government evaluators tested the old and new safeguards. The export controls were lifted on June 30. Fable 5 returned to global users on July 1, while Mythos 5 resumed more narrowly as Anthropic and the government continued work on trusted access. A broad restriction gave way to a more specific technical remedy once the evidence became clearer.

That sequence should matter to every ally considering deep dependence on American frontier models. AI systems are moving into cybersecurity, scientific research, government workflows, intelligence support, defense supply chains, and other functions where availability has strategic consequences. The relevant risk extends beyond whether an American model is safe enough to use. Governments also need to know what happens to their own operations when U.S. authorities decide that access must change.

Washington already recognizes that AI security cooperation has to cross borders. The June National Security Presidential Memorandum 11 directs the State Department to develop a strategy for engaging allies and partners and sharing findings about foreign AI threats. The missing piece concerns American systems themselves: consultation, evidence-sharing, and continuity procedures for allied users when a U.S. security intervention affects access.

China’s new institution raises the strategic cost of leaving that gap open. WAICO presents Beijing as a convener on AI development, governance, and capacity-building, particularly for the Global South. The organization does not guarantee access to China’s most advanced models, and its practical influence will depend on what its members actually build. Its importance at this stage is political. China now has a standing forum through which it can tell partners that AI cooperation has an institutional home.

Washington does not need to copy that model. Its closest partners need something narrower and more operational: an Allied Frontier AI Access Compact covering the circumstances in which security restrictions on frontier models spill across allied borders.

The first element should be a shared risk vocabulary tied to evidence. A narrow safeguard bypass, a capability already available from many models, and a genuinely novel capability with serious strategic consequences should trigger different levels of response. Governments will still disagree, but common categories force the disagreement onto facts that technical agencies can examine.

The second element should be graduated intervention. Security authorities may need to block a capability, restrict a class of users, limit access to vetted institutions, or impose geographic controls. Worldwide suspension should sit at the far end of that ladder and carry a defined review period, an evidentiary basis that can be shared at an appropriate classification level, and conditions for restoring access.

Third, trusted allies need notification channels that work at crisis speed. Urgent action cannot always wait for diplomacy. A designated allied authority can still receive prompt notice of the scope of a restriction and enough information to determine which national systems, contractors, or research programs are exposed. A government should not discover that a strategic dependency has disappeared through a vendor status page.

Fourth, access agreements should include continuity requirements. Critical users need pre-identified alternative models, local fallbacks, degraded operating modes, and data-portability arrangements. This is already a live issue at meaningful scale. Before the June interruption, Anthropic was expanding Project Glasswing to roughly 150 organizations in more than 15 countries. Once trusted-access programs reach governments, banks, laboratories, and critical suppliers, continuity becomes part of national resilience.

Fifth, the compact should connect national evaluation institutions. The technical precedent now exists. In July, the United Kingdom’s AI Security Institute and the U.S. Center for AI Standards and Innovation jointly evaluated China’s Kimi K3 and published both the results and important limits of the test environment. A wider evaluator network involving European, Japanese, Canadian, South Korean, and Australian institutions could give governments an independent evidentiary base before a disputed finding becomes an alliance-wide interruption.

The compact would serve American interests as much as allied ones. The U.S. strategy gains leverage when partners build institutions, applications, and security practices around American technology. Dependence becomes politically fragile when the process governing that dependence is opaque. Governments that cannot plan around access risk will diversify faster, favor open-weight alternatives, require local hosting, or build procurement rules designed to reduce exposure to U.S. providers.

This is where the competition with China becomes more consequential than a contest over model benchmarks. Beijing is building diplomatic machinery around AI cooperation while Washington is exporting a powerful technology stack. The American stack may remain technically superior in many areas. Allied confidence will also depend on whether the rules surrounding access are predictable enough for governments to place critical functions on top of it.

Frontier AI is moving into the same category as other strategic infrastructures whose value depends on more than initial availability. States care about supply assurance, interruption procedures, trusted operators, contingency plans, and restoration after a security event. AI access will acquire the same expectations as dependence deepens.

The June Anthropic episode demonstrated that frontier-model access can become a national security instrument overnight. The July creation of WAICO showed that AI access and cooperation are also becoming tools of diplomacy. The United States now needs to connect those two realities. An allied access compact would give trusted partners a process for consultation, shared evidence, graduated restrictions, continuity, and restoration while preserving Washington’s ability to act when a genuine security threat requires it.

The next phase of AI competition will test which country can make technological dependence strategically manageable for its partners. America already has much of the capability and much of the allied demand. It now needs the institutional layer that makes both durable.