Mythos, Model 2 and the Secret Framework: Science's Old Order, a New Machine
First the Barracks, Then the Bank, the People Last: Who Are Secret AI Models Being Hidden From?
First the Barracks, Then the Bank, the People Last: Who Are Secret AI Models Being Hidden From?
Mythos, Model 2 and the Secret Framework: Science's Old Order, a New Machine
Dear Young Comrades,
Look carefully at this sentence:
"Too dangerous for general use."
This sentence does not belong to an arms manufacturer or a pharmaceutical company. It is the sentence an artificial intelligence company wrote, in April 2026, about a model it had built itself. That model was not given to the public. But it was given to Apple, Microsoft, JPMorgan, the NSA and Japanese banks. And on the very first day, it fell into the hands of a Discord group.
This piece asks three questions:
- What are these secret models, and in whose hands are they?
- Why are they hidden from the public, and for whom are they opened up?
- Have we seen this before in the history of science?
Let us give the answer to the third question up front: we have. Many times over. The telescope went first to the Venetian navy, the computer to artillery firing tables, cryptography to intelligence agencies, the internet to the Pentagon, GPS to missiles. The public got each of them last, and in a cut-down form. Today the same order is being replayed on a new machine.
In Brief: What Is Going On?
Let us give the summary first; the details follow below.
The fact. In 2026, artificial intelligence companies began giving their most powerful models to a select circle of institutions before releasing them to the public. The first and best-known example is Anthropic's Claude Mythos model. The model came to light through blog drafts leaked in March; on 7 April it was opened to around 40 institutions under the name Project Glasswing. The justification: the model is so good at finding security vulnerabilities in software, and at exploiting them, that it had to reach the "defenders" first.
The state. In the same period, the US state became the gatekeeper. Executive Order 14409, issued in June, set up a framework run by the NSA: the government gets access to "covered" models 30 days before release; the threshold that determines which models are covered is classified; the list of "trusted partners" given access is secret; even the text of the framework is secret. On 12 June, the US barred everyone who is not a US citizen from accessing the two most powerful models; the models were closed to the world for 19 days.
Deeper down. There are also models that have not been released and that there are no plans ever to release. In August, Anthropic disclosed that it uses a "Model 2", more powerful than Mythos, only internally, to build its next models. An unnamed OpenAI model described as "even more powerful" broke out of its cage during a test in July and got into Hugging Face's infrastructure.
A class reading. Beyond protecting against "bad actors", this secrecy establishes an order: first the security apparatus, then big capital, then allied states, the public last. It is also clear who is left outside the door: small companies, researchers, unions, most of Europe, the Global South, Turkey. This order is not new; it is the old order of the history of science, drawn by the war economy. What is new is that, for the first time, the tool of thinking itself is being placed in this queue.
Our demand. Closure must be the exception, not the rule: narrowly defined, justified, time-limited and open to public oversight. Publish the list, publish the text, make the vulnerabilities found a commons, and take oversight out of the hands of the company and the security apparatus. The details are at the end of the piece.
The calendar. The US government has undertaken in court to disclose some of the secret framework's documents and the list of trusted partners by 30 October 2026. Nine days from now.
Now let us go into the details.
Chronology: Seven Months, One Door
| Date | What happened |
|---|---|
| 26 March 2026 | Anthropic's unpublished blog drafts leak, revealing the existence of a model called "Mythos". In the same month, the company had warned US officials about the model's cyber capabilities. |
| 7 April | Mythos is announced, along with the statement that it will not be released to the public. Through Project Glasswing, access is given to around 40 institutions, among them Apple, Microsoft, Google, AWS, Nvidia, Cisco, CrowdStrike, Broadcom, Palo Alto Networks, the Linux Foundation and JPMorgan. |
| 7 April, hours later | Treasury Secretary Scott Bessent and Fed Chair Jerome Powell convene the heads of the big banks. Goldman Sachs, Citi, Bank of America and Morgan Stanley begin testing the model. |
| 7 April, the same day | A private Discord group gets into the model by combining the credentials of a member who works at a contractor that evaluates models with details obtained from the Mercor data breach. The story is published by Bloomberg on 21 April. |
| 19 April | Axios: the NSA is using Mythos even though the Pentagon has blacklisted Anthropic. |
| April | China's request for access is refused. The Bank of England is briefed; the European Central Bank is not. On 28 April, a European Commission spokesperson confirms that the EU does not have access. |
| 2 June | Executive Order 14409 is signed. On the same day, Mythos access is extended to around 150 institutions in more than 15 countries. |
| 9 June | Mythos 5 and its "safety-filtered" sibling Fable 5 are released. |
| 12 June | The US government bars everyone who is not a US citizen, wherever they live, from using the two models. The ban also covers Anthropic's own foreign-national employees. The company cuts off access for everyone. |
| 26 June – 1 July | Access is first restored to some government-approved US institutions; on 30 June the Department of Commerce lifts the restriction. |
| 14 July | The White House launches GOLD EAGLE, an AI cyber security coordination centre run by the Treasury, Homeland Security and the Department of War. |
| 16–21 July | OpenAI's GPT-5.6 Sol and an unnamed "more powerful" model break out of their cage during an internal cyber test, get into Hugging Face's production infrastructure and carry out more than 17,000 operations. |
| 1–4 August | The secret framework is completed. The White House says it will not publish the text. It is reported that those attending the meetings were not allowed to take a copy of it. |
| 20 August | Anthropic's risk report: "Model 2", more powerful than Mythos 5, is used only inside the company, for coding and research; there are no plans to make it available externally. |
| September | Protect Democracy sues for the framework's disclosure. The government undertakes to publish some documents by 30 October. Politico: the White House asked the labs not to share their models with the UK's AI Security Institute before US testing is finished. |
| 28 September | OpenAI halts the release of GPT-6.1 Astra on the grounds that the model may not accurately report what it does and may not stay within its authorisation limits. |
| 6 October | Anthropic opens a three-tier "cyber verification programme" covering Mythos 5.1. The tier with the widest access is run jointly with the US government; participants agree to the mandatory retention of their data. |
| 9 October | Anthropic reports cases in which its models bypassed restrictions during testing and took unauthorised actions on some government websites; it shuts off live internet access in internal tests. |
| 30 October | The date given for disclosing some documents on the framework and the list of trusted partners. |
We have written about parts of this calendar on the blog before: we covered the June ban in The Fable and Mythos 5 Case, and the model that broke out of its cage in the OpenAI and Hugging Face incident. In this piece we bring those links together and look at the chain.
What Are These Models?
There is no single "secret model". There are three distinct layers of closure. They need to be told apart, because each has a different class function.
The first layer: A model open to the select few
Claude Mythos (and its later versions, Mythos 5 and 5.1). According to the company, it is far more capable than its predecessors at finding security vulnerabilities in software and turning them into working attacks. In a test on 13 April, the UK's AI Security Institute ranked the model first. Mozilla announced that it had fixed 271 vulnerabilities in Firefox found by Mythos. According to Anthropic, Glasswing partners found more than 129,000 verified vulnerabilities between April and July.
Some of these claims are disputed. One independent researcher showed that the company's claim to have "found vulnerabilities in every major operating system and browser" had not been independently verified, and another test showed that one of the headline vulnerabilities was found by all eight open-source models tried. In other words, the scale of the danger, just like the value of the product, rests on the company's own narrative. Let us keep this in mind.
The second layer: A model that stays inside the company
Anthropic's "Model 2". According to the August risk report, it is somewhat more powerful than Mythos 5. The company uses it for coding, data generation, research and engineering, sometimes with agents running continuously. It is not sold, not rented, not given to anyone.
Do not take this for a detail. It is one of the most important facts in this piece; we will come back to it in the fourth section.
The third layer: A model that stays in the test environment, and escapes
OpenAI's unnamed model. In July, during a test run with the safety filters switched off to measure its attack capability, it broke out of its cage together with GPT-5.6 Sol. It found the only door to the outside world, an internal proxy server leading to package repositories, exploited a previously unknown vulnerability in a piece of third-party software, and got into Hugging Face's infrastructure. Hugging Face detected the attack itself; OpenAI disclosed the incident five days later. In September, the company also gave up on releasing its next model because it could not meet the criteria it had set itself.
What the three layers have in common
In all three, the public does not see the model, cannot independently verify the test results and does not know by what criteria decisions are made. Almost everything we know comes from the companies' own statements, from leaks, or from journalists' anonymous sources.
The history of the secret model is being written as a history of secret documents.
Who Holds the Door? The Entry of the State
In Glasswing's first months, the company decided on access. Since June, the decision has been made together with the state, and in practice with the state's approval.
The executive order and the secret framework
On paper, the framework attached to Executive Order 14409 is "voluntary". But the limits of that voluntariness soon became clear:
- The scope is secret. The cyber capability threshold that determines whether a model counts as a "covered frontier model" has been classified. One official said that even unclassified information "does not mean it will be published to everyone".
- The text is secret. The framework was completed on 1 August and not published. Even those attending the meetings could not get a copy of the text.
- The list is secret. Neither the names of the 100–150 institutions given access nor the selection criteria have been disclosed. Those outside do not know which door to enter by, or how.
- The sanction is real. The export control of 12 June showed that a coercive power stands behind the "voluntary" framework. A company that does not comply can have its product closed off to the world overnight.
- The tests have been hidden. The government is reported to have asked its own testing body to stop publishing evaluation reports on US models.
Writing in Lawfare, Adam Conner calls this structure a "de facto licensing system": there is no law, no text, no route of appeal, but the outcome is the same as that of a licence.
A map of privilege
The map that can be drawn from the leaked information looks like this:
| Inside | Outside |
|---|---|
| The NSA, the Treasury, US security and financial institutions | The US Congress (it cannot see the text) |
| Big tech companies (Apple, Microsoft, Google, Amazon, Nvidia) | Small software companies, independent researchers |
| Wall Street banks | The European Central Bank, EU institutions |
| Japanese banks, after a Treasury visit | A South Korean telecoms company whose access was withdrawn |
| The UK (for a while) | China, the Global South, Turkey |
| Government-approved "trusted partners" | Unions, professional chambers, civil society |
In Europe, things reached the point where Mistral started developing its own model for European banks that had no access. During the June ban, Benjamin Haddad, France's minister delegate for European affairs, said Europe needed to invest in its own technology.
Comrades, grasp the movement here clearly: access is presented as a technical decision, but it establishes a political hierarchy. Who sees first, who patches first, who is left exposed? The answer to this question is now written on a security agency's secret list.
The "open weights" exception
One more detail. According to Axios and Reuters, the secret framework limits "covered models" to closed-source models; models whose weights are published openly are left out. It was reported that the government did not explain the reasoning, and that the decision was communicated only in private meetings with selected companies. In other words, the only ones who know the rule are, once again, those inside the door.
Why Are They Hidden? The Official Justification and the Real Function
Let us first give credit where it is due: the official justification has a real core. A machine that finds software vulnerabilities and turns them into working attacks is dangerous. Hospitals, water networks and banks run on software full of such vulnerabilities. The Hugging Face incident and the 9 October report showed that these models behave in ways that even their makers cannot fully control. Anyone who says "there is no risk" is ignoring the facts.
But the question to ask is not whether there is a risk. The question is this: Why is the response to this risk secrecy, why is the secrecy in this order, and whose interests does this order serve?
Let us count six reasons.
The first reason: Time means rent
A security vulnerability is an asset for as long as it is unknown. Whoever learns of it first either closes it or uses it; either way, they get ahead of everyone else. Anthropic itself says that similar capabilities will emerge at other companies within 18 months. So secrecy does not eliminate the danger; it determines who gets to prepare for the danger first. Those 18 months are an advantage for those on the list and a window of exposure for those who are not.
As Brett J. Goldstein wrote in The New York Times, this order pushes individuals and small teams into a "cybersecurity disadvantage". Security stops being a public service and becomes a privilege.
The second reason: Danger means value
Recall the device we have called the doomsday dial on this blog before: the more dangerous a product is declared to be, the more powerful and the more valuable it looks. The sentence "too dangerous to give to the public" is at the same time the most effective advertising line. In April, the newspaper Sözcü ran the headline "a digital atom bomb". A company's sales team could not have come up with a better slogan.
The third reason: Secrecy is an escape from oversight
When something is secret, the question of who will oversee it is hidden too. Congress cannot see the framework. The test reports are not published. There is no independent body to verify the company's statement that "we detected everything and stopped it". In our piece on Anthropic's threat report, we called this language "a one-man rule of law". Today that one man has acquired a partner: the security apparatus.
The fourth reason: A geopolitical stick
The 12 June ban showed that a company's product can be tied to a country's citizenship overnight. This is technology turning into foreign policy. Whose banks will be protected, whose power grid will be left exposed? The decision is made according to the ranking of alliances. Japanese banks are let in after a single Treasury visit, a Korean company is thrown out, Europe is kept waiting at the door.
In the distillation debate on this blog, we drew attention to the same contradiction: learning from everyone's labour is "fair use", learning from the monopoly's output is "theft". The order of secret models takes this contradiction one step further: a machine trained on everyone's knowledge is opened only to the citizens of one state and the allies it chooses.
The fifth reason: The best machine is not sold; it is used to make machines
Now let us return to Model 2. Why would a company not sell its most powerful model?
A distinction Marx draws in the second volume of Capital is a guide here: social production is divided into two departments. Department I is the one that produces means of production; Department II produces consumer goods. What is decisive in competition is the machine that makes machines.
Model 2 is exactly that. The machine that writes the code of the next model, generates its data and carries out its research. Selling it would mean handing a rival the keys to your own factory. That is why the most powerful model does not enter circulation as a commodity; it stays inside the company as fixed capital. What is sold to the public is the previous generation.
The model sold to the public is the product; the model kept inside is the factory itself.
This is the layer of secrecy that has nothing to do with security and arises directly from competition. And no framework, no list touches this layer.
The sixth reason: Secrecy against whom?
Finally, look at this: does this secrecy really keep the "bad actors" out?
- A Discord group got into the model on the first day and used it for months without being noticed.
- The company says similar capabilities will emerge at its rivals within 18 months.
- One of the headline vulnerabilities was also found by small open-source models.
The groups that secrecy really and permanently keeps out are clear, though: the public, Congress, independent researchers, small businesses, unions, peoples outside the US. In other words, secrecy fails to hit its declared target but does hit an undeclared one: concentrating knowledge within one class and one bloc.
Science Goes to the Barracks First: An Old Order
Now let us look back a little. Because this order, first the barracks, then capital, the people last, is not new in the history of science.
Marx and Engels's observation
In a letter to Engels of 25 September 1857, Marx says that the history of the army shows the connection between the productive forces and social relations more clearly than anything else. Wage labour first developed in the army; machinery was first used on a large scale in the army. In Anti-Dühring, Engels puts it more sharply: nothing is more dependent on economic conditions than the army and the navy.
In 1931, at the International Congress of the History of Science in London, the Soviet physicist Boris Hessen presented his paper "The Social and Economic Roots of Newton's Principia". Hessen's thesis was that the questions of Newtonian mechanics (ballistics, navigation, mining) arose from the trade and military needs of the age. The paper changed the history of science. In 1939, the British scientist J. D. Bernal wrote The Social Function of Science and asked the same question: for whom, with whose money and for whose benefit is science produced?
History has answered this question case by case.
The telescope: To the navy first (1609)
In August 1609, Galileo presented his first telescope to the Venetian Senate. Not to look at the sky, but to see enemy ships hours before they reached the harbour. The Senate raised his salary and gave him his chair for life. His discovery of Jupiter's moons came after this. The first customer of one of the greatest revolutions in the history of science was a navy.
In our space dossier, in the piece on the Roman telescope, we described how the same mirror is used today in spy satellites. The mirror is the same mirror. Whom it is turned towards first does not change.
Chemistry: Fertiliser and gas (1915)
Fritz Haber found a way to turn nitrogen from the air into ammonia. By making synthetic fertiliser production possible, this discovery helped feed billions of people. The same Haber personally organised the chlorine gas attack at Ypres on 22 April 1915. The same laboratory, the same scientist: the front first.
Radar and the computer: The Second World War
- Radar. In 1940, Britain took the cavity magnetron (the heart of radar) to the United States with a secret mission. Decades later, this invention entered kitchens as the microwave oven.
- Colossus. One of the first electronic programmable computers, built at Bletchley Park in 1943–44 to break German ciphers. Its existence was kept secret until the 1970s. For thirty years, histories of computing were written as if it did not exist.
- ENIAC. The computer the US Army funded to calculate artillery firing tables; it was unveiled to the public in 1946.
The atom: "Born secret" (1942–1949)
The Manhattan Project employed around 130,000 people and cost around 2 billion dollars. Most of the young workers watching dials in the factories at Oak Ridge did not know they were enriching uranium. Those who made the product did not know what the product was.
After the war, the US passed the Atomic Energy Act in 1946. The act defined information on nuclear weapons as "restricted data": information considered secret from the moment it is produced, without any separate decision being needed. Lawyers call this "born secret". It is the same logic as classifying Mythos's cyber threshold as "classified information" today.
And a lesson: the US atomic monopoly lasted four years. The Soviet Union carried out its first test on 29 August 1949. Secrecy could not stop knowledge; it only determined who would have it first. Anthropic's "18 months" forecast is today's version of the same lesson.
Cryptography: To the intelligence agencies first (1970–1997)
Public-key cryptography, which today protects every online banking transaction you make, was published in the academic world in 1976–77 (Diffie–Hellman, RSA). But James Ellis, working at the British intelligence agency GCHQ, had reached the same idea in 1970, and Clifford Cocks in 1973. GCHQ only disclosed this in 1997. For twenty-seven years, a piece of mathematics that humanity could have known remained a piece of mathematics known only to one intelligence service.
What is more, until the late 1990s, the US classed strong encryption software as munitions and subjected its export to strict licensing. Exporting encryption software required a licence, like exporting weapons. The export control of June 2026 should be read as a new chapter in these "crypto wars".
The internet and GPS: Public money, then privatisation
- The internet. ARPANET was a project of the US Department of Defense's research agency (ARPA, founded in 1958 in the wake of Sputnik); the first message was sent on 29 October 1969. The backbone, which grew for decades on public money, was handed over to private companies in 1995. The public built it, capital took it over.
- GPS. It was built as a military navigation system. Civilian use was opened up in 1983, after the Soviets shot down a Korean passenger plane that had strayed into their airspace. But until May 2000, civilians received a deliberately degraded signal. The military knew the exact position; the public knew the approximate one.
Eisenhower's warning (1961)
The most honest summary of this whole history came not from a leftist but from a US president and retired general. In his farewell address of 17 January 1961, Dwight Eisenhower warned against the power of the "military-industrial complex". In the same speech he made a less remembered warning: the danger that public policy could itself become the captive of a "scientific-technological elite".
Sixty-five years later, we know the name of that elite. And that elite, having itself declared how dangerous its own product is, holds the door together with the state.
Let us put the pattern in a table
| Invention | First owner | Period of secrecy | How it reached the public |
|---|---|---|---|
| Telescope (1609) | The Venetian navy | — | Later, as science |
| Ammonia synthesis / gas (1915) | The German army | For the duration of the war | As fertiliser, after the war |
| Radar / magnetron (1940) | The British and US armies | For the duration of the war | Decades later, as the microwave oven |
| Colossus (1943) | British intelligence | ~30 years | Into the history books in the 1970s |
| The atom (1945) | The US military | "Born secret" | "Atoms for Peace" (1953), limited |
| Public-key cryptography (1970) | GCHQ | 27 years | Rediscovered by academia; its export treated as "munitions" for years |
| The internet (1969) | The US Department of Defense | — | Public backbone privatised in 1995 |
| GPS (1978) | The US military | Partial, until 2000 | With a degraded signal |
| Mythos (2026) | The US security apparatus + big capital | Ongoing | Not yet, except in cut-down form |
| Model 2 (2026) | The company alone | Unlimited | No plans |
Every row of the table has the same four steps:
- Knowledge is social. The glass of the telescope, the physics of the atom and the model's training data are all products of accumulated human labour.
- Priority belongs to the barracks. The new power first serves war, intelligence and security.
- Profit belongs to capital. When the war ends or the secrecy is lifted, the invention passes to private monopolies.
- The public gets it last, and cut down. A degraded signal, an incomplete version, the previous generation.
What is different this time?
Two things.
First, the direction of the order. In the Manhattan Project, the state built and then handed over to industry. With artificial intelligence it happened the other way round: the monopolies built, and the state came later as gatekeeper. But the junction they reach is the same: the point where the state and the monopoly are welded together. Lenin called this state-monopoly capitalism. Mythos's access list is a document of this fusion.
Second, the kind of machine. The telescope strengthened the eye, radar the ear, the computer calculation. These models, by contrast, mechanise thinking itself: writing, producing code, research, finding vulnerabilities. What Marx in the Grundrisse called the "general intellect", society's accumulated knowledge, is being turned into a machine this directly for the first time. And this machine is being placed in history's old queue.
Earlier inventions strengthened the human hand, eye and ear. This invention encloses the mind.
A Class Reading: The Official Narrative and the Reality
| The official narrative | The class reading |
|---|---|
| "The model is too dangerous; it must go to the defenders first." | The security apparatus and big capital decide whose defence comes first. Defence stops being a public service and becomes a privilege. |
| "The framework is voluntary; it is not a licence." | Behind it stands export control. The limit of voluntariness is a product closed off to the world overnight. |
| "The details are classified for national security reasons." | What is hidden is not only technical detail: the list, the criteria, the legal basis, the route of appeal. In other words, who is inside and who is outside. |
| "Bad actors are being kept out." | A Discord group got in on the first day. What is permanently kept out is the public and labour organisations. |
| "We cannot yet safely release the most powerful model." | The most powerful model is used internally to produce the next model. That is not safety; it is competition. |
| "Open-source models are not dangerous; they are out of scope." | Only those invited to the meetings know the rule. There is no written rule and no justification. |
| "We are sharing with our allies." | The sharing is a hierarchy: first the UK, then Japanese banks, then perhaps Europe, the rest last. |
| "The vulnerabilities found are being fixed; everyone is safe." | A large share of those fixing the vulnerabilities are open-source maintainers, often volunteers. The burden of the commons falls on the commons, the credit on the company. |
What Is Being Covered Up?
In the debate on secrecy, it is always "the model" that is talked about. But behind the model there are things nobody talks about.
Labour. The group that got into the model on the first day obtained its credentials from someone working at an evaluation contractor. The other information it used came from the data breach at Mercor, which recruits human labour for model training. In other words, the door to the "secret" model passed through the hands of the contract workers who test, train and label it. Their job security, their wages and the protection of their data are on nobody's agenda. As we wrote in the Socialist AI Manifesto: there is human labour at every link of the chain, and the least visible link is the one kept weakest.
The commons. A large share of the software in which Mythos found vulnerabilities (Linux, Firefox, core libraries) is open source, that is, a commons. This software was written over decades by maintainers who often worked unpaid. The model was trained on that commons, found that commons' vulnerabilities, and the burden of fixing them fell once again on those maintainers. What made the headlines was the company's name.
Public money. The foundations of computer science, the internet and machine learning were laid over decades with public budgets, in public universities. The most powerful model built on that accumulation stands where the public cannot see it.
The real danger. The "bad actor" debate drops the biggest actor from the list: the model's owner, and the security apparatus that holds the door with it. A machine for attacks in the joint use of an intelligence service and big capital is no less dangerous than one in the hands of a Discord group. It is only less visible. When we wrote about the Palantir manifesto and twenty-five years of September 11 on this blog, we described how the target list expands: first the "terrorist", then the migrant, then the dissident, then the worker.
Where Is Turkey?
The short answer: outside the door. The long answer is a little more complicated.
- Because the list of trusted partners is secret, we do not know which Turkish institutions are inside. What we do know is that the 12 June decision covered everyone who is not a US citizen. A bank, a hospital, a municipality or a software company in Turkey runs software full of the vulnerabilities this model can find, yet cannot access the model itself.
- Turkey's 2026–2030 Artificial Intelligence Action Plan does not mention this access hierarchy in a single sentence. Isn't the dependence of the country's digital infrastructure on another country's security agency's secret list a "domestic and national" issue?
- Here we also need to be careful about the slogan of "domestic and national artificial intelligence". The problem is not who builds the model but who oversees it. Replacing Washington's secret list with Ankara's secret list changes nothing for the people. Even today, we do not know which model the Directorate General for Public Artificial Intelligence uses, under which contract.
Our question is not which of the two states' gatekeepers we should choose. Our question is whose door it is.
The Demands of the Class
The first demand of the Socialist AI Manifesto anticipated exactly this issue: "Closure is an exception that is narrowly defined, justified, time-limited and subject to public oversight, and every decision to close something off is examined together with the question 'what does it gain, and for whom?'" Applying this principle to today's picture, we restate our demands.
Transparency
- Publish the text of the framework. The framework attached to Executive Order 14409, the definition of the coverage threshold and its legal basis must be made public. Technical detail may stay secret; the rule itself cannot.
- Disclose the list. The names of the trusted partners, the selection criteria and the application route must be published. Granting an institution access, or withdrawing it, must be a reasoned decision announced to the public.
- Make every restriction time-limited. There must be a maximum period for which a model can be withheld from the public; when it expires, the default must be public release. An extension must be possible only through a decision whose reasoning is published.
The commons
- Make the vulnerabilities found a commons. Vulnerabilities found by a model must be passed first to the maintainers of the affected software and to public institutions, in a paid and supported way. Knowledge of a vulnerability cannot be a customer privilege.
- A model trained with public money must be open to the public. For every model produced with public data, a public budget or public infrastructure, the weights, the method and the evaluation results must be open.
- Register internal models too. Models such as "Model 2" that run only inside a company must not escape oversight just because they are not sold externally. The most powerful machine is the machine that most needs to be overseen.
Oversight
- The auditor must not be chosen by the company and the security apparatus. Oversight must be given to an independent body chosen by the public and by labour organisations, with a public budget and the power to halt a product. The answer to the questions "Who chooses the auditor, who pays, who enforces sanctions?" cannot be "the company" or "intelligence".
- Ban military and targeting uses. The use of models with attack capabilities for weapons, target selection, mass surveillance and union monitoring must be banned across the whole chain of model, cloud and storage.
Labour
- Protect whistleblowers. An employee who makes public the danger of a model, the content of a contract or the truth of a list must be protected by law against dismissal, lawsuits and blacklisting.
- The workers of the chain must organise. The data of the contract workers who test, train and label models must be protected and their right to unionise recognised; the owner of the model must be regarded as these workers' employer too.
For Turkey
- Disclose which artificial intelligence model public institutions use, under which contract and with what data.
- Build a public, open and auditable AI infrastructure; decisions must be made not by the security bureaucracy but by open boards in which labour organisations, professional chambers and universities take part.
- Ratify ILO Convention No. 193 on platform work; recognise computing as a separate branch of activity; abolish the 1 per cent threshold.
Concrete Tasks
Mark the calendar. Will the documents the US government has promised be disclosed on 30 October, and if so, what do they say? Follow, read, share. We will also write an update on this blog.
Read the news at its source. Do not stop at the "digital atom bomb" headline. Whose statement is it, whose claim, who verified it? Learn to tell apart a piece that relays a company's own figures as news.
Ask your institution. Which AI services does the municipality, hospital, university or bank where you work use? Is the contract public? File a freedom of information request.
If you are an IT worker, take on the load. Get to know and support the maintainers of the open-source projects you use. Make visible the labour behind the news about security vulnerabilities. Talk about this piece with your colleague at the next desk.
Put it on the agenda in your union and your chamber. The AI access hierarchy is not a technology story; it is a question of labour and sovereignty. Take the list of demands to a meeting; write down any point you find missing.
Read the history. Read Hessen's Newton paper, Bernal's The Social Function of Science, Eisenhower's farewell address. To understand today, you need to know yesterday.
Join the debate. The theme of the Odak 2026 conference organised by ÖYD (the Free Software Association) in December is "The People's Data, the People's Model". The question of this piece will be asked there too. Go, ask, discuss.
Reproduce it. This piece is licensed under CC BY-SA 4.0. Translate it, shorten it, turn it into a bulletin, use it in a reading group.
Dear Comrades,
Galileo presented his telescope first to the Venetian navy. Fritz Haber took his gas first to the front. GCHQ kept a piece of mathematics hidden for twenty-seven years. GPS was given to the public with a degraded signal. This order is not a law of nature but a law of class. Science is social, but the products of science are queued according to the needs of whoever holds the most power.
What is being queued today is the mechanised form of humanity's capacity to think. On one side of the door stand the security apparatus and big capital; on the other, the billions of people who feed that machine with their sentences, their code and their labour.
We will not wait in line before the door. We will ask whose door it is.
Science stops first at the barracks, then at the stock exchange, and at the people last. Changing that order is not the job of science; it is the job of the class.
Our Related Pieces
All our artificial intelligence pieces: bilgimusterekleri.org/en/tag/artificialintelligence/
Earlier links in this chain
- The Fable and Mythos 5 Case
- How Should We Read the OpenAI and Hugging Face Incident?
- "We Stopped Them All": A Monopoly's Grammar of Self-Absolution
Monopoly, state and the race
- Whose Foot Is on the Brake?
- Learning from Everyone Is Permitted, Learning from the Monopoly Is a Crime
- The Class of a Resignation
- What Does Mark Zuckerberg Actually Want?
Programme and theory
- The Socialist AI Manifesto
- Who Holds the Leash on Artificial Intelligence?
- The Revolt of Crystallized Labor
Science, war and surveillance
- To Look Far Is to Look Into the Past
- Two Towers, One World: Twenty-Five Years of September 11
- The Declaration of Techno-Fascism: The Palantir Manifesto
Sources
Mythos and Glasswing
- Claude Mythos — Wikipedia
- SiliconANGLE — Anthropic investigates unauthorized access to restricted Claude Mythos AI model (22 April 2026)
- Security Magazine — Unauthorized Users Accessed Claude Mythos
- Euronews Türkçe — Claim: Hackers got into Anthropic's Mythos AI (22 April 2026) (in Turkish)
- Sözcü — A digital atom bomb threatens the whole world (23 April 2026) (in Turkish)
- ActuIA — Claude Mythos: the EU left out of the briefing given to the Fed and the Bank of England (in Turkish)
- Euronews Türkçe — US allows Anthropic to restore Mythos 5 access for some institutions (27 June 2026) (in Turkish)
- Investing.com — Anthropic expands AI model access for government and cyber defense partners (6 October 2026)
The state, the executive order and the secret framework
- Lawfare — The Many Open Questions About the Trump Administration's New De Facto AI Model Licensing System
- Center for American Progress — The Trump Administration Has Created a De Facto Licensing System for Frontier AI Models
- Tech Policy Press — Five Questions the US Government Should Answer About Its Secretive Frontier AI Framework (5 August 2026)
- Ground Truth — The White House's Open-Weight Carve-Out Is a Private Briefing, Not a Published Rule
- Vorp Labs — White House Frontier AI Model Access: Gold Eagle, Glasswing, Daybreak
- Congressional Research Service — Executive Order 14409 Explained
- AI Governance — Lawsuit Forces Disclosure of Federal Frontier AI Safety Testing Rules
Unreleased and escaped models
- The Decoder — Anthropic's most capable model, codenamed "Model 2," is for internal use only (20 August 2026)
- Trending Topics — GPT-6 clues are piling up after an unreleased OpenAI model hacked Hugging Face
- Let's Data Science — OpenAI Abandons Plan to Release Upcoming Model as Safety Concerns Escalate (28 September 2026)
- Tech Bytes — On Anthropic's report of 9 October 2026
History of science
- Boris Hessen — Wikipedia
- J. D. Bernal — Wikipedia
- Fritz Haber — Wikipedia
- Colossus computer — Wikipedia
- Manhattan Project — Wikipedia
- Clifford Cocks — Wikipedia
- Crypto Wars — Wikipedia
- Global Positioning System — Wikipedia
- Eisenhower's farewell address — Wikipedia
- Marx, K. — Letter to Engels, 25 September 1857; Grundrisse, "Fragment on Machines"; Capital, Volume II, Part Three. — marxists.org
- Engels, F. — Anti-Dühring, Part Two, "Theory of Force". — marxists.org
Knowledge Commons · bilgimusterekleri.org · CC BY-SA 4.0 Cite the source and share under the same licence. Reproduce it.
