Access Denied Is Not a Moat

On June 12, 2026, Anthropic said the U.S. government had directed it to suspend access to Fable 5 and Mythos 5 for all foreign nationals, including foreign-national Anthropic employees[1].¹1.Anthropic's announcement uses the legal category "foreign national," not the casual phrase "non-American." The distinction matters because the directive applied even to foreign-national Anthropic employees inside the company. It also means the category can catch people who are obviously central to the U.S. AI ecosystem. On X, commentators pointed to Andrej Karpathy, a Slovak-Canadian AI researcher who had joined Anthropic, as an example of someone who could be covered by the rule if he is not a U.S. citizen.

This incident differs from Anthropic's own commercial access decisions. The immediate order came from the government, not from Anthropic's product team. But Anthropic invited this reading: it has proactively shaped the narrative and the belief that frontier AI advantage can, and should, be protected by controlling access.

To be clear, "moat" is not Anthropic's slogan. It is my reading of what this strategy is trying to do. The target is the strategic premise underneath its public argument: that controlling access to models, chips, and the American AI stack can preserve a lead long enough to create safety, leverage, and better terms of engagement.

Anthropic has argued that a neck-and-neck U.S.-China AI race would make safety and governance harder[2][3]²2.Anthropic's own phrasing is: "A neck-and-neck race between American and Chinese AI labs could make industry and government-led safety and governance efforts more difficult, and less likely.". It has argued for maintaining and strengthening export controls on advanced semiconductors[4][5]. It has also restricted access to Claude in cases where competitors allegedly used the model in ways that violated its terms.

The hardline position is not baseless. Claude has been genuinely strong in coding and agentic workflows. Anthropic helped define important pieces of the agent ecosystem, including the Model Context Protocol and Skills[6][7]. Claude Code was the coding-agent product to beat. If you believe frontier AI is a short-window national-security race, and if you believe your lead is one of the few things preventing the world from breaking, then access control becomes tempting.

But that logic does not create a moat. At most, it creates delay. Sometimes it does something worse: it helps rivals see the cost of dependence faster. Access denial does not freeze competitors in place. It turns replacement from an optional roadmap item into a strategic emergency.

The Model Access Lesson

The clearest version of the pattern appeared in coding models.

OpenAI had proved the basic promise of code-specialized models early. Its Codex research was published in July 2021, describing a GPT model fine-tuned on public GitHub code[8]. But after that, OpenAI's public product center of gravity did not stay on coding. Anthropic kept pressing on that line, and Claude Code and Claude's API became the coding models many developers trusted most.

WIRED later reported that Anthropic revoked OpenAI's Claude API access, saying OpenAI had violated Anthropic's terms of service while using Claude ahead of GPT-5[9]. Reporting also indicated that xAI staff had been using Anthropic models through Cursor until that access was cut off[10]. That does not prove any particular cutoff directly produced any particular model. But the situation is more serious than ordinary replacement: once access becomes unreliable, self-reliance and self-sufficiency become urgent strategic priorities.

Still, the strategic lesson is obvious enough. As long as a rival depends on you, you can still shape its choices. Price, speed, terms, and availability are all forms of leverage. Once you cut that dependence, the rival's goal becomes much simpler: escape you as quickly as possible.

OpenAI's modern Codex is the proof. Codex returned in 2025 as a cloud-based software engineering agent, then evolved into GPT-5-Codex and later GPT-5.3-Codex, a model OpenAI described as the most capable agentic coding model it had released to date[11][12][13].

That comeback did not stop at GPT-5.3-Codex. OpenAI later made GPT-5.5 the default starting point for most Codex tasks, describing it as its strongest option for complex coding, computer use, knowledge work, and research workflows[14][15]. More importantly, user reception no longer supports the story that Claude owns an unreachable coding lead[16][17][18].³3.In the linked discussions, Codex users describe GPT-5.5 as a strong default for real coding work, while Claude users complain about Opus token burn, latency, hanging sessions, instability, and regressions. The Business Insider piece reports the same backlash around Opus 4.7. That is the reversal: the company that lagged in coding agents now has a coding model users love, while Anthropic's lead no longer looks uncontested.

Anthropic did not single-handedly create OpenAI's coding push. The point is that OpenAI had been visibly slow to return to coding. After proving the category with the original Codex, it let the public Codex API fade out and only returned with a cloud software-engineering agent in 2025. In the meantime, Anthropic had made coding one of Claude's central identities for a long stretch: from the upgraded Claude 3.5 Sonnet era that many users treated as "Sonnet 3.6," through Claude 3.7 Sonnet and Claude Code, and later through Sonnet 4.6 and Opus 4.6[19][20][21][22]. My hypothesis is that the cutoff did not create OpenAI's replacement plan from nothing, but it likely shortened OpenAI's reaction time. We do not need to prove that the cutoff was the only cause to see how it could become strategically self-defeating. If it turns a postponable internal project into an urgent dependency problem, the backlash has already begun.

As long as the dependency exists, so does the leverage. Once the dependency is cut, the leverage starts burning down.

The Stack-Independence Lesson

The same pattern appears at national scale, but the mechanism is more complicated than any slogan.

Anthropic's export-control argument is that compute advantage matters. If advanced chips are necessary for frontier training, then limiting access to those chips can slow an adversary and preserve a democratic lead. This is the cleanest version of the case, and it has real force. Chips are physical. Supply chains are observable. Export controls can bite in a way that model-output secrecy often cannot.

But even here, denial has a second-order effect: it helps substitution gather consensus. The hard question is not whether export controls create friction. They do. The hard question is whether the friction preserves dependence or accelerates independence.

Jensen Huang has been unusually blunt on this point. He argued in 2025 that U.S. chip export controls had failed by giving Chinese firms "the spirit, the energy and the government support" to accelerate domestic development[23][24]. In a later interview, he pushed a related argument: if the next few years are critical, the United States should want the world's AI development to happen on the American technology stack[25].⁴4.Huang's point is about dependency as the practical form of U.S. leadership. Leadership lives not only in chip shipments, but in CUDA, libraries, developer habits, vendor relationships, and the decision to stay on the American stack instead of building around it.

That distinction matters because dependence is a system property, not a shipment count. If Chinese labs can buy Nvidia chips, they remain tied to the American stack: GPUs, CUDA, libraries, debugging tools, deployment assumptions, vendor relationships, and the tacit knowledge around all of it. If they are denied those chips, the whole industrial system gets a different instruction: make the denied path less important.

The DeepSeek-Huawei story shows both sides of this. First, the friction is real. Earlier reporting said DeepSeek tried to train R2 on Huawei's Ascend chips and hit problems with stability, interconnect, and the software stack. It fell back to Nvidia for training and kept Ascend only for inference[26]. Then the picture changed. Newer reports say a Huawei-linked team completed full-parameter post-training of DeepSeek's 1.6-trillion-parameter V4-Pro on more than a thousand Ascend 910C chips, and that V4-Pro was built around Ascend from the start[27].⁵5.This was full-parameter post-training, not frontier pre-training from scratch. Its significance is that Ascend is moving from inference and experiments into training-class workloads that once looked out of reach. This does not mean Ascend has fully replaced Nvidia. It means substitution is no longer theoretical.

Huawei is making the same point at the infrastructure layer. Its Ascend roadmap promises the 950DT in late 2026 for training and inference, the 960 in late 2027 with double the computing power, memory bandwidth, memory capacity, and interconnect ports of the 950 generation, and the 970 in late 2028 with another intended jump[28].⁶6.The roadmap matters as a coordination signal. Customers, labs, ministries, and suppliers can plan around the promised Ascend generations even before every chip ships at scale.

This is why the access-control question cannot stop at "did the policy slow training this year?" It has to ask a harder question: did the policy preserve long-term dependence on the American stack, or did it help turn stack independence into a national industrial priority?

The model layer points in the same direction. DeepSeek released R1 in January 2025 with open model weights and a permissive license for broad use[29][30]. Stanford HAI later described Chinese open-weight models, including Qwen and DeepSeek, as globally significant and widely adopted[31]. Hugging Face's 2026 report similarly described a rapidly growing open-weight and open-source model ecosystem, with Chinese models accounting for a large share of recent download activity[32].⁷7.Stanford HAI says Chinese open-weight LLMs "seem to have caught up or even pulled ahead" in capabilities and adoption. Hugging Face's report says China surpassed the U.S. in monthly and overall downloads, with Chinese models accounting for a plurality, 41%, of downloads.

Dario Amodei's counterargument is serious: DeepSeek does not show controls are useless; it shows that controls need to be stronger and better enforced, especially at the scale of millions of chips[33].

But the open-weight wave does prove something else: capabilities do not stay bottled up just because a gatekeeper wants them to. Z.ai's GLM-5.2 is the newest exhibit. Z.ai describes it as a long-horizon, coding-oriented, MIT-licensed open model with a 1M-token context window[34]. Artificial Analysis ranked GLM-5.2 as the leading open-weight model on its Intelligence Index and effectively level with GPT-5.5 on GDPval-AA v2[35]. Arena reported that GLM-5.2 Max ranked number two in Code Arena: Frontend, behind only Fable 5 and ahead of Claude Opus 4.7 Thinking[36]. Then Z.ai founder Jie Tang replied to Elon Musk's estimate of how long a Chinese Fable-class model would take by saying it "won't take that long"[37].

Together, those signals weaken the moat logic. A frontier lead can be real and still temporary. A model can be closed and still teach the market what is possible. A constrained country can still discover efficiency paths unconstrained competitors did not prioritize. That is the core mistake in treating access denial as durable leverage: it assumes the denied party will stand still. In reality, denial changes the denied party.

The Finite-Game Fallacy

The access-control strategy makes the most sense if AI is a finite race: one lab or one country crosses the line, gets far enough ahead, and then negotiates from a position no one else can challenge.

The strongest version of this story is recursive self-improvement, or RSI. If the first lab to build a system capable of materially accelerating AI research can use that system to build the next one, then the lead might compound. Compute advantage becomes model advantage. Model advantage becomes research advantage. Research advantage becomes a bigger model advantage. In that world, crossing the bar could create an expanding gap rather than a temporary lead.

That is a powerful vision. It may even be true. The question is not whether compounding is possible. The question is whether everyone else will peacefully behave as though Anthropic, or any one lab, should be allowed to compound first. Anthropic's public policy paper points in this direction when it argues that a 12-24 month lead by 2028 would be enormously advantageous, would help democracies avoid a destabilizing neck-and-neck race, and would make engagement with Chinese AI experts more likely to succeed[2]. It also argues that compute advantage can compound into algorithmic advantage and then into a durable AI lead. This is the real steelman: if RSI is close, then a small lead is not small. It is the seed of a much larger lead.

But the political conclusion does not follow. If everyone believes the first actor across the line gets a compounding advantage, why would everyone else calmly allow that actor to cross? Why would China accept it? Why would open-weight labs accept it? Why would other U.S. labs accept it? The closer the prize looks to recursive self-improvement, the less likely rivals are to treat access denial as a reason to slow down. They will treat it as proof that the window is closing.

This is the Cold War lesson. If one side describes the race as existential, builds controls to preserve a lead, and says it will talk seriously after that lead is comfortable, the other side does not hear "safety." It hears "arms race." The promise of later conversation can easily become the reason everyone accelerates now.

The last few years of AI have not looked like winner-take-all.

OpenAI looked untouchable after ChatGPT. Google caught up faster than many people expected. Anthropic looked dominant in coding. OpenAI came back with Codex. Chinese open-weight models looked like a sideshow until they were suddenly central to the global model ecosystem. The pattern is not permanent dominance. The pattern is leap, panic, imitation, compression, and leap again. History is not moving in a flat circle; it is spiraling upward. Each round of catch-up raises the baseline for the next round of competition.

There are two reasons this keeps happening.

First, the follower's job is easier than the pioneer's. The pioneer must prove that a path exists. The follower gets to run down a path whose existence has already been demonstrated. Once the market knows that coding agents matter, every serious lab can justify spending on coding agents. Once the market knows that reasoning traces excite users, every serious lab can test the same surface. And once the market knows that smaller, cheaper, good-enough open models can win adoption, the denied party has another route out of dependence: it does not need to beat the frontier model everywhere to make the gatekeeper less necessary.

Second, information flows too quickly. Researchers move. Engineers talk. Users compare. Benchmarks leak signal even when model weights do not. Papers omit details but reveal enough. Product behavior teaches competitors what users value. The secret is rarely a single secret. It is a bundle of decisions, and enough of those decisions become legible through use.

This is why a one-year lead should not be confused with ownership of the future. A lead is useful. A lead can matter. A lead can give time. But a lead is not a crossing bar where the winner gets to rest.

Time For What?

The more defensible case for access denial is not that denial creates a permanent moat. Anthropic does not need to claim that. What it can really defend is simpler: denial buys time.

Fine. Then the decisive question is: time for what?

If the answer is safety, then denial alone is insufficient. Safety requires coordination, evaluations, incident reporting, standards, and some level of mutual visibility. You do not get those by teaching every rival that your platform can disappear the moment politics or competition turns against them.

If the answer is standards, denial is self-defeating. Standards win by adoption. MCP became important because it was useful across the ecosystem, not because Anthropic kept it behind a wall. The more a standard becomes a shared substrate, the more leverage its originator has. The more it becomes a permissioned club, the more rivals are pushed to build substitutes.

If the answer is negotiation, denial poisons the table. A dependency can create leverage, but leverage has to be spent carefully. If the other side believes you will use access as a weapon whenever the balance shifts, it will treat independence as the first condition of negotiation.

If the answer is commercial runway, then say that plainly. There is nothing mysterious about wanting more time to monetize a lead. But commercial runway is not the same argument as safety. It should not be smuggled into the moral language of global governance.

The contradiction is that many of the stated reasons for access denial require cooperation, while access denial teaches everyone to reduce cooperation. It buys time in the currency of competition while claiming to spend that time on goals denominated in trust.

Start The Conversation Early

Anthropic's fear of a reckless race is not imaginary. A world where every frontier lab and every major country rushes deployment because it is afraid of falling behind is a bad world. The company is right to worry about that.

But if your solution to a race is to wait until you are comfortably ahead before you sit down with everyone else, you are not really proposing a conversation. You are waiting for surrender.

This is where Anthropic's own "neck-and-neck race" sentence deserves to be revisited. The company says such a race would make safety and governance efforts harder. But in the same public argument, the practical prescription is not to begin with dialogue. It is to restrict compute, restrict model access, close loopholes, deter distillation, export the American stack, and then engage from a position of overwhelming advantage[2]. That may be a coherent theory of leverage. It is not yet evidence of a serious attempt at conversation.

That is the missing empirical step. Anthropic's essay gives many reasons to distrust the CCP, and some of those reasons are real. But it slides too easily from distrust of a political system to the presumption that Chinese AI practitioners, policy researchers, and frontier labs are not available for meaningful safety dialogue. I do not see that established in the public record. If the claim is that conversation will fail unless the United States first obtains a commanding lead, then the burden is to show that the other side has explicitly rejected conversation, not merely that the other side is strategically competitive.

No serious competitor accepts that. No serious country accepts that. Certainly China will not accept it. OpenAI will not accept it either. Nor will xAI, Google, Meta, Mistral, DeepSeek, Qwen, or the next lab that discovers it can win adoption by being cheaper, open, or merely good enough.

Access denial can be a tactic. It can slow. It can punish. It can protect a narrow entry point for a while. In some cases, it may even be justified.

But it is not a moat.

A moat makes dependence durable. Access denial teaches the dependent party to escape. A moat preserves leverage. Access denial spends leverage. A moat gives you time to build trust. Access denial tells everyone watching that trust is dangerous.

If Anthropic wants the world to coordinate before the race becomes uncontrollable, it should start the conversation while it still has real technical credibility and real ecosystem influence. Waiting for a comfortable lead is waiting for a world that will not arrive.

The moat is already melting. The only question is whether the trust melts first.