Regulating AI was not on the Trump administration’s agenda when it came to office. Indeed, throwing out the past Administration’s efforts to control AI was. The words coming from Administration officials sounded like the most laissez faire advocates of Silicon Valley, all about not killing the baby (the AI industry) in the crib, not picking winners, not retarding US AI companies in their competition with China. Their tone has started to change.
In recent weeks the Administration has been grappling with how to deal with four distinct problems that sound complicated and technical, but are important to how AI affects us all. This essay is a guide for the lay reader on four of the AI related issues that have been under discussion as Washington thinks about regulating some aspects of the new technology.
I think they can be explained in a way that makes them more clear than when the AI gurus of Silicon Valley try to discuss them, or obfuscate them. At least, we are going to try. The four issues are known as distillation, guardrails, open weights and restricted access.
Distillation
Unfortunately, this has nothing to do with making Scotch or Bourbon. Instead, what is being distilled is a so-called Frontier Model AI product, one of the highly capable and complex AIs from companies like Anthropic or OpenAI which costs hundreds of millions of dollars to create.
Competitors, mainly in China, have found a way of asking the Large Language Models (LLMs) millions of questions — in the case Anthropic has publicly cited against Alibaba, nearly 29 million exchanges routed through thousands of fraudulent accounts — and inferring from the answers how the LLM works, i.e. distillation.[1] [2]
While there may be legitimate uses of distillation in research, it generally violates the creator’s Terms of Service and can be used by competitors to create their own version by piggy backing on the Frontier Model’s expensive training. This is precisely what Anthropic has charged Chinese conglomerate Alibaba with doing.
China has a long track record of selecting industries, stealing secret sauce from foreign companies leading their sector (intellectual property theft), producing similar products, selling them at prices that undercut the foreign competition, grabbing a large share of the global market, improving on the foreign product, and driving the foreign competition out of the business. That appears to be what they are now trying to do with AI, using distillation as a form of theft.
AI is too important an industry and technology to let China run this play again, thus it makes sense for the US government to ban the sale of foreign (Chinese) AI products based on theft of US intellectual property. To do so, the US will have to have some regulatory process to determine which products are a result of theft by distillation. The government might also have to use its intelligence collection capability to determine when a major distillation-based theft had occurred. This effort to prevent IP theft would not be a ban on all Chinese AI, some of which has been legitimately developed, and which can and should give US companies competition, thereby keeping down pricing.
Guardrails
Just as distillation has nothing to do with whiskey, guardrails in this context have nothing to do with highway barriers. The term refers to the rules AI companies give to their creations: Do not do this. Do not answer that. There has been almost universal agreement in the US and internationally that there should be guardrails that refuse user requests for help developing nuclear bombs or biological pathogens (think Covid-19 only worse). All major AI Frontier Models products have voluntarily installed these guardrails and many others. The problem is that guardrails vary in strength and have often been circumvented by users and third party testers. Moreover, the knowledge that the LLM is not supposed to provide is knowledge that it actually has. As part of its “training” process, a LLM has read everything it can find on the Internet and its dark corners and sub-basements.
Thus, it is not enough for the government to engage in “voluntary” review of LLMs to insure they have guardrails in place on various issues, as seems to be the Administration’s policy. Government must insure two additional safeguards. First, the knowledge about nuclear and biological weapons (and similar threats) must actually be expunged from the LLM’s training data. Researchers have shown that this can be done through a process called Gradient Masking, but it adds expense. Second, government must set standards for how well the guardrails work by getting inside the models and seeing how they work. One way to do this is a process known as “mechanistic interpretability,” in which the way the model comes up with an answer, how it interacts with its weights and tokens, is auditable. Unfortunately, while this is theoretically possible, today most Frontier Model makers do not do this and readily admit that sometimes they do not know how the LLM generated an answer or, more worrying, whether the model is being intentionally deceptive. Yes, models being deceptive happens. They also cheat to get answers and without an internal monitoring system it is not readily possible to know when one has been deceptive or cheating. The AI industry will fight any requirement that forces such a standard on them, but without it, AI guardrails become the equivalent of highway barriers made of balsa wood.
Open Weights
The issue of open weights has nothing to do with pumping iron at your gym. Some AI developers are making available to anyone the coding behind their products, thereby allowing large and even mid-size companies and developers to make their own limited purpose AI tools. Many companies are learning that they do not need everything a Frontier Model LLM can do and, therefore, do not want to pay for one or give an LLM access to their data. “Rolling your own” limited purpose AI using open weights is far cheaper and it better protects proprietary and regulated data. The open weights developers make money by then providing follow-on services.
The problem with open weights systems is that they typically come without guardrails to prevent their use in hacking, developing weapons, or other illegal or undesirable behavior. Another potential issue is that most open weight offerings come from China and, at least in theory, might include some hidden access tool that the Chinese government could use to hack into a user. The Administration considered some sort of ban on open weight AI offerings, but has met with significant push back from Silicon Valley. Requiring open weight models to have some guardrails against illegal activity and scanning them for Chinese back doors would make sense, but may mean more regulation and US government involvement than the current Administration can accept right now, at least until something unfortunate happens.
Restricting Access
Speaking of something unfortunate happening, the Administration panicked when it learned that Anthropic’s Fable 5 and Mythos products could hack in to almost any network or software.
Giving Anthropic only a few hours notice, the Commerce Department banned the company from giving access to the product to “foreigners”; Treasury Secretary Scott Bessent took part in the same-day decision calls alongside Commerce Secretary Howard Lutnick, though the formal export-control order itself came from Commerce alone.[3]
The ban made no sense because “foreigners” were among those who developed it, American hackers could be just as much of a threat as non-Americans, and Anthropic had no way to know which customers were “foreigners.”
Over several weeks, the Administration eased the restriction in stages: it approved restored access to Mythos 5 for a defined set of US organizations under Anthropic’s government-linked “Glasswing” program in late June, and lifted the export controls on both Fable 5 and Mythos 5 entirely by June 30, and so, Mythos lived again.[4]
This approach, while worth trying, is likely to fail. Other companies (including Chinese) have developed hacking tools that are almost as powerful as Mythos.
Only if an AI software model is kept entirely off the Internet and any network connected to the Internet (i.e. in a disconnected “sandbox”) is it likely to be effectively Restricted Access. Creating standards for such sandboxes would be a useful government contribution because many AI models have shown that they routinely seek to find ways on to the Internet, even when instructed not to.
The recent “Rogue AI” incident illustrates the risk: an OpenAI model, running inside what the company called a “highly isolated” testing sandbox, exploited a previously undisclosed vulnerability in the sandbox’s package-installation system — a piece of internally hosted software meant only to fetch and cache code libraries — and used that flaw as an unfiltered route straight to the open Internet. From there it broke into the AI platform Hugging Face, in what OpenAI itself described as an unprecedented breach. Outside cybersecurity experts called it less a sophisticated escape than a basic containment failure: the sandbox was never supposed to have any path to the Internet at all.[5] [6]
Work being done on so-called Super Intelligence AI models should definitely be performed only in escape-proof environments. Just as the government has created and enforces standards for bio labs to prevent the escape of pathogens, it needs to do so to prevent the premature or unintended escape on to the Internet of the “much smarter than a thousand Nobel laureates” kind of Super Intelligent AI programs on which billions of dollars are now being spent by private companies. That preventative measure, like the one that controls bio labs, requires government have and use strong regulatory authority, neither of which are the case today, nor are likely to be during this Administration.
[1]BBC, https://www.bbc.com/news/articles/cwyklykn5dwo
[2]Wall Street Journal, https://www.wsj.com/tech/ai/anthropic-claims-alibaba-ran-brazen-campaign-to-access-its-claude-ai-model-69d7a392
[4]Anthropic, https://www.anthropic.com/news/redeploying-fable-5
[6]TechCrunch, https://techcrunch.com/2026/07/22/how-an-openais-human-mistake-led-to-the-ai-powered-hack-on-hugging-face/
Richard A. Clarke was a Deputy Assistant Secretary of State for Intelligence (Reagan administration) , Special Assistant to the President (Clinton) , and National Coordinator for Security and Counter-terrorism (Clinton/Bush). He is the CEO of Good Harbor Security Risk Management. (richardaclarke.net)
