In June, one government’s order turned two of the most capable AI models on Earth dark — for everyone, everywhere — in a matter of hours.
It happened quietly. Commerce directed a leading US AI developer to cut off access to two frontier models for any foreign national, anywhere in the world. But no provider can cleanly sort its users by intent — the criminal and the defender reach the same model through the same interface — so the order couldn’t be surgical. It landed as a global off switch. The models went dark while the company moved to comply and contest at the same time.
This Independence Day, that’s the fact worth sitting with — not because of who pushed the button, but because of what the button reveals about how we’re thinking about AI governance. We’re getting the story wrong, and the wrong story leads to bad decisions.
What actually happened
Two things happened in June, and most coverage blurred them into one.
The first was an executive order on June 2 that was deliberately gentle. It asked the NSA to benchmark the most capable models, invited developers to share those models with the government for up to 30 days before release, and went out of its way to say it created no mandatory licensing and no preclearance. Participation was voluntary. Weeks later, one lab’s flagship model shipped only in coordination with the government — the voluntary path, working as designed.
The second was the off switch — an export-control action that pulled two live models for the entire world. That one wasn’t a request. And that’s the one that should change how a security leader thinks.
The wrong frame
Almost everyone read June as a contest between nations. The US is asserting control over AI. Allies got cut off. Who wins the race, Washington or Beijing?
That framing feels natural, and it’s a trap. It treats AI capability like a strategic weapon to be hoarded behind a border — something you keep on your side of the line and deny to the other side.
But the line doesn’t run where that story says it does.
The right frame
The real contest isn’t country versus country. It’s bad actors versus legitimate business.
Start with how the control actually has to work, because the engineering tells you why the border frame fails. You cannot enforce “no foreign nationals” at an inference endpoint. IP geofencing is defeated by a $5 VPN; truly sorting users by nationality would mean identity-proofing every API call, which no one does and no privacy regime would welcome. The only real control surface a provider has is authentication plus behavioral abuse monitoring — inferring intent from how the model is being used, not from a passport the user never showed. So an order written around nationality can only be honored by the blunt option: pull the model for everybody. The off switch wasn’t a design choice. It was the only switch the architecture exposed.
Now look at who that switch can’t reach. Adversaries do not wait for export approvals. Capable open-weight models — several of them from outside the US — are already published and self-hostable by anyone, anywhere. Once those weights are downloaded, inference runs offline on commodity GPUs: no license check, no telemetry call-home, no remote kill. There is no button to push. A criminal crew or a hostile intelligence service doesn’t need a US lab’s hosted model; it pulls a substitute off a public repository and runs it air-gapped tonight.
So when a single nation flips a switch on a governed commercial model, who actually feels it? Not the bad actors — they’re already loose with tools no one can recall. The people who feel it are the defenders and the legitimate businesses trying to use the best available tools to keep up. And the allies on the same side of the fight, suddenly locked out of capability they were depending on.
That’s the part the nation-versus-nation frame misses entirely. The off switch didn’t slow the adversary. It slowed our own team. The reaction proved it: allies treated the episode as a reason to build their own sovereign AI capacity rather than depend on a supplier that could be switched off, and the expert community split — some pressing Washington to ease controls that hamstring defenders, others urging it to tighten them further. That split is itself the tell. We’re arguing about where to set a gate the adversary already walked around — because the adversary was never inside it.
The part the critics get wrong, too
None of that means “no rules.” The case for guardrails is real, and security leaders should be the last people to wave it away.
These models are genuinely good at offense now. Independent testing shows the latest ones finding previously unknown vulnerabilities in widely used software and devices — real bugs, not theoretical ones. And the technical reason a single “this model is safe” stamp can’t hold is that model guardrails are probabilistic, not deterministic — they lower the rate of unsafe output, they don’t make it impossible, so the picture changes the moment someone finds a new jailbreak.
But look closely at what the capability can and can’t do yet. In controlled evaluations the newest models have gone past bug-finding — discovering novel vulnerabilities, completing multi-step attack sequences, even fully compromising patched systems without human guidance. In the wild, large-scale autonomous attacks are still mostly the simpler kind. The gap between “can do it on a benchmark range” and “does it at scale against your defended estate” is narrowing fast — and it is exactly the gap defenders control. Patch velocity, segmentation, identity hygiene, and detection engineering are what keep the cost of crossing it high. The gating factor is shifting from whether AI can find the way in to whether your environment makes using it expensive.
And the clock matters. Credible voices now put real odds on AI systems that meaningfully accelerate their own development within the next few years — one frontier lab’s co-founder has publicly put the probability of recursive self-improvement around 60% by the end of 2028 — and AI-assisted AI research is already common inside the labs. If that curve holds, the time to establish norms and visibility is while the capability is merely dangerous, not after it starts compounding. Asking for guardrails before that point isn’t censorship. It’s the fire code we’ll wish we’d written.
Where I land
Put the two halves together and the answer isn’t “control AI” or “free AI.” It’s about who sets the rules and how fast the right people can move under them.
We need guardrails — but they have to match the shape of the threat. The threat is global and it’s adversary-versus-defender, so the guardrails have to be global and coordinated too. Picture the US NSA and CISA setting shared benchmarks and shared red lines alongside their allied counterparts — the United Kingdom’s NCSC, Canada’s Canadian Centre for Cyber Security (CCCS), Australia’s ACSC, France’s ANSSI, Germany’s BSI, and the EU’s ENISA — the same way the Five Eyes community already shares threat intelligence. A single country’s switch is the wrong instrument for a borderless problem. It cuts off friends, leaves enemies untouched, and fractures the alliance that’s actually on defense together.
And the guardrails have to move at the speed of the threat. Legitimate businesses and defenders need the latest security and frontier AI tools as fast as they can responsibly get them — because the bad actors already have theirs, and they face no review, no export rule, no 30-day window. A control regime that slows the good guys more than the bad guys isn’t safety. It’s a self-inflicted disadvantage. The voluntary review path points in the right direction; the unilateral off switch points the wrong way.
That’s the verdict: govern frontier AI through coordinated allied guardrails that keep legitimate defenders moving at threat speed — not through one nation’s kill switch that handicaps its own side. Independence, on the Fourth, was never about going it alone. It was about a common cause defended together.
What this means for the operation you’re building
The policy will land where it lands. Your job is to make sure your security operation survives whichever way it breaks — and June taught one durable lesson for anyone wiring AI into the SOC: a frontier model is now a dependency that can vanish. By government order, by exploit, by export rule, by outage. Treat it like one.
Building a SOC that can absorb that disruption is exactly the argument behind the Agentic SOC model — resilience through autonomous, model-agnostic workflows.
Concretely, that means don’t hard-wire your detection, triage, and response to a single external model’s API. Put an abstraction layer — a model router — between your workflows and any one provider, normalize your prompt and response schemas so they aren’t bound to one vendor’s format, and keep a standing evaluation harness that validates a replacement model against your real detection and triage cases before you fail over. That last part is the piece teams skip: models aren’t drop-in equivalents, and detection quality varies measurably between them, so “swappable” only means something if you’re continuously benchmarking the alternates. Underneath all of it, own the layer that doesn’t move — a governed, observable data foundation that holds your data, your detections, and your audit trail. When one model goes dark, you change engines; you don’t lose the SOC.
The operational implications of frontier AI for the SOC go deeper than model portability — here’s the full picture of what changes for defenders.
That same logic is now repricing the market. For two years the security-AI conversation was a horsepower race — whose model scored highest, whose assistant demoed best. June added a new question to every evaluation: what happens to our operation if this provider gets restricted, breached, or switched off? Continuity is a procurement criterion now, not a footnote — expect smart buyers to write model portability, data-ownership, and multi-model support into contracts the way they already do for any critical SaaS dependency. The deeper signal is where durable value sits: when the model itself can be commoditized, restricted, or swapped, the defensible layer is the governed data foundation and the controls around it. “Which model” is the wrong first question. The right one is “what data and governance sit beneath the models” — and that’s the question June answered for us.
The Fourth of July read
Independence isn’t isolation. It’s knowing your dependencies, refusing to be hostage to any single one, and standing with allies against a shared adversary instead of building walls between friends.
A government showed it can turn a model off. The deeper reminder is that the model was never the foundation — it was a tenant. Build the foundation you control. Keep your engines interchangeable. Keep your allies close. And make sure the people writing the rules understand the real fight: not country against country, but all of us against the ones who never asked permission in the first place.
