Encryption, spyware, and now Mythos: History shows why cyber export control doesn’t work

The debate surrounding Anthropic's Mythos cybersecurity model has reignited a decades-long discussion about the effectiveness of export controls on sensitive technology. Historical precedent suggests that restricting the flow of cybersecurity-related software has consistently proven ineffective, raising questions about whether new regulatory approaches can succeed where previous efforts have failed.

Export controls on cybersecurity technology have been implemented since the 1990s, beginning with encryption software restrictions. The Clinton administration's efforts to limit strong encryption exports ultimately failed as researchers published algorithms publicly and open-source alternatives proliferated globally. Similar restrictions on intrusion detection systems and vulnerability research tools followed comparable trajectories—initial restrictions gave way to widespread international availability through decentralized channels.

The pattern repeated with spyware-related technologies. Despite regulatory efforts by multiple nations and international bodies, surveillance tools, penetration testing frameworks, and exploit development kits have continuously spread across borders. Black markets, academic publications, and collaborative open-source communities have consistently circumvented official restrictions, making technology gatekeeping increasingly obsolete.

• Export controls create artificial market barriers that primarily affect legitimate security researchers and companies while leaving determined threat actors with alternative acquisition routes

• Decentralized technology development and open-source models have fundamentally changed how cybersecurity tools spread, making centralized control mechanisms outdated

• Restricting access to defensive cybersecurity tools may paradoxically weaken global security by limiting legitimate professionals' ability to develop and deploy protections

• International coordination remains fragmented, as countries with different strategic interests rarely enforce consistent policies on dual-use technology

• Anthropic's Mythos faces similar control challenges that encryption and other cybersecurity innovations encountered, suggesting comparable enforcement difficulties

As artificial intelligence becomes increasingly integrated into cybersecurity workflows, the export control debate grows more urgent yet simultaneously less viable. The historical record demonstrates that technological restrictions fail when tools serve legitimate defensive purposes and when decentralized alternatives exist. Policymakers must reckon with this reality while developing security frameworks that acknowledge modern distribution channels and international collaboration standards. Without recognizing these patterns, new restrictions risk repeating the failures of the past three decades while potentially hampering beneficial security innovation.