Ankara confronts NATO's new AI-gatekeeping problem
Frontier AI that can break into classified systems within hours is now US supplied and US gated, and the 7 8 July Ankara summit is the first forum where allies have to say so in person.
Frontier AI that can break into classified systems within hours is now US supplied and US gated, and the 7 8 July Ankara summit is the first forum where allies have to say so in person.
On 30 June the Trump administration ended an 18-day export-control blackout on Anthropic's Claude Fable 5 and Mythos 5. Washington now controls both sides of NATO's frontier-AI problem: it decides which models leave the country and which allied organizations get to use them. The NATO summit in Ankara on 7-8 July is the first public forum where allied governments have to face that fact together.
Federal safety testing had put Anthropic's most cyber-capable models through classified cyber-defense evaluations, with global release following the political pressure that triggered the testing, Ars Technica reported. In parallel, Washington expanded Project Glasswing, the controlled-access channel that lets vetted allied organizations run US frontier models under written terms, to roughly 150 organizations across more than 15 countries, including EU institutions. On 22-23 June, the Five Eyes intelligence partnership issued a rare joint statement warning that AI-enabled cyber attacks on governments and businesses capable of causing severe damage are only months away, with a separate warning on the same threat echoed by the Guardian's coverage of the Five Eyes language.
That threat clock is what makes the chokepoint consequential. NSA and CISA have been testing Anthropic's Claude Mythos, a model that surfaced vulnerabilities in classified US systems within hours during a government test, as the Associated Press and a subsequent Mythos-focused write-up both confirmed. The capability is real, and access is rationed by Washington alone. Estonia's cyber ambassador Helen Popp has been the most explicit allied voice in the Politico-led reporting, telling Politico that NATO has to adapt to the AI threat landscape, and arguing that capabilities available to adversaries should reach allies who move first.
The mechanism behind that rationing has no clean NATO analog. Export controls decide which models leave the country; Project Glasswing decides which allied organizations get access, on what terms, and when. Both processes run inside the US government without external accountability. Within roughly three weeks, those policy tracks moved in opposite directions: controls tightened, then loosened, while Glasswing quietly expanded. Three different access statuses for the same frontier models inside roughly three weeks is the operating reality. No allied government can plan a procurement calendar around a model whose US availability is set by domestic politics rather than treaty.
Europe is responding in two directions that point the same way. EU institutions have openly demanded access to US frontier models, with only a few countries, including the UK, initially allowed to run evaluations, while individual capitals are accelerating independent defense-AI capacity of their own. According to a PIIE analysis, ad hoc US export controls on AI models risk fragmenting the allied ecosystem and pushing partners toward sovereign alternatives that Beijing can then exploit. OpenAI's latest release has likewise been limited by the White House to a small group of approved US firms, extending the gatekeeping role beyond Anthropic.
The Ankara agenda reflects the discomfort. AI and cyber will get only brief mentions in the closing statement. Former NATO cyber policy lead Heli Tiirmaa-Klaar predicted to Politico that allies will avoid formal discussion on any topic that lacks consensus, pushing the real conversation into the margins. That is why the meeting matters: not because Ankara decides who gets the model, but because it is the first time the alliance has to negotiate, in one room, a frontier capability it depends on Washington to provide and to police.
The watch item on 7 July is whether any ally gets a stable written access term out of the corridor talks, and whether the closing statement narrows that gap or papers over it. The next test of the template is the 30 June export-control lift rolling over into routine ally access by the time the summit ends.