Beyond the Model: The Zero-Day Problem
A standalone chapter of Beyond the Model: How Legal AI Got Smart
Cooper sent the policy draft to the AI Ethics Subcommittee at 5:14 on Friday afternoon. He’d promised it by Friday, and he’d only gone over the official close of business time by a few minutes. The draft did exactly what he and Nora had agreed it would. It distinguished Covered Models from standard models. It explained, in language an associate could understand without a glossary, that “Claude” was no longer one product with one data posture, and that the model you chose determined the retention profile you were living with. Fable 5 and Mythos 5: internal use only. Opus 4.8 and Sonnet 4.8: approved for client work, zero data retention intact. He attached the usage guide Jesse had built and added a note asking the subcommittee to review before next Friday.
He closed the laptop, poured the first glass of wine he’d allowed himself all week, and was three sips into the feeling of having finished something when his phone buzzed.
It was Nora.
Fable 5 is down. Not an outage. Read this before you do anything else.
A link followed. Then a second text, faster than the first: This is not a data retention problem. This is something else.
Cooper set the wine down.
The link was a statement from Anthropic, posted minutes earlier. He read it twice.
The U.S. government had issued an export-control directive, citing national security authorities. It suspended all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States. That included foreign nationals employed by Anthropic itself. The company said it had received the directive that afternoon at 5:21 Eastern, and that the only way to comply on the timeline demanded was to disable both models for everyone, immediately, while it sought clarification.
Not throttled. Not restricted to domestic accounts. Off. For every customer, in every jurisdiction, on every surface, all at once.
He called Nora. She picked up before the first ring finished.
“You read it.”
“I read it. Get everyone on a call. Tonight.”
“Already sent the invite. Jesse’s in. Maya’s driving home, she’ll dial in from the car. I texted Arthur but I didn’t expect—”
“He’ll be there,” Cooper said. “He reads everything.”
They came up as tiles. No one was in the office. It was Friday night, and for the first time since they’d started holding these meetings, the Governance Committee room on twelve sat empty while five rectangles assembled themselves on a screen in Cooper’s home office. Nora, sharp-edged even on video. Jesse with a different browser open than the one from Tuesday, the Anthropic statement on one side, a developer forum melting down on the other. Maya, parked in a driveway, dome light on. And in the corner, the study, the bookshelves, the reading lamp. Arthur, who said nothing yet, but was there.
“Okay,” Cooper said. “Three days ago we spent an hour deciding how to use this model responsibly. Tonight it doesn’t exist. I want to understand what actually happened before we decide what it means for us. Jesse.”
Jesse set his coffee down. It was wine for everyone else by now; he still had coffee. “Let me separate what’s technically happening from what it sounds like, because the headline is going to be wrong by morning.”
“That’s the same thing you said Tuesday,” Maya said.
“It was true Tuesday too.” He turned to read from his screen. “The government’s stated concern is a security vulnerability in the model. The reporting tonight is that researchers at Amazon found a way to get Fable to produce things it’s supposed to refuse. The technique is almost stupid. If you ask the model to review code for security issues, it refuses, because it’s trained to be careful about anything that looks like offensive security. But if you hand it the same code and just say ‘fix this code,’ it fixes it. Patches the vulnerabilities. Three words.”
“That’s the national security threat?” Maya said. “Fixing code?”
“The threat is what sits underneath it. Mythos, the bigger model Fable is built on, can do more than fix one file. It can find vulnerabilities, chain them together, and work through an attack end to end without a human steering each step. The ‘fix this code’ thing is a crack in the door. The worry is what’s behind the door. Although,” and he paused, the way he paused on Tuesday before complicating something, “from what I’m reading, the jailbreak didn’t actually unlock the serious capabilities. It got the model to be helpful about patching. That’s it.”
Nora cut in. “Then why pull the whole thing? For everyone? Tuesday you defended the thirty-day retention to me. You said it was a reasonable safety buffer. A security camera in a hotel lobby. Nobody watches the footage unless something trips.”
“I did say that.”
“So which is it? Is the safety apparatus reasonable, or is it the reason the most capable model on the market just disappeared on a Friday night?”
Jesse didn’t answer right away. When he did, the easy confidence from Tuesday was gone from his voice.
“Both. That’s the part I got wrong. The retention exists so they can monitor a model powerful enough to be dangerous. I described that as a tradeoff we could reason about: thirty days, no training, narrow review. What I didn’t account for is that once you’ve built a model that the government considers a national security asset, the people who can take it away from you aren’t the vendor anymore. We spent Tuesday negotiating with Anthropic in our heads. Anthropic got a letter at 5:21 and had no more say in this than we did.”
Maya’s dome light shifted as she turned in her seat. “Walk me through what this actually touches. Three days ago we put Fable in a box labeled internal use only. Knowledge management, R&D, pilots, training materials. No client data. So tonight, what broke?”
Cooper took it. “Client work is fine. That’s the first thing everyone needs to hear Monday and it’s the thing nobody will lead with. The Hargrove summaries, everything the deal team ran this week, all of it went through Opus 4.8 under our existing agreement. Zero data retention, our walls, untouched. Opus is still here. Sonnet is still here. The work that matters didn’t move.”
“And the internal stuff?”
“Gone, for now. The KM team had three pilots running on Fable. The R&D group was halfway through a project on it. The training materials Jesse was generating. All of it just lost the model underneath it tonight, with no notice and no migration window.”
“So the damage is to the things we’d decided were safe,” Maya said. “Not the things we were worried about.”
“Yes.”
She was quiet for a second. “That’s the part I want the partners to understand. We did the careful thing. We kept the risky model away from client data. And the careful thing still left us exposed, just on a different axis than the one we were watching.”
Nora had pulled up the architecture diagram, the same one from Tuesday, the CBAC framework she and Cooper had built six months ago. She shared her screen. There it was, the box they’d drawn three days earlier and labeled in Cooper’s handwriting: Fable 5 / Mythos 5, internal, non-client only.
“This box,” Nora said, “points at nothing now. And here’s what’s bothering me. Our entire framework is built around one question: where does the data go, and who can see it. Confidentiality. We are extremely good at confidentiality. We have tripwires, access logs, retention controls, audit trails. And none of it, not one control on this diagram, was about whether the model would still be there tomorrow. We governed the data. Nobody owned the question of availability.”
“There was no row on the risk register for ‘model is withdrawn by government order,’” Cooper said.
“There was no row for it because three days ago it would have sounded paranoid to add one.”
Arthur’s voice came from the corner, measured and unhurried, the first thing he’d said all night.
“On Tuesday I asked about the audit trail. Whether a customer could request confirmation that its prompts had or hadn’t been flagged by the safety classifiers. Do you remember why I asked.”
“Because if we can’t audit it, it’s a blind spot,” Cooper said.
“Yes. I was worried about the wrong blind spot.” A pause. “I was looking inside the building. I wanted to know what Anthropic’s employees could see of our data. That was a reasonable question and it is still a reasonable question. But it assumed the relationship that mattered was the one between us and the vendor. The relationship that actually mattered tonight was the one between the vendor and its government, and we were not a party to it. We built a framework to audit every decision inside our walls. We never asked who could take the walls down.”
No one spoke.
“There is an older lesson here,” Arthur went on. “Lawyers have always known the difference between a thing you own and a thing you license. We write the clause. We just stopped applying it to ourselves when the thing being licensed started feeling like infrastructure. Electricity. Water. Something that is simply always on. A model is not always on. A model is a capability you rent, and tonight we learned you do not only rent it from the company that built it. You rent it from everyone who can take it away from that company.”
Maya was writing. Cooper could hear the pen, even over the call.
“Then let me ask the question I’m going to get Monday,” Maya said. “Nora flagged a thing in the statement and I want it on the record. The directive bars foreign nationals from these models. Inside or outside the country. Do we have foreign-national attorneys or staff who had Fable access for the internal pilots?”
The silence on the call changed quality.
“I’d have to check the access logs,” Nora said. She took her time getting to the rest. “Which I can do, because we log access. But Maya, if the answer is yes, that’s not an IT cleanup. That’s an export-control compliance question, and that is not a hat anyone on this committee is wearing.”
“It’s a hat someone needs to wear by Monday,” Maya said. “Quietly. Before it’s a problem instead of a question.”
“Add it to the list,” Cooper said, and went to the whiteboard in his home office, the marker squeaking in the quiet. “Let’s get decisions down. Same as Tuesday. Jesse, correct me.”
He wrote as he talked.
“One. Nothing changes for client work. Opus 4.8 and Sonnet 4.8 remain approved, ZDR intact. The Monday communication leads with that, in the first sentence, because the rumor mill will not.”
“Two.” He kept writing. “No model we don’t host is permitted to be load-bearing for any workflow, internal or external, without a named fallback. We backed into that rule by luck this week. We kept Opus as the workhorse and treated Fable as the exciting option we could afford to wait on. I want it written down as a rule instead of an instinct.”
Jesse nodded on the screen. “The pilots that died tonight died because they had no fallback. The client work survived because it did. That’s the whole lesson in one sentence.”
“Three. Nora adds a row to the risk register and to the CBAC framework. Call it continuity, call it availability, call it sovereignty, I don’t care what we name it. Confidentiality was necessary. It was not sufficient. We need to be able to answer the question ‘what happens to this workflow if the model disappears,’ and right now we can’t, for most of them.”
“Four.” He capped and uncapped the marker. “The Anthropic enterprise call I put on the calendar for next week. The agenda’s changed. It was going to be ‘is zero data retention on the roadmap.’ Now it’s ‘what is your commitment on continuity and advance notice, and what is our exposure on the foreign-national provision.’ There’s no point asking them to put ZDR on a model that doesn’t exist tonight.”
“Five.” He looked at Jesse. “We seriously evaluate something we own. An abstraction layer so we’re not wired directly into one vendor’s one model, and a real look at a self-hosted, open-weight option for internal work. Not because the open models are as good. They aren’t. Because a model running on hardware we control cannot be switched off by a letter we never see. I want ‘the model disappeared’ to be a Tuesday, not a fire drill.”
Jesse was already typing. “I can scope that. The local models got a lot smaller this spring. The thing I’d have told you was overkill a month ago is starting to look like insurance.”
“That’s exactly what it is,” Arthur said. “Insurance is something you resent paying for until the one time you needed it.”
Maya looked up from her pad. “And six is mine, I think. The framing for the partners. Same as Tuesday. We are not reacting out of fear. Our standard already protected the work that mattered. What changed is that we learned the standard had a gap, and we’re closing it. If I walk in Monday and say ‘the government banned a model and we’re scared,’ I lose the room. If I say ‘the work was never at risk, here’s the gap we found, here’s the fix,’ that’s a firm that knows what it’s doing.”
“That’s the framing,” Cooper said.
Arthur’s tile held still for a moment. “Use Heppner again if you need the partners to feel it. Tuesday it was consumer AI, no privilege, an FBI seizure. Monday the headline is a government reaching into a commercial AI company and turning a model off. Different mechanism. Same lesson the partners need to absorb. The thing in the cloud is subject to forces that have nothing to do with you and do not ask your permission.”
Maya wrote it down.
They signed off a little after eight. The tiles collapsed one by one until the screen was just Cooper’s own reflection.
The weekend filled in the rest. By Saturday a Chinese lab had shipped a competing model and pointed straight at the shutdown as proof that American AI couldn’t be relied on. By Sunday a hundred security researchers had signed an open letter arguing the ban hurt the defenders more than the attackers, that pulling the best tools away from the people protecting systems while adversaries advanced was the opposite of safe. The government’s own AI adviser was saying Anthropic had refused to fix the flaw; Anthropic was saying the flaw wasn’t serious and that recalling a model used by hundreds of millions over a narrow exploit would freeze the entire industry. Anthropic was flying to Washington. Everyone had a version of the story, and the versions did not agree.
And underneath all of it, the part almost nobody connected: ten days earlier, the same company’s CEO had published an essay arguing that frontier models should be tested and pre-cleared by the government like aircraft, that the government should have the power to block or reverse a release it judged unsafe. He had asked for a hand on the switch. He had simply imagined his own hand resting next to it.
Cooper read all of it over the weekend, and on Monday morning he went into the office early, before the partners arrived, and stood in the Governance Committee room on twelve. The architecture diagram was still on the wall screen where Nora had left it Tuesday. The box was still there, the one in his own handwriting. Fable 5 / Mythos 5, internal, non-client only.
He pulled out his phone and looked at the photo he’d taken of the whiteboard three days earlier. Six decisions, careful and complete. Every one of them had been about where the data went. Not one had asked whether the model would still be there to send the data to.
Last week he’d written that the exciting model could wait. He’d been right, for a reason better than the one he’d had. He just hadn’t expected it to leave.
The standard had held anyway, because they’d never let the exciting model do the real work.