The Mercantilism
of Generative AI

It is not censorship — and the word matters

My first instinct that morning was the word “censorship.” I think that instinct is wrong, and being precise about why is the first move of the whole analysis. Censorship is the suppression of speech — of something someone wants to express. Nobody told Anthropic what its models may say. The directive restricted who may operate a capability. That is a different category: it is the logic of arms control and export licensing, the same logic that governs centrifuges, certain lab equipment, and — the precedent that haunts this entire booklet — strong cryptography in the 1990s.

Why insist on the distinction? Because the labels carry their own moral physics. Society has a strong, settled consensus against censorship, and a strong, settled consensus that you can't freely buy a centrifuge. By moving the question from “free speech” to “dual-use capability,” the state relocates the fight onto terrain where it ordinarily prevails. So the more accurate word for what you're feeling is not censorship but rationing: a cap on how good a tool an ordinary person is permitted to operate. And rationing is something societies do constantly without anyone reaching for the language of tyranny.

The utility ladder

Think of how electricity matured. It did not stay a product that Edison and Westinghouse fought over in the open market, and it was not nationalized. It became a licensed common carrier — a regulated utility, overseen by public commissions, with price controls and universal-service obligations. You cannot run a power plant, a bank, or a nuclear reactor without a charter that a regulator can suspend. Read the June 12 kill switch through that lens and it is neither censorship nor even quite arms control. It is the first assertion that frontier intelligence belongs in the category of critical infrastructure you need a license to operate — and that the license can be pulled in an afternoon.

That is the ladder this booklet keeps climbing: censorship → rationing → arms control → licensed critical infrastructure. Each rung is a more accurate, and more consequential, description of the same event. The top rung is the one that should hold your attention, because licensing is durable in a way that outrage is not.

The AC/DC lesson, and its disanalogy

There's a tempting argument that no cap can hold: ban the better technology and someone simply reinvents it. The history of electricity seems to prove it — Edison pushed direct current (DC), but alternating current (AC) won because it could be transmitted over distance, and once the idea was understood, anyone could build a transformer. Apply that to AI and you'd conclude the cap is futile: open weights are the “someone reinvents AC” event, and the ban breaks.

But there's a disanalogy, and it's the whole ballgame. AC's barrier was knowledge — trivial to copy once known. Frontier AI's barrier is capital and energy — a gigawatt of power and years of construction. You cannot reinvent a frontier training run in a garage. That is what makes the cap potentially more durable than the historical analogy suggests: the means of production is physically scarce and physically controllable. The chip export controls the US already maintains are the early form of this; the natural extension is from “which chips may go to which country” to “which concentrations may be built at all.” interpretation

The acid: efficiency, and the variable that fights it

The disanalogy has a counter-force. If frontier-class capability keeps getting dramatically cheaper — and recent history says it does — then the capital barrier erodes and the bullion stops being rare. So the durability of the wall is genuinely a race: capital moat versus efficiency curve.

Here is the variable that tilts the race back toward the wall: recursive self-improvement. As models increasingly do the work of AI research — generating training data, running experiments, writing the code of the next system — the leader's rate of progress can accelerate. And the key distinction is this: leakage acts on levels; self-improvement acts on the derivative. A follower who steals your current capability level still cannot catch a trajectory that is itself speeding up. The follower copies where you were; the leader is busy widening where it's going. And because self-improvement runs on compute, it folds straight back into Mechanism 2's chokepoint: whoever holds the bullion also holds the engine that pulls away. interpretation

(A caveat worth keeping honest: self-improvement loops that work tend to be the ones with a hard correctness check — a verifiable reward — rather than a model freely grading its own homework, which degenerates. The strongest versions of this argument assume the verifiable-reward kind. I find that assumption plausible, not certain.)

Why the market pushes one way and the state the other

The market's instinct is to distribute, and not out of generosity. The roughly $700B of capex has to be repaid, and you repay it by selling to everyone. Competition reinforces this: in an oligopoly, withhold your best model and a rival rents theirs out and takes the market. And there's a deeper reason a lab can't hoard even if it wanted to — it cannot consume its own capacity. To capture the value of a model that can do any economically useful task, you would have to vertically integrate into every market the model can address: law, drugs, logistics, code, all of it. Impossible. So even a pure profit-maximizer sells the shovels, because it cannot dig all the gold itself.

The state's instinct runs the other way: a decisive capability is a national advantage, and you don't license a national advantage to foreigners. So the two hands pull in opposite directions, and the interesting thing about June 12 is which one won. The market wanted to sell Mythos to the entire world. The state said no. This wasn't capitalism hoarding intelligence — capitalism was straining to distribute it. It was politics overriding the market's distribute-instinct. That is the single cleanest way I can state what happened.

Where hoarding's economics actually close: the nation

The objection to any “they'll hoard the AGI” story is the one above — no single firm can consume the capacity, so the market forces a sale. But raise the altitude from firm to nation and the objection dissolves. A lab can't run wet labs and law firms and factories; a national economy contains firms that do all of those. So a directive of the form “take this capability and go win global markets with it,” addressed to a country's champions, clears the economic bar that a single firm fails. This is simply industrial policy: channel a strategic advantage to national champions, deny it to rivals. Japan's MITI did a version of it; China's direction of subsidized champions into EVs and solar is a current version. interpretation

Export the goods, not the factory

But to win a foreign market, your champions must operate in it — which sounds like the very export the wall forbids. The resolution is the oldest mercantilist move there is, and it closes the loop on the “money must move” principle: you export the finished goods, not the factory. The dark factory for intelligence stays home, like a power plant; what crosses the border is the aluminium smelted with the cheap power — the drug, the design, the software product, the intelligence-intensive output. You never ship the grid.

And this is exactly the shape of the June 12 directive. It restricts foreign nationals operating the model — that's exporting the factory — while saying nothing about foreign customers buying its products — that's just trade. The scope that looked like a clumsy enforcement artifact is, read this way, the policy stated with precision. interpretation

Two futures: who gets armed, who gets targeted

“Export the goods, keep the factory” has a flip side that quietly decides which industries thrive and which bleed. The customers who get armed with frontier access are the ones the factory-holder could never become. The ones who get targeted are the ones it can. Put plainly: if your business is the kind of good the factory makes, you are not a customer — you are a target. The test is a single question:

How much of your margin is the thinking — and how much is the moat around the thinking?

Take two European firms. A carmaker — say BMW — gets armed. Almost none of its margin is the thinking; it's the plant, the supply chain, the brand, the dealer network, the regulatory homologation — none of which a model-holder can acquire by being clever. Nobody out-BMWs BMW with a model. So BMW keeps frontier access, runs business-as-usual, and pays a hefty and probably unavoidable AI tax on design and logistics. (Its one soft spot is the software edge — the in-car software, the autonomy stack — exactly where a software-native rival can integrate.) A European cybersecurity or IT-services firm gets targeted. Its margin was expert cognitive labour sold by the hour — which is precisely the good the factory produces. Under the lens it may be quietly denied the state-of-the-art model while a domestic champion of the model-holding bloc is pointed straight at its customers. Why would a buyer choose the visibly weaker provider? interpretation

The rough sorting: hard to integrate into → armed — automotive and heavy industry, pharma (wet labs, trials, patents), energy and infrastructure, banking infrastructure — value rooted in physical, regulated, capital-heavy moats. Easy to integrate into → targeted — IT services, software, consulting, content, and cybersecurity — value that is the cognitive output. Four modifiers can pull a targeted firm back toward safety: regulatory licensure plus liability (someone must be legally on the hook), proprietary data or trust the holder can't acquire, a physical last mile, and — most important here — sovereignty or jurisdiction requirements. And the sorting is dynamic: what's infeasible to integrate into today (run a fab, a wet lab) creeps toward feasible as models gain agentic and eventually embodied reach. “Safe” means “safe for now.”

The shield, and why it's a fuse

That last modifier — sovereignty — is the targeted firm's great hope, and it deserves a hard look, because it is more fragile than it appears. A government can mandate that a Swedish municipality's server racks, software, and security services come from an EU supplier. That's a shield. But the shield has a half-life, set by how fast and how badly you're hurt by being under-armed. Where the harm is slow and diffuse — the EU's tariffs on Chinese electric vehicles, say — the shield can hold for years, even decades; slightly pricier cars hurt no one this afternoon. Where the harm is fast, catastrophic, and legible, the shield is not a wall but a fuse. In cybersecurity, being a generation behind doesn't mean a slightly worse product; it means you get breached. A handful of major incidents in a short span and the political economy flips overnight: the same municipality that was ordered to buy local now demands the bloc's firm with the state-of-the-art model. interpretation

And in adversarial domains the shield is worse than brittle — it is self-undermining. The attacker does not obey export controls; criminals and hostile states get the best models through theft, leaks, or their own bloc. So the wall binds the defender and not the attacker — the same pathology that made the 2013 Wassenaar “intrusion software” controls catch security researchers instead of intruders. You hand your defender an inferior weapon, the un-walled attacker walks through, and the resulting breach is the very thing that forces the shield open. The shield manufactures the breach that ends it.

When it breaks, it breaks badly: dependency enters through the breach, on the worst possible terms, negotiated from a smoking crater — and crisis-driven dependencies almost never unwind. The cruel irony writes itself: the domains you would most want to keep sovereign — security, defence, critical infrastructure — are exactly where the shield is most brittle, so they fall first and hardest. Sovereignty is least achievable precisely where it matters most.

It isn't all-or-nothing, though. The shield's strength tracks sensitivity, in three tiers:

At the classified top, the shield holds almost by fiat: an intelligence service will never run its crown-jewel security on a foreign, kill-switchable model, because the foreign dependency is itself the unacceptable risk. But that leaves it in an impossible bind — it can't buy foreign and can't afford to lag against adversaries wielding the state of the art — and the only escape is to build its own. That bind is the sharpest argument in this whole booklet for bloc-level sovereign capability. In the important middle — the municipalities and hospitals with no national-security mandate but plenty to lose — the fuse blows first. At the commodity bottom, there is no shield at all; whoever has the best model wins.

So the durable moves for a targeted firm, or a targeted nation, come down to two: pre-position the dependency deliberately — negotiate frontier access on your terms before the crisis, not from the crater after it — or build sovereign capability at the bloc level. Neither is something an individual firm can do alone, and neither is something the EU can do today. That is what turns “regulate the dependency, not the use” from a tidy slogan into a security imperative with a countdown on it. And it rhymes with where this booklet began: the recall that started it all was triggered by a cyber capability — the founding event and the most exposed European industry are one and the same domain. interpretation

Let me make the whole armed-versus-targeted split concrete with the one business I know from the inside: my own.

Three labs, one rule

The naive version of the optimistic case says: even if US frontier capability gets walled, open models — especially from China — will keep the field free. I don't think that survives contact with why anyone open-weights in the first place. Watch the same rule produce three different behaviors:

Meta. A decade of open-frontier evangelism, and then — when the economics of $100B-scale compute bit — its frontier development went closed. The “Linux of AI” thesis did not survive contact with the cost of the frontier. Openness was abandoned the moment closing served the position better.

Mistral. Around January 2026 the framing shifted: open weights were now described, in effect, as the freemium tier of a commercial offering. reported Not a gift — a funnel. Open as a customer-acquisition layer beneath a paid product.

China. The open releases that have done so much to erode Western labs' moat are best read as a catch-up-and-commoditize strategy: open-weight your competitor's complement, build ecosystem dependence, erode the leader's advantage. That logic holds precisely as long as you are behind or at parity.

Put together, these aren't three philosophies; they're three positions on one curve. The rule: you are “open” when being open helps you win, and the day closing helps more, you close. There are now too many examples to call this cynicism. It's just the gravity of the thing.

The readable trigger hidden in the rule

The rule gives you a free instrument. If openness tracks position, then the day a Chinese lab ships its best model closed is the day it believes it has taken a lead. So you don't have to guess whether China has hit the frontier curve — you can watch for the first un-open-weighted Chinese frontier release and read it as the signal. Openness is the tell of the trailing hand. interpretation

What open weights actually buy you

So is the open-model hope worthless? No — but it has to be re-shaped. Open weights don't guarantee a free frontier; they guarantee something narrower and more useful: un-severability. A client of an API can be switched off in an afternoon, as June 12 proved. A client of weights it hosts itself cannot. Open weights are not the substrate of freedom; they're the substrate of a connection no one can cut. That's the real reason they matter — and we'll return to it when we get to what you can actually do.

The chartered-company structure

The mercantilist powers didn't run one national monopoly. They chartered several companies — East India, the Levant Company, the Royal African Company — that competed amongst themselves while all serving the same national balance of trade against rival nations. Firm-level plurality and bloc-level singularity were never in tension; the plurality was the hedge and the spur, the singularity was the wall. Map it straight across: within the US bloc, several labs compete, and the state prefers it that way (a nation doesn't bet its frontier on one company, and competition keeps them sharp); at the wall, the state treats their combined capability and compute as one national arsenal facing a rival's arsenal.

The labs as organs of a bloc

Read this way, the labs stop being rivals-to-the-death and start looking like differentiated organs of a single body. One plays the monastic frontier-holder, organized around the research bet. Another is the export-house: a heavily productized lab whose mass-market machine looks like drift if you want it to be a research monastery, but looks like an asset if you want a champion that can convert capability into won markets. A third is the own-your-own-specie player — vertically integrated into its own compute, with the distribution surface to deploy outputs across an entire economy without ever exposing a weight, and a track record of releasing world-changing capability as a controlled scientific commons rather than a shipped product. I'm holding individual motives agnostic here; the structure is the point, and structurally these are complementary roles in one bloc, not three companies fighting over the same square foot. interpretation

Why June 12 fits perfectly

This is the reading that finally snaps the recall into focus. It was the state asserting bloc-level control over a firm-level asset. Anthropic is one chartered company in the national stable; the government demonstrated it can pull that company's flagship to serve the bloc's position. And the “foreign national” scope is bloc-logic in its purest form — keep the capability inside the bloc's people, regardless of geography. Even the financing tension resolves at this altitude: a lab whose API economics look shaky on its own can still be nationally worth backstopping, because the relevant ledger is the bloc's balance of trade, not one firm's quarterly P&L. The government-lab entanglements already forming look like the embryo of exactly that backstop-and-control bundle. interpretation

Every mechanism so far points one way: toward concentration, walls, and control. I don't want to leave it there, because I don't think it's the whole truth, and the missing piece is the most human one.

We tend to call intelligence the defining human trait. I'm not sure that's right. The trait that actually carried us through evolution is adaptability — the capacity to reconfigure ourselves when the environment changes the rules. And here's a reason that's more than sentiment: today's models are frozen after training. They are brilliant and static. They do not restructure themselves in response to a genuinely novel situation the way an organism does. Adaptability — the live rewiring of strategy under new conditions — is precisely the capability the current paradigm has not captured. If anything is a durable human moat against a walled, hoarded frontier, it is this.

Adaptability is also a leak the wall-builders don't model. Alongside the technical leaks of Mechanism 2 — weights, talent, algorithms — there is a social leak: people route around caps. Every concentrated general-purpose technology in history — the printing press, electricity, the internet — was adapted-around by the people it was meant to exclude. Capability finds the cracks because humans are crack-finding machines.

But I promised honesty over comfort, so here is the complication that keeps this from being a happy ending. Adaptation is symmetric. The hoarder adapts too — its controls evolve, its non-tariff barriers get smarter, its enforcement learns. So the real picture isn't “human ingenuity inevitably wins.” It's an arms race between the distributed many and the concentrated few, and history does not promise the many win it — sometimes a wall holds for generations, sometimes it's gone in a decade. Optimism here is a bet that decentralized adaptation outruns centralized control. That bet is usually right in the long run. It is frequently wrong in the run you actually have to live through.

I keep this counter-current in the booklet not to soften the thesis but to complete it. The mercantile reclassification of intelligence is real and it is happening. Human adaptability is the force pushing back. Which one you weight more heavily is, in the end, a temperament — and you should know your own.

A closing note — and the stance behind every page

I started writing this the morning a collaborator went behind glass, and I'll end where the disclaimer began: I might be wrong about all of it. The lens could be over-fitted to one dramatic event. Mythos might be back, unrestricted, by the time you read this, and some of these mechanisms might look quaint. If so, good — update the log, retire the stale mechanism, and keep the habit.

Because the habit is the real deliverable, not the thesis. Foresee, watch the triggers, adjust. Don't predict the future; build a structure that lets you interpret it as it arrives and act before it's obvious. Hold several mechanisms open at once. And keep some faith in the counter-current — in human adaptability, the variable the wall-builders never quite manage to price in. The mercantilism of intelligence is real and it is underway. So is the ancient human talent for finding the cracks. Which of those you bet on is, in the end, up to you. I'd just ask that you watch the dates before you decide.