US classified code as weapons before. It didn’t work

OpenAI’s newest model rollout is being pulled into a government approval process, echoing older U.S. fights over treating code like munitions—until courts forced the policy to change. Now, the key question is whether today’s restrictions on AI model weights wi

For OpenAI, the handoff to the government didn’t feel like a technical checkbox. It was a schedule. And it was personal.

OpenAI CEO Sam Altman is going along with a process he says his staff doesn’t want to become the long-term way the company works: turning over a say to federal officials over who can access its newest model. Under the plan described here. GPT-5.6 will ship first to only a small group of partners. with the government approving access “customer by customer” during a preview period before a wider rollout.

The request didn’t come vaguely or abstractly. It came from the White House’s Office of the National Cyber Director and the Office of Science and Technology Policy. Commerce Secretary Howard Lutnick is described as personally pressing Altman to secure sign-off from other agencies before OpenAI moved forward—even for that limited rollout.

Just weeks earlier. a different AI company had already been forced into the kind of disruption the government is trying to manage now. A federal directive compelled Anthropic to disable access to its two most advanced models entirely. The order wasn’t tied to a specific disclosed flaw. The concern was that foreign nationals could use the technology. Anthropic, the company that lost access, is now suing the government over the directive.

Both firms are being asked to operate in a reality that’s historically been reserved for arms makers: federal intervention not just in safety requirements, but in the actual rollout timing of frontier AI.

The White House shift that came after a deregulatory promise

A year before GPT-5.6 negotiations, the administration was telling a much different story about how Washington should treat the industry.

At the Paris AI Action Summit in February 2025, Vice President JD Vance told European leaders that the U.S. believed “stringent AI regulations could harm the industry.” He warned that “excessive regulation of the AI sector could kill a transformative industry. ” urging Europe to adopt a deregulatory posture.

During that summit, the U.S. and the United Kingdom declined to sign a joint declaration on AI safety. But by the time GPT-5.6 discussions were underway—16 months later—the administration was described as calling AI executives to halt or slow a launch.

The direction of the tug-of-war has flipped. In the earlier era, the White House pushed restrictive policy first, and courts later loosened it. This time, the government began with a looser posture and is now tightening its belt on its own.

How code ended up on the same shelf as weapons

This isn’t the first time the U.S. has tried to treat code like something dangerous enough to regulate through a wartime lens.

In the early 1990s, the U.S. government classified strong encryption as literal munitions, placing it on the United States Munitions List. That list covered actual weapons, with the State Department controlling exports while the Commerce Department handled lower-stakes dual-use technology.

The policy collided with Daniel Bernstein. a Berkeley student who developed an encryption algorithm called “Snuffle.” Bernstein wanted to publish the program online. but the rules required him to register as an arms dealer and obtain a government license before doing so. Without those steps, he could face civil and criminal penalties.

Bernstein sued. A federal judge ruled that code is speech protected by the First Amendment. In response. the Clinton administration acted: in November 1996. President Bill Clinton signed an executive order moving most commercial encryption from the Munitions List to the Commerce Control List. which imposed far fewer restrictions.

The legal fight didn’t end with that switch. A Ninth Circuit panel later ruled in 1999 that the publishing restrictions were unconstitutional. But that opinion was pulled for a rehearing that never finished. The case fizzled out a few years later on a technicality, and by then, the restrictions had already been lifted.

AI doesn’t map perfectly onto encryption—but the collision is similar

Courts have found code to be protected speech only in narrower situations. One example given here is that courts count code as speech when it resembles ordinary communications and its expressive value outweighs the job it’s actually doing—not simply because it’s made of text.

A growing number of legal experts. however. argue that AI is different in a way that matters for constitutional questions—particularly when it comes to model weights. Alan Rozenshtein. a University of Minnesota law professor. argues there’s no reason to automatically treat the distribution of model weights as protected by the First Amendment. unlike academic research and human-readable source code used to build those systems.

Other legal analyses frame it even more bluntly: the First Amendment may protect model algorithms, but not the weights themselves.

That distinction matters because the issues being pressed in Washington now target rollout access and, in Anthropic’s case, an order to disable access to two advanced models. Yet the core First Amendment question isn’t being fully litigated in the public fight that’s grabbing attention.

The weights that represent the trained system—what government restrictions are increasingly aimed at—sit on shakier constitutional ground than code that clearly functions as human-readable expression. And unlike the Bernstein case, nobody has yet been forced into court to settle that exact question.

What is happening in court right now

The legal struggle over AI and government limits is already underway, just in a different case.

In March, Anthropic sued the Department of Defense over a “supply chain risk” designation. Anthropic says the DOD was retaliating against the company’s refusal to allow the Pentagon to use Claude for autonomous weapons and mass surveillance.

A coalition of groups filed a brief backing Anthropic, arguing the government’s demand amounted to a First Amendment violation. They wrote that requiring Claude to express ideas that Anthropic does not wish to express is “classic compelled speech. ” located at the center of First Amendment prohibitions.

Judge Rita Lin agreed. She found Anthropic would likely succeed on its First Amendment retaliation claim and granted a preliminary injunction.

Still. the court case that has the closest comparisons to the encryption era is not the one based on compelled speech. The export-control directive that forced Anthropic to disable access in June immediately drew comparisons to the 1990s fight. But the lawsuit that followed does not make a First Amendment argument. Instead, it sticks to narrower legal claims about what export-control law actually covers.

That leaves the larger, unanswered issue hovering in the background: whether Bernstein’s logic—that code can be protected speech—extends to AI model weights as the federal government tightens restrictions.

The result is a familiar feeling, but with new stakes. In the 1990s, the government tried to treat strong encryption like munitions and then backed off when courts pushed back. Today’s restrictions may yet face a similar reckoning. But right now. the most consequential question—how far First Amendment protection stretches to the trained files themselves—has not been settled.

OpenAI GPT-5.6 Sam Altman White House Office of the National Cyber Director Office of Science and Technology Policy Howard Lutnick Anthropic Claude Department of Defense supply chain risk First Amendment encryption Daniel Bernstein Snuffle United States Munitions List Commerce Control List export control Rita Lin