Nine days ago I argued you should own your AI, because a government had just switched one off. This week a Tokyo lab shipped the commercial answer — a model built so that no single government can switch it off. The cypherpunk thesis just acquired an enterprise price list.
On 13 June, the US Commerce Department forced Anthropic to disable Claude Fable 5 and Mythos 5 worldwide, three days after launch. I wrote at the time that the mechanism, not the model, was the warning: if your critical capability lives on someone else’s servers under someone else’s regulator, you are a tenant, evictable overnight. That was the principle. This week, Sakana AI turned it into a product.
What Sakana actually shipped
The Tokyo lab — founded by Llion Jones, co-author of the original “Attention Is All You Need” Transformer paper, and David Ha — has launched Fugu and Fugu Ultra. To the user it looks like one model behind one OpenAI-compatible API. Under the hood it is not a model at all in the usual sense: it is a language model trained to orchestrate a swappable pool of other LLMs — including recursive copies of itself — handling selection, delegation, verification and synthesis internally.
Ask it something simple, it answers alone. Hand it something messy, long and multi-step — reproducing a scientific paper, a cybersecurity audit, a financial forecast — and it convenes a team of specialist models and referees their work. It builds on two of Sakana’s own ICLR 2026 papers, Trinity and Conductor. The pitch is explicitly philosophical: powerful AI is not a single-model problem but a collective-intelligence one.
The numbers are not a rounding error
Here is what makes this more than a press release. On Sakana’s published benchmarks, Fugu Ultra does not just keep up with frontier — it edges ahead of the very base models it orchestrates:
- SWE-Bench Pro (real engineering): Fugu Ultra 73.7 vs Opus 4.8’s 69.2, GPT-5.5’s 58.6, Gemini 3.1 Pro’s 54.2.
- TerminalBench 2.1: 82.1 vs Opus 4.8’s 74.6.
- LiveCodeBench: 93.2, top of the table.
- Humanity’s Last Exam: 50.0, narrowly ahead of Opus 4.8’s 49.8.
The whole point: the orchestrated team beats its strongest individual member. And Sakana notes the kicker — neither banned Anthropic model is even in the pool, because they are no longer publicly available. Fugu hits these scores without the very models the US government just withdrew. Add them back and it would likely score higher still. One early tester said that where rival tools flagged three issues in a code review, Fugu surfaced more than twenty.
The sales pitch is the cypherpunk argument in a suit
Sakana is not being subtle about why this matters now. Straight from the announcement: “For an organization or a nation, relying on a single company’s APIs for critical infrastructure, finance, or governance is a material vulnerability. This risk is no longer a hypothetical possibility, but a reality.”
They cite the Fable ban by name. Because the pool is fully swappable, if one provider goes dark — regulatory order, foreign-policy decision, price hike, outage — the orchestrator simply reroutes to the models still standing. This is vendor diversification reframed as resilience engineering. It is the same instinct that made Phil Zimmermann publish PGP and the cypherpunks treat capability as something you take, not something you are granted — only now it arrives with subscription tiers and a console login.
Where I have to put the CFO hat back on
I want this to be the whole story. It is not, and pretending otherwise would be exactly the hype I try to avoid. Orchestration is resilience, but it is not sovereignty.
Fugu’s real-world capability depends entirely on which models are in its pool — and those models are still other companies’ APIs. If several top providers restrict access at the same time, Fugu’s options shrink with them. It routes around a single failure brilliantly; it does not route around a coordinated one. A swappable pool of rented engines is a far better position than one rented engine — but it is still rented. The only thing that genuinely cannot be switched off is a set of open weights sitting on a disk you own, which is why DeepSeek, Llama, Qwen and Gemma on your own hardware remain the actual lifeboat. Fugu is a much better fleet; it is not a lifeboat.
So the honest framing for an operator is a two-layer one. Layer one: orchestration like Fugu for everyday frontier-grade work with built-in failover — a material upgrade on single-vendor dependence. Layer two: a genuinely local, open-weight model held in reserve for the day the whole rented fleet is unreachable at once. The first protects you from a supplier going down. Only the second protects you from the suppliers being taken from you.
Why this is the more interesting signal than the ban itself
The Fable 5 directive told us the state will assert control over AI capability. Fugu tells us something more useful: the market has already begun pricing that risk and engineering around it, within days, commercially. That is the cypherpunk pattern running exactly to script — capability becomes ungovernable not by petition but by architecture. Governments deleted the smartest models on earth with one signature on a Friday. By the following week, a lab had shipped a system whose entire reason to exist is to make that signature matter less.
For any business whose operations now lean on AI, the question I posed nine days ago stands, just with a better answer available: what is your fallback when the model is switched off? “A single frontier API” is a single point of failure. “An orchestrator with failover, plus open weights on my own silicon” is a posture. Build the posture in calm water — because you do not provision for the storm once it is on you.
Mark Hendy is a private-equity-facing CFO who works with technology and governance through Tanous Limited. If your business depends on AI and you have not stress-tested what happens when access is withdrawn, get in touch.
Leave a Reply