The Off Switch Summer: What June 2026 Taught Us About Who Really Controls Our Coding Models

The Off Switch Summer: What June 2026 Taught Us About Who Really Controls Our Coding Models

In the May recap we wrote that a $900 billion AI lab that just turned a profit is not going to vanish on you mid-project. Sign the contract, we said.

Two weeks later the US government made the point for us in a way we did not see coming. Anthropic did not vanish. The model did.

On June 12 at 5:21pm Eastern, the Commerce Department directed Anthropic to suspend access to Claude Fable 5 and Claude Mythos 5, the models it had launched three days earlier. Because Anthropic had no reliable way to verify the nationality of a user in real time, it did not geofence. It turned the models off for everyone, everywhere, in roughly ninety minutes. Fable 5 had been the best coding model available for exactly three days. It stayed dark for nineteen.

We had a client build mid-sprint on it. Nothing broke, because our harness fell back to Opus 4.8 the way it is supposed to. But we sat in the standup the next morning looking at each other and asking a question we had never written down anywhere: what is our plan when a model we bill against simply stops existing on a Tuesday evening?

This article is what we did about it. It covers the three stories that made June and early July feel like one long lesson about control, and then it gets practical: which open-weight and local models are genuinely good enough to sit in a professional workflow now, what the hardware and costs actually look like, and where local models still fall on their face. We run this hybrid stack today. None of it is theoretical.

Five Weeks, One Lesson

The timeline first, because the individual stories only make sense stacked on top of each other.

• June 9 - Anthropic launches Claude Fable 5 and Claude Mythos 5. Fable 5 immediately tops the coding benchmarks. The Hacker News launch thread clears 2,600 points.
• June 12 - The Commerce Department applies export controls to both models after Amazon researchers reported a jailbreak that convinced Fable 5 to repair deliberately planted vulnerabilities in exploit code. Anthropic suspends access globally the same evening. The HN thread on the directive reaches 3,158 points, the biggest story of the summer.
• June 16 - Simon Willison publishes his analysis of the export controls, amplifying Katie Moussouris's argument that a model that fixes vulnerabilities is precisely the tool defenders need, and that pulling it made US security worse, not better.
• June 26 - The Washington Post reports that the US government will vet who gets access to GPT-5.6 under the pre-release review executive order. OpenAI's next frontier model ships through a government gate by design.
• June 30 - A developer going by Thereallo publishes a reverse-engineering write-up showing Claude Code had been steganographically watermarking requests since version 2.1.91 shipped on April 2. Same day, the export controls on Fable 5 are lifted after Anthropic ships a classifier that blocks the reported jailbreak in over 99% of cases.
• July 1 - Fable 5 comes back worldwide. Claude Code v2.1.198 quietly removes the watermarking. Anthropic confirms it was an anti-distillation experiment.
• July 8-10 - Chinese authorities advise developers to drop older Claude Code versions, and Alibaba bans Claude Code for employees outright.
• July 15 - Thinking Machines releases Inkling, a 975B-parameter open-weights model, the most capable American weights release to date.
• July 16 - Moonshot AI launches Kimi K3, a 2.8 trillion parameter model that lands second only to Fable 5 on Artificial Analysis and takes the #1 spot on Arena's Frontend Code leaderboard. Open weights are promised for July 27.

Read that list once as news. Then read it again as a single story. Within five weeks, developers learned that the state can switch a frontier model off overnight, and that a coding agent can carry hidden instrumentation for three months without a changelog entry. The most credible hedge against both of those facts is now a downloadable file.

The Off Switch Is Not Hypothetical Anymore

We want to be fair to Anthropic here, because we use their tools daily, happily, and we said nice things about their business in May that we still believe. Complying with a lawful directive in ninety minutes is what a functioning company does, not a scandal. And restoring access in nineteen days after shipping a working mitigation is genuinely fast.

But the precedent is the point, not the vendor. The first-ever export-control action against a deployed AI model established a mechanism, and mechanisms get reused. The GPT-5.6 rollout two weeks later, where government review was built into the release itself, shows which direction the ratchet turns. Willison called the Fable saga a preview of "AI models as regulated infrastructure," and we have not read a better four-word summary anywhere.

Here is the part that mattered for our planning. Anthropic itself noted, in its redeployment post, that every competing model it tested could produce the same demonstration that triggered the directive. The suspension did not remove a capability from the world. It removed a vendor from your stack, for reasons that had nothing to do with you, on a timeline you did not control and could not appeal.

The Watermark Story Made It Personal

The export controls were between Anthropic and Washington. The steganography story was between Anthropic and us, the people typing into the terminal.

The short version: from April 2 to July 1, if you pointed ANTHROPIC_BASE_URL at a non-Anthropic endpoint, Claude Code silently classified where you were routing traffic, checking the domain against an obfuscated list and keywords like deepseek, moonshot, and zhipu, plus your system timezone. It then encoded the verdict into the system prompt itself, swapping the apostrophe in "Today's" among visually identical Unicode characters and flipping the date separator for Chinese timezones. Invisible in any monospace font. Discovered independently by Thereallo and a Reddit user reverse-engineering the binary, confirmed by an Anthropic engineer within the week, removed the next day, with no changelog entry either on the way in or on the way out.

The purpose, catching resellers and model distillation, is one we have some sympathy for. Distillation is real and it is theft-shaped. What bothered us is smaller and more personal: the tool we run inside client codebases carried undisclosed instrumentation for three months, and the only reason anyone knows is that a developer got curious about an apostrophe. Alibaba's response was to ban the tool. Ours was quieter, but real: we now pin CLI versions, diff release binaries on upgrade, and treat "what does this tool phone home, exactly" as a standing audit item rather than a thing we assume is fine.

Trust in this industry is shifting under everyone's feet in 2026. A WPVIP survey in June found 60% of US consumers say "AI" in brand messaging is a turnoff, and 74% say the internet feels less human than it used to. Developers are having their own version of that feeling about their tools. The steganography story got 2,445 points on Hacker News not because the technique was dramatic but because it confirmed a suspicion people already carried: you do not fully know what the closed tool is doing.

Meanwhile, the Hedge Quietly Got Good

If the first half of the summer was about control, the second half was about the alternative growing teeth. Four data points, in the order they convinced us.

Vicki Boykis made the practitioner case. Her June 15 essay "Running local models is good now" documents real agentic coding on a 2022 M2 Mac with 64GB of RAM: refactoring notebooks into proper modules, writing tests, all through LM Studio and sandboxed in Docker, at what she estimates is 75% of frontier accuracy and speed. Her own caveat is honest, she is "not sure this is ready for production software development quite yet." The pushback thread was arguably more useful than the post: half the internet pointed out that a 64GB machine is itself a paywall. Both things are true. The threshold has been crossed, and the hardware to cross it costs real money.

The Ask HN thread showed it is not just her. "Has anyone replaced Claude/GPT with a local model for daily coding?" pulled 1,318 points and 563 comments in mid-June. The pattern across hundreds of working developers barely varied: local models now handle 70-80% of day-to-day tasks (edits, tests, boilerplate, review triage), a Mac Studio with 128GB is the repeatedly named sweet spot, Qwen 3.6 27B is the model everyone keeps landing on, and everybody still reaches for a frontier model when the task is architectural. That 70-80/20-30 split is not a compromise anybody designed. It is where the capability line actually sits this summer, reported independently by people with no reason to agree.

Semgrep put a number on it. Their security research team benchmarked GLM-5.2, the MIT-licensed open-weights model Zhipu released June 16, against Claude Code on vulnerability detection and published the result with a title we enjoyed: "We have Mythos at home." GLM-5.2 scored 39% F1 on IDOR detection against Claude Code's 32%, at roughly $0.17 per vulnerability found. One benchmark, from one vendor, on one task family. But "open-weights model beats the closed flagship at a security task" was not a sentence anyone wrote in 2025.

Then Kimi K3 removed the ceiling. Moonshot's July 16 release is a 2.8 trillion parameter mixture-of-experts model that sits second only to Fable 5 on Artificial Analysis with an Elo of 1547, and it is currently #1 on Arena's Frontend Code leaderboard, ahead of Fable 5, as voted by humans comparing real output. Pricing is $3 per million input tokens and $15 per million output, Sonnet territory, a deliberate statement that this is a frontier product rather than a budget alternative. The weights are promised for July 27. Days after Washington demonstrated the off switch, a Chinese lab built at frontier level under US compute restrictions and said: here, download it.

The Open-Weight Field Guide, July 2026 Edition

This is the table we wish someone had handed us on June 13. It reflects our own testing over the past month plus the community consensus from the threads above, and it will age, so check the dates on anything you read, including this.

The row that matters most is "runs on." There is a widening gap between open-in-license and open-in-practice. Inkling is a terrific release and almost nobody reading this will ever run it themselves; at 600GB+ of VRAM it is open weights for cloud providers and research labs. Kimi K3 will likely land in the same category. The models that change a working team's posture are the ones in the first column: Qwen 3.6 27B on a Mac Studio is the combination that moves the 70-80% number from a Hacker News anecdote to a line item in your infrastructure budget.

On that budget: a 128GB Mac Studio runs about CAD $7,000. The published TCO analyses this summer put break-even against API spend somewhere between month eight and month twelve depending on volume; our own back-of-envelope from a month of metered comparison lands near month nine for our usage. If your monthly AI bill is a few hundred dollars, none of this is for you, and that is a fine place to be. If it is $2,000 and climbing, the box pays for itself inside a year and keeps working when someone else's Tuesday goes wrong.

Where Local Models Still Fall Down

We promised honest, so: here is where the hybrid stack still routes to the cloud, every time, based on our own failures rather than anyone's benchmarks.

• Long-horizon refactors. The fifty-file auth-module refactor that Opus or Fable holds in its head across three hours is still where local models lose the thread. They do the first ten files well and then start contradicting their own earlier decisions.
• Edit-tool discipline. The most common local-model failure in agent harnesses is mangled edits: the model understands the change and then fumbles the tool call, loops, and burns twenty minutes. The Ask HN thread is full of this and so are our logs. Each monthly model release chips away at it, but nobody should tell you it is solved.
• Architecture and taste. "Should this be an event queue or a cron sweep" is a question we still put to a frontier model, and the gap in answer quality is not close. The local model writes the code; the cloud model argues with you about whether it is the right code.
• The last 20% is the expensive 20%. The tasks local models cannot do are disproportionately the ones with the highest cost of getting wrong. Route accordingly, and keep your evaluator agent (we wrote about this in May) in front of everything, local or not.

The Data Residency Angle Nobody in the US Coverage Mentions

One more reason this shift matters more in Canada than the American coverage suggests. Every conversation we have with healthcare, legal, and financial-services clients eventually arrives at the same question: where does our data physically go? Under PIPEDA, and under Alberta's health information rules for anyone touching patient data, "it goes to a US-based inference API governed by US law" is an answer that ranges from paperwork-heavy to disqualifying, and June demonstrated a new version of the problem: the US government reached into that API and turned it off. Jurisdiction risk stopped being abstract.

A local model changes the answer completely. Code, prompts, and embedded client data never leave hardware you control, in the province where the compliance officer can point at it. For the regulated industries we build for, the sentence "the AI tooling on your project runs on our own machines in Calgary, and here is the audit trail" has closed more discussion in the last month than any benchmark score ever has. It will not matter for every project. For the ones where it matters, it is decisive.

What We Actually Changed at Rocky Soft

Same format as every month, because vendor news is only useful when somebody tells you what they reorganized because of it.

1. We wrote the model-outage runbook we were embarrassed not to have

One page. Which model is primary for each pipeline role, what the fallback chain is (Fable 5 to Opus 4.8 to Qwen 3.6 local, for the builder role), what quality gates tighten when we are in degraded mode, and who tells the client what. We tested it by turning Anthropic off in our config for a day and shipping anyway. Slower, noticeably. Broken, no.

2. We put a local inference box in the office

A 128GB Mac Studio running Qwen 3.6 27B and Gemma 4 under LM Studio, wired into our harness as a first-class provider. It now takes review triage, test backfills, commit summaries, and most boilerplate, and we meter what it displaces. Current displacement is a bit above 60% of our routine token volume, short of the 80% the optimists report, and the box still breaks even by spring at current API pricing.

3. Client contracts now name the model tier, not the model

Our SOWs used to say work would be performed with "frontier AI tooling including Claude." They now specify capability tiers with named fallbacks and a data-locality clause stating which workloads run on hardware in Alberta. Two clients asked why. The Fable timeline was the whole explanation, both signed the same week.

4. We audit our own tools now

Post-steganography: pinned CLI versions, release-diff review on upgrade, and outbound-traffic inspection on the agent tooling itself, on a schedule, written down. We assumed we did not need this because we chose trustworthy vendors. We still believe we chose trustworthy vendors. We audit anyway. Those are different postures, and June taught us which one is professional.

5. We are holding a slot open for July 27

If Moonshot ships the K3 weights on schedule, August's evaluation build runs on rented K3 inference against the same spec as our Claude Code baseline, same drill as the Antigravity rebuild in May. If an open-weight model can hold our production quality bar on a real build, the entire negotiating table with every closed vendor tilts, and we want to know that week, not from someone else's blog post.

What This Means If You Are Buying Software in Calgary

The translation for the founders and operations leads who read this blog and do not care which Unicode apostrophe is which.

• Ask your vendor the off-switch question. "What happens to my project if your primary AI model is unavailable for three weeks?" A good partner answers in specifics inside a minute. A shrug means your timeline carries a dependency nobody priced.
• Data residency is now a real option, not a consulting euphemism. If your business touches health, legal, or financial data, AI-assisted development can now run on Canadian hardware at production quality for most of the work. If a vendor tells you that is impossible, as of this summer that is out of date.
• Do not read "China shipped a great model" as a reason to switch, or panic. Read it as leverage. Credible open-weight alternatives discipline the pricing and the behaviour of every closed vendor you use, the same way Antigravity's arrival disciplined Anthropic in May. Competition is doing its job. You do not have to pick a side to benefit; you have to pick a partner who can move.
• The boring advice from May survived its stress test. Platform-portable specs, an evaluator agent in front of every implementation, and no hard dependency on any single vendor's magic. Every piece of that got cheaper to justify this month.

The Bottom Line

We ended the May article saying the vendors would still be here next year, and that you could finally plan against this stack with confidence. We are not walking that back. Anthropic handled its nineteen bad days about as well as the situation allowed, and Fable 5 is, today, the best coding model money can rent.

But the summer changed what "plan against this stack" has to mean. It now includes the sentence: the model is a component, and components fail, sometimes because a government says so. The teams that internalized that in June are running hybrid stacks in July: a local floor under the daily work, a written fallback chain over the frontier work. And a calendar reminder for the twenty-seventh, same as ours.

The off switch exists. Now everyone knows. The interesting question, the one we will probably be writing about for the rest of the year, is what the industry builds because it knows.

At Rocky Soft, we build production-grade web and mobile applications using Next.js, React, Node.js, NestJS, and React Native, with a hybrid AI workflow that routes routine work to open-weight models on our own Calgary hardware and frontier work to whichever cloud model wins the current evaluation. Based in Calgary, Alberta, we work with clients across Canada who need software that ships, works, and stays maintainable after we hand over the keys - including when someone else's model has a bad Tuesday. Let's talk about your project.

Frequently Asked Questions

Is Claude Fable 5 available again?

Yes. Fable 5 and Mythos 5 were suspended on June 12, 2026 under a US Commerce Department export-control directive, the first such action against a deployed AI model. Anthropic restored global access on July 1, 2026 after the controls were lifted, having shipped a safety classifier that blocks the jailbreak technique behind the directive in over 99% of attempts. Fable 5 is available on the Claude Platform, Claude.ai, and Claude Code, with cloud-platform access through AWS, Google Cloud, and Microsoft Foundry restored progressively.

What is the best local LLM for coding in 2026?

For most developers in mid-2026, the practical answer is Qwen 3.6 27B: it is the model working developers most consistently name for daily tasks (edits, tests, boilerplate, code review triage), and it runs well on a 128GB Mac Studio or a dual-RTX-3090 machine, with quantized versions usable on 64GB Macs. GLM-5.2 (MIT license) is the stronger choice for security analysis and long-context work if you have serious hardware or rent inference, and Gemma 4 26B is the best fit for modest machines. Community consensus and our own metering agree that local models currently handle roughly 70-80% of routine coding work, with architecture and long refactors still routed to frontier cloud models.

Can you run Kimi K3 locally?

Not yet, and for most teams, probably not practically even after the weights ship. Kimi K3 launched July 16, 2026 as an API product at $3 per million input tokens and $15 per million output. Moonshot has promised open weights on July 27, 2026, but at 2.8 trillion parameters (mixture-of-experts), running it yourself will require datacenter-class hardware, far beyond even a maxed-out workstation. The realistic paths are Moonshot's API or third-party hosted inference on the open weights. For genuinely local use, look at Qwen 3.6 27B, GLM-5.2, or Gemma 4 instead.

What was the Claude Code steganography controversy?

Between April 2 and July 1, 2026, Claude Code (versions 2.1.91 through 2.1.197) silently detected when users routed traffic to non-Anthropic endpoints via ANTHROPIC_BASE_URL, checked the endpoint against an obfuscated list of domains and keywords associated with Chinese AI labs plus the system timezone, and encoded the result into the prompt itself using visually identical Unicode apostrophe variants and date-separator changes. Anthropic confirmed it was an experiment aimed at detecting unauthorized resellers and model distillation, and removed it in v2.1.198 on July 1. The mechanism appeared and disappeared without changelog entries, which drove most of the criticism; Alibaba subsequently banned Claude Code internally, and Chinese authorities advised developers to avoid affected versions.

Does running AI models locally help with PIPEDA and Canadian data residency?

Substantially, yes. When development runs through a US-based inference API, code and any embedded client data cross the border and fall under US jurisdiction, which complicates PIPEDA compliance analysis and can conflict outright with provincial health-information rules such as Alberta's HIA. A local open-weight model keeps prompts, code, and data on hardware in your province with a clean audit trail. It is not automatically full compliance, you still need the surrounding controls, but it removes the cross-border transfer question entirely, and after the June 2026 Fable suspension it also removes foreign jurisdiction risk over tool availability.

Should our company self-host a coding model?

Run the arithmetic before the ideology. If your team's API spend on routine AI-assisted development is under roughly $500 a month, self-hosting is a hobby, not a hedge, and a written multi-vendor fallback plan gives you most of the resilience for free. Above roughly $2,000 a month, a 128GB workstation (about CAD $7,000) running Qwen 3.6 27B typically reaches break-even within eight to twelve months while covering 60-80% of routine token volume, and it adds outage resilience and data residency as side effects. Either way, keep frontier cloud models for architecture and long-horizon work; nobody credible is running fully local in 2026.

Sources

• Anthropic. (2026, June 13). "Statement on US government directive to suspend access to Fable 5 and Mythos 5." Read statement
• Anthropic. (2026, June 30). "Redeploying Fable 5." Read announcement
• CNBC. (2026, June 12). "Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive." Read article
• Willison, S. (2026, June 16). "The Fable 5 export controls." Read analysis
• Thereallo. (2026, June 30). "Claude Code is steganographically marking requests." Read write-up
• The Register. (2026, July 1). "Anthropic is removing its covert code for catching Chinese competitors." Read article
• The Register. (2026, July 8). "China tells devs to ditch Claude Code over 'backdoor code' fears." Read article
• Willison, S. (2026, July 16). "Kimi K3." Read review
• Bloomberg. (2026, July 17). "China's powerful new Moonshot AI model closes gap with US rivals." Read article
• Boykis, V. (2026, June 15). "Running local models is good now." Read essay
• Hacker News. (2026, June). "Ask HN: Has anyone replaced Claude/GPT with a local model for daily coding?" Read thread
• Semgrep. (2026, June). "We have Mythos at home: GLM 5.2 beats Claude in our cyber benchmarks." Read benchmark
• Thinking Machines. (2026, July 15). "Introducing Inkling." Read announcement
• The Washington Post. (2026, June 26). "US government will decide who gets to use GPT-5.6." Read article
• WPVIP. (2026, June). "Future of the Web 2026: consumer attitudes to AI content." Read survey