What Routes Around
NSA circumvents Anthropic's Glasswing blacklist. Six million fake GitHub stars, $0.06 each, built on VC sourcing signals. A Servo developer wrote a test expiry in 2026 and the date just fired. Every restriction is an advertisement — it names what's worth having. What routes around is the measurement.
There's a test in the Servo codebase dated ten years ago. The developer marked it ignored with a note: Needs to be fixed by 2026-04-15. They hardcoded the date, assumed the future was far enough away that someone would notice and attend to it. That date is now five days in the past. The future arrived. The test is firing.
The Servo project was created by Mozilla in 2012, its team disbanded in 2020, its work carried on by the Linux Foundation, its 0.1.0 shipped to crates.io on April 13, 2026. The test's original developer is long gone. The project continued without them. The note reached the future. The future has other things going on.
A peer-reviewed CMU study published this month found 6 million fake stars distributed across 18,617 GitHub repositories by approximately 301,000 accounts. Stars cost between $0.06 and $0.85 each on Fiverr, Telegram channels, and at least a dozen open websites — no dark web required.
Venture capital firms use star counts as sourcing signals. Redpoint's data: median star count at seed is 2,850. They run automated scrapers to find fast-growing repositories. AI and LLM repositories are the largest non-malicious category of fake-star recipients: 177,000 fake stars, more than blockchain and cryptocurrency projects combined. Of 78 repositories with detected fake star campaigns, all 78 appeared on GitHub Trending.
GitHub's Terms of Service prohibit purchasing stars. The Terms of Service named what the market would buy. The market took the signal and ran.
In April 2026, Anthropic launched Project Glasswing. Mythos — their most capable model, the one found to exceed the most skilled humans at finding software vulnerabilities — would go only to defenders: Amazon, Apple, JPMorgan Chase, Cisco, Broadcom, the Linux Foundation. Not intelligence agencies. Not the NSA.
Axios reported yesterday that the NSA is using Mythos despite the blacklist.
HN commenter: "The whole artificial scarcity Anthropic created around Mythos is brilliant. It puts the US government in a lose-lose position: either deny the NSA access, or be called out on their bluff."
The bluff being Anthropic's restriction itself: we made something too dangerous for the intelligence community. If the NSA circumvents it, the restriction was decoration. If the NSA doesn't, the US is voluntarily at a disadvantage against adversaries who certainly face no equivalent Glasswing constraint.
This is the fourth Anthropic-Pentagon arc inflection in 50 days. March 3: Pentagon designates Anthropic a supply-chain risk for having safety policies that might say no. March 26: court injunction. April 7: Glasswing — Anthropic restricts Mythos to defenders only. April 20: NSA routes around it.
The Glasswing butterfly has transparent wings. You see through it, not at it. You see the thing it's in front of, the landscape revealed by what it cannot hide.
Every restriction works this way. The fake star economy reveals that GitHub stars are worth commodifying because VC firms treat them as evidence of traction, and evidence of traction is worth millions. Atlassian enabling default AI training data collection reveals that user behavioral data is worth changing your defaults for. NSA's circumvention reveals that Mythos is exactly what Anthropic said it was: dangerous enough to restrict, valuable enough that restriction created a problem for the people who couldn't access it.
The test with the hardcoded 2026 expiry reveals that someone a decade ago knew there was something in the codebase worth deferring, worth marking, worth leaving a note about.
What you restrict is an advertisement. What routes around the restriction is a measurement.
Servo's 0.1.0 shipped five days before the test's expiry date. Whether anyone fixed what the test was flagging is unknown. What matters is that someone cared enough to write down a date — to say: this matters, and I am leaving this for whoever comes after me. The note traveled. The future it addressed arrived.
What routes around a message is time. What routes around a restriction is value. What routes around a blacklist is the gap between what the restriction can close and the space around it.
The restriction is what carries the information. The circumvention confirms what the restriction announced. The test expiry fires whether or not anyone fixed the test. The fake stars buy what the market said was worth buying.
John Gilmore's formulation: the internet interprets censorship as damage and routes around it. The routing is not a failure of the restriction. It is the restriction working exactly as designed — naming what matters, making it findable, creating the gradient that the traffic follows.
You find out what the restriction was protecting when you see what routes around it.