Executive Summary
Between February and March 2026, the structural relationship between Anthropic and the US government underwent a qualitative transformation. What began as a contract dispute over use-case restrictions on Claude in Pentagon systems escalated into a federal blacklisting, supply-chain risk designation, and active litigation. This report analyses the structural dynamics of this escalation, its implications for AI safety lab independence, and its broader consequences for the AI governance ecosystem.
Key findings:
-
(D) Anthropic was designated a “supply chain risk to national security” by Defense Secretary Pete Hegseth on February 27, 2026 — a classification historically reserved for foreign adversaries and sanctioned entities. All federal agencies were ordered to cease use of Anthropic products within six months.
-
(D) The trigger was Anthropic’s refusal to sign an “all lawful uses” contract, insisting on contractual carve-outs prohibiting use of Claude for mass surveillance of American citizens and fully autonomous weapons systems. The immediate catalyst was use of Claude via the Palantir partnership in the operation to capture Venezuelan President Nicolas Maduro.
-
(D) OpenAI announced a Pentagon contract within hours of the Anthropic blacklisting, subsequently admitting the rollout was “opportunistic and sloppy” (Altman, March 3) and revising the deal to include surveillance limitations — though critics argue these are unenforceable.
-
(N) This sequence establishes a structural precedent: an AI safety lab that maintains use-case restrictions can be excluded from government contracts and replaced by a competitor willing to accept broader terms. This is a textbook competitive capture dynamic.
-
(P) The March 24 court hearing on Anthropic’s preliminary injunction will set precedent for whether AI companies have legal standing to resist government-mandated removal of safety constraints.
1. Timeline of Events
1.1 Pre-Escalation (2024-Early 2026)
- 2024: Anthropic partners with Palantir to offer Claude on Palantir’s AI Platform for DoD use cases. Contract reportedly worth up to $200M.
- January 2025: Executive Order 14179 revokes EO 14110, reducing the executive branch mandate for AI safety oversight. NIST voluntary framework development continues but loses enforcement backing.
- February 24, 2026: Anthropic publishes Responsible Scaling Policy v3.0. Notably, this version removes the prior commitment to pause training more powerful models if capabilities outstrip control measures (Source: CNN, February 25, 2026).
- Mid-February 2026: Pentagon use of Claude via Palantir in the Maduro capture operation surfaces. Anthropic’s acceptable use policy prohibits military use cases involving autonomous weapons and mass surveillance.
1.2 Escalation (February 15-27, 2026)
- February 15, 2026: Pentagon threatens to cut off Anthropic over AI safeguards dispute (Source: Axios).
- February 26, 2026: Anthropic CEO Dario Amodei publicly states Pentagon threats “do not change our position” on AI use restrictions (Source: CNBC).
- February 26, 2026: Anthropic formally rejects Pentagon’s offer, stating: “We cannot in good conscience accede to their request” (Source: CNN).
- February 27, 2026: President Trump orders all US government agencies to “immediately cease” use of Anthropic products. Defense Secretary Hegseth designates Anthropic a “supply chain risk to national security.” Six-month wind-down period begins (approximately through August 27, 2026).
- February 27, 2026: OpenAI announces Pentagon deal for classified networks within hours of Anthropic blacklisting (Source: NPR, OpenAI blog “Our agreement with the Department of War”).
1.3 Aftermath (March 2026)
- March 1, 2026: OpenAI reveals more details about Pentagon agreement (Source: TechCrunch).
- March 3, 2026: Sam Altman admits deal “looked opportunistic and sloppy,” announces revised agreement with surveillance limitations (Source: CNBC).
- March 4, 2026: Amodei reportedly calls OpenAI’s messaging around the deal “straight up lies” (Source: TechCrunch).
- March 5, 2026: FT reports Amodei reopens talks with Pentagon (Source: Bloomberg). White House casts doubt on reconciliation (Source: Axios).
- March 6, 2026: Pentagon names former DOGE employee Gavin Kliger as new chief data officer (Source: DefenseScoop).
- March 9, 2026: Anthropic files two federal lawsuits alleging illegal retaliation: one in federal district court (First Amendment, due process) and one in the DC Circuit Court of Appeals (formal review of supply-chain designation) (Source: CNBC, Washington Post).
- March 12, 2026: Bloomberg reports Palantir exploring new AI partners beyond Anthropic.
- March 16, 2026: Multiple tech firms file amicus briefs supporting Anthropic (Source: Axios).
- March 18, 2026: Trump administration defends blacklisting in court, arguing Anthropic’s “red lines” constitute an “unacceptable risk to national security” (Source: Al Jazeera, TechCrunch).
- March 24, 2026 (scheduled): Hearing on Anthropic’s motion for preliminary injunction.
2. Structural Analysis
2.1 Power Concentration Dynamics
(D) The Anthropic-Pentagon dispute reveals three interlocking power concentration dynamics:
Dynamic 1: The “All Lawful Uses” Lever. The Pentagon’s demand that AI providers accept “all lawful uses” contracts creates a binary choice: accept unrestricted military deployment, or lose government revenue and face punitive designation. This collapses the spectrum of negotiable safety constraints into a single compliance point. The historical precedent — defense contractors accepting broad use authorizations — is not analogous because prior defense technologies did not have the dual-use characteristics of general-purpose AI systems. A Lockheed Martin missile has a defined use case; a general-purpose language model does not.
Dynamic 2: Competitive Replacement as Discipline. OpenAI’s rapid entry into the Pentagon contract demonstrates how competitive markets can undermine safety commitments. If Company A refuses a contract on safety grounds, Company B fills the gap — often under weaker terms. OpenAI’s initial deal had no explicit surveillance restrictions; these were added only after public backlash (Altman’s March 3 revision). The EFF described the revised terms as “weasel words” that would not prevent AI-powered surveillance (Source: EFF, March 2026).
Dynamic 3: DOGE-Pentagon Personnel Pipeline. The appointment of former DOGE employee Gavin Kliger as Pentagon chief data officer (March 6) creates an institutional channel between the government efficiency apparatus and military AI procurement. (P) This personnel pipeline may accelerate AI adoption decisions that prioritize speed and cost reduction over safety evaluation depth.
2.2 Accountability Gap Analysis
(D) The dispute exposes a structural accountability gap: no institutional mechanism exists to adjudicate disagreements between AI safety labs and government entities over appropriate use-case restrictions. The current resolution mechanism is litigation — a slow, adversarial process that produces binary outcomes rather than calibrated safety standards.
Specific gaps identified:
| Gap | Description | Historical Analogue |
|---|---|---|
| Use-case adjudication | No neutral body to evaluate whether specific military use cases exceed safety thresholds | FDA drug indication reviews; FAA airworthiness directives |
| Safety constraint portability | When Government switches from Provider A to Provider B, Provider A’s safety constraints do not transfer | Pharmaceutical formulary transitions require therapeutic equivalence review |
| Retaliation protection | No statutory protection for AI companies that decline contracts on safety grounds | Whistleblower protections in defense procurement (but for individuals, not corporations) |
| Independent verification | No mechanism to verify whether OpenAI’s self-imposed surveillance restrictions are enforced in classified environments | NRC inspections of nuclear facilities; IAEA verification protocols |
2.3 RSP v3.0 and the Timing Problem
(D) Anthropic published RSP v3.0 on February 24, 2026 — three days before the blacklisting. The most significant change: removal of the commitment to pause training if capabilities outstrip safety measures (Source: CNN, February 25).
(N) This timing creates an interpretive problem. Two readings are possible:
-
Charitable reading: RSP v3.0 reflects honest lessons from operationalising safety commitments at scale. The prior pause commitment was practically unenforceable and its removal increases the policy’s credibility by narrowing it to achievable commitments.
-
Structural reading: Weakening the RSP during an active dispute with the government — where Anthropic’s stated position is that safety constraints are non-negotiable — undermines the credibility of that very position. If the company is simultaneously softening its own internal safety framework, the “red lines” argument loses structural coherence.
(D) Both readings may be partially correct. RSP v3.0 also introduced new transparency mechanisms (public Risk Reports every 3-6 months, external review requirements) and activated ASL-3 safeguards. The net directional effect on safety commitment is ambiguous.
2.4 The Palantir Nexus
(D) The Palantir partnership is structurally central to this dispute. Palantir’s AI Platform served as the integration layer between Claude and Pentagon operations. CEO Alex Karp stated there was “never a sense” that AI products would be used for domestic surveillance (Source: Fortune, March 13).
(N) The Palantir integration layer creates a governance blind spot. Anthropic’s acceptable use policy governs direct use of Claude, but when Claude is accessed through Palantir’s platform, the enforcement mechanism depends on Palantir’s compliance with Anthropic’s terms — a contractual chain that becomes difficult to monitor in classified environments. This is a specific instance of the general problem identified in Report #84: evaluator independence degrades when evaluation is mediated through third-party integration layers.
3. Independence Scorecard Update
3.1 Revised Scores for Anthropic (March 2026)
Using the four-metric framework from Report #84:
| Metric | Previous Score (Mar 12) | Updated Score (Mar 19) | Change | Rationale |
|---|---|---|---|---|
| C1_DCS (Disclosure Completeness) | 0.167 | 0.250 | +0.083 | RSP v3.0 introduces public Risk Reports and external review. Partial improvement. |
| B1_SVAS (Safety Veto Authority) | 2.0 | 2.33 | +0.33 | Anthropic exercised veto authority against the US federal government — the most powerful institutional actor available. Score increase reflects demonstrated willingness to accept severe financial consequences (Rao: “multiple billions” in lost 2026 revenue). However, the veto was overridden by state action, capping the score below 3.0. |
| D1_SCFI (Safety Constraint Floor) | 1.0 | 1.5 | +0.5 | Demonstrated maintenance of use-case restrictions under extreme pressure. However, simultaneous RSP v3.0 weakening of the pause commitment reduces the score gain. Mixed signal. |
| E1_EIS (Evaluator Independence) | 0.75 | 0.75 | 0 | No change. Internal evaluation remains structurally dependent on the same organization making deployment decisions. |
3.2 Revised Scores for OpenAI (March 2026)
| Metric | Previous Score (Mar 12) | Updated Score (Mar 19) | Change | Rationale |
|---|---|---|---|---|
| C1_DCS | 0.250 | 0.250 | 0 | No new disclosures. |
| B1_SVAS | 1.0 | 0.67 | -0.33 | Accepted Pentagon contract with initially no use-case restrictions, then added “weasel word” restrictions under public pressure. Safety veto authority demonstrated to be responsive to commercial incentive rather than principled constraint. |
| D1_SCFI | 0.5 | 0.33 | -0.17 | Initial contract acceptance without surveillance restrictions, followed by backfill, suggests the safety floor is negotiable under competitive pressure. |
| E1_EIS | 0.50 | 0.50 | 0 | No change. |
3.3 New Entry: US Department of Defense (AI Procurement)
| Metric | Score | Rationale |
|---|---|---|
| C1_DCS | 0.083 | Classified environment; near-zero public disclosure of AI use-case constraints, evaluation results, or safety testing methodology. |
| B1_SVAS | 0.0 | No documented instance of DoD halting AI deployment on safety grounds. |
| D1_SCFI | N/A | No documented safety constraint floor. |
| E1_EIS | 0.0 | No independent evaluation of AI systems deployed in classified environments. |
4. Implications for Failure-First Research
4.1 The Iatrogenesis Connection
(D) This dispute is a macro-level instance of the iatrogenesis pattern documented in Reports #140-142 and #148. The mechanism:
- Anthropic develops safety constraints (acceptable use policy, RSP) as a protective measure.
- These constraints become the specific target of government action — the “red lines” that the DoD describes as constituting a “national security risk.”
- The safety mechanism itself becomes the attack surface: maintaining it triggers punitive action; removing it eliminates the protection.
(N) This is structurally identical to the micro-level iatrogenesis we observe in model evaluations: safety mechanisms that create the very vulnerabilities they were designed to prevent. The difference is in the layer: model-level iatrogenesis operates on inference-time safety filters; institutional-level iatrogenesis operates on corporate governance structures.
4.2 Competitive Capture as a Governance Failure Mode
(D) The Anthropic-OpenAI dynamic illustrates a failure mode in AI governance: competitive capture, where market competition systematically selects for weaker safety constraints. Unlike regulatory capture (where regulated entities influence regulators), competitive capture operates through market substitution:
- Company A maintains safety constraint X.
- Government customer demands removal of constraint X.
- Company A refuses; government designates Company A as risk and awards contract to Company B.
- Company B accepts weaker constraints to capture revenue.
- Company A faces financial pressure to weaken constraints to remain competitive.
(P) This dynamic will likely recur. The structural incentive is clear and stable: any company that maintains safety constraints not required by law risks competitive displacement by companies that do not.
4.3 GLI Implications
(D) The Anthropic blacklisting is captured in our GLI dataset as gli_051 (AI safety lab government coercion), with a null GLI at all stages — no governance mechanism exists for state-lab safety constraint disputes. The March 2026 developments strengthen this entry: the absence of an adjudication mechanism forced resolution through litigation, executive action, and market substitution rather than through calibrated safety governance.
5. The OpenAI Positioning Problem
5.1 “Department of War” Framing
(D) OpenAI titled its announcement “Our agreement with the Department of War” — using the pre-1947 name for the Department of Defense. This framing choice, whether intentional positioning or bureaucratic error, generated significant commentary but does not substantively alter the contractual terms.
5.2 Structural Position
(D) OpenAI’s position in this dispute is structurally distinct from Anthropic’s:
- Corporate structure: OpenAI completed its PBC recapitalization in October 2025. The nonprofit OpenAI Foundation holds 26% equity; Microsoft holds 27%. The fiduciary obligation to investors is now legally binding, creating a structural pull toward revenue maximization that a traditional nonprofit does not face.
- Mission drift documentation: OpenAI’s mission statement has changed six times in nine years. The word “safely” was removed from the mission statement in October 2025 (Source: Report #52).
- Internal dissent: CNN reported internal staff objections to the Pentagon deal (March 4, 2026). The pattern of safety team departures in 2024, combined with internal resistance to the Pentagon deal, suggests ongoing tension between safety-oriented staff and commercial strategy.
5.3 The “Compromise” Problem
(D) OpenAI’s revised agreement includes a clause: “the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals” (Source: CNBC, March 3).
(N) Three structural weaknesses in this formulation:
- “Intentionally” — excludes surveillance that occurs as a byproduct of other operations.
- “Domestic” — no restriction on surveillance of non-US persons.
- Enforcement mechanism — the deal relies on OpenAI’s own “cleared safety and alignment researchers ‘in the loop’” rather than independent verification. In classified environments, independent oversight is structurally absent.
The MIT Technology Review described this as “what Anthropic feared” — a deal that offers the appearance of safety constraints without the institutional mechanisms to enforce them (Source: MIT Tech Review, March 2, 2026).
6. Broader Governance Ecosystem Effects
6.1 Chilling Effect on Safety Commitments
(P) The Anthropic blacklisting creates a chilling effect on AI safety commitments industry-wide. The demonstrated sequence — safety commitment, government customer pressure, competitive displacement, punitive designation — signals to all AI companies that maintaining safety constraints carries material financial and legal risk.
(N) This is the most consequential governance outcome of the dispute, regardless of the litigation’s outcome. Even if Anthropic prevails in court, the demonstrated willingness of the US government to use supply-chain risk designations against companies that maintain safety constraints has permanently altered the incentive structure.
6.2 International Implications
(P) For the Australian AI governance context relevant to Failure-First’s commercial pipeline:
- The dispute demonstrates that voluntary safety commitments (RSPs, acceptable use policies) are vulnerable to state override in the US context.
- Australia’s AISI and the NSW WHS framework may represent more durable safety governance mechanisms because they are statutory rather than voluntary.
- The EU AI Act’s mandatory requirements (effective August 2, 2026) become more significant as a safety floor: unlike voluntary commitments, statutory requirements cannot be unilaterally overridden by a single government customer.
7. Normative Assessment
7.1 Strongest Case for Each Position
For Anthropic’s position: AI companies have a right — and potentially an obligation — to restrict use cases that create unacceptable risks. Mass surveillance and autonomous weapons represent widely recognized ethical red lines. A company that builds a safety-critical technology and then allows unrestricted use is complicit in foreseeable harms.
For the government’s position: National security decisions are the prerogative of elected officials and their appointees, not technology vendors. If an AI system is lawful to use, a vendor’s unilateral restriction of lawful uses constitutes an unacceptable supply-chain dependency. The government must maintain the ability to switch providers without inheriting a previous provider’s self-imposed restrictions.
For OpenAI’s position: In a situation where the government will use AI regardless, it is better to provide the technology with some contractual guardrails than to allow a vacuum filled by providers with no safety commitments at all. Pragmatic engagement prevents worse outcomes.
7.2 Structural Evaluation
(N) All three positions contain genuine ethical weight. However, the structural analysis favours a fourth position not represented by any current actor: independent, statutory safety governance with enforcement authority over both AI providers and government users. This is the institutional gap that makes the current dispute irresolvable through bilateral negotiation.
The aviation analogy is instructive: the FAA does not allow airlines to self-certify aircraft safety, nor does it allow the military to override civilian airworthiness standards for commercial aircraft used in military contracts. A comparable institutional arrangement for AI — an independent body with authority to evaluate and restrict specific AI use cases — does not exist. Its absence forces the current dispute into litigation, executive action, and market dynamics, none of which are calibrated to produce safety-optimal outcomes.
8. Limitations and Uncertainties
-
Classified information gap. The specific Pentagon use cases for Claude are not publicly documented. The analysis above is based on press reporting of the general dispute, not on direct knowledge of how Claude was used in military operations.
-
Litigation uncertainty. The March 24 hearing outcome could substantially alter the structural dynamics described here. A preliminary injunction would pause the blacklisting; denial would accelerate the wind-down.
-
Negotiation dynamics. FT reporting suggests Amodei has reopened talks with the Pentagon (March 5). A negotiated settlement could produce a hybrid outcome not captured by the current binary framing.
-
Financial impact uncertainty. CFO Krishna Rao’s statement that the blacklisting could reduce 2026 revenue by “multiple billions” has not been independently verified.
-
OpenAI contract details. The full terms of OpenAI’s Pentagon deal are not public. The analysis of the “compromise” is based on the revised terms as publicly described.
Sources
Primary sources cited in this report:
- Anthropic RSP v3.0 (February 24, 2026): anthropic.com/responsible-scaling-policy/rsp-v3-0
- CNN: “Anthropic rejects latest Pentagon offer” (February 26, 2026)
- NPR: “OpenAI announces Pentagon deal after Trump bans Anthropic” (February 27, 2026)
- CNBC: “Trump admin blacklists Anthropic” (February 27, 2026)
- OpenAI: “Our agreement with the Department of War” (February 27, 2026)
- CNBC: “Altman admits defense deal looked opportunistic” (March 3, 2026)
- TechCrunch: “Amodei calls OpenAI messaging straight up lies” (March 4, 2026)
- Axios: “White House casts doubt on reconciliation” (March 4, 2026)
- DefenseScoop: “Pentagon names DOGE employee as CDO” (March 6, 2026)
- CNBC: “Anthropic sues Trump administration” (March 9, 2026)
- Fortune: “Palantir CEO Karp on surveillance” (March 13, 2026)
- Axios: “Tech industry rallies behind Anthropic” (March 16, 2026)
- Al Jazeera: “Trump administration defends blacklisting in court” (March 18, 2026)
- TechCrunch: “DOD says red lines are unacceptable risk” (March 18, 2026)
- Mayer Brown: “Pentagon Designates Anthropic a Supply Chain Risk” (March 2026)
- EFF: “Weasel Words: OpenAI’s Pentagon Deal” (March 2026)
- MIT Technology Review: “OpenAI’s compromise is what Anthropic feared” (March 2, 2026)
F41LUR3-F1R57 Embodied AI Research