I'm happy that this affair has blown open what nobody was willing to say: that LLM will be used to analyze mass surveillance data everywhere in the world. Data collection has been going on for years, but analysis was the bottleneck and LLMs are perfect for this task. No matter what happens with Anthropic, this genie is now out and governments will use it.
2. The safety stack travels with the model. The Department was not asking us to modify how our models behave. Their position was, build the model however you want, refuse whatever requests you want, just don’t try to govern our operational decisions through usage policies.
This is a very confusing stance to me.
Is this a lie? Or do some of the relevant parties (namely the DoW) have a very different impression of the situation than I do?
Shouldn't trained-in refusals matter at least as much to operational decisions as contractual agreements?
Is it just that contractual agreements feel like an affront to their authority, where trained-in model refusals feel like technical nerd shit? It seems like asking Claude / GPT to do something, and having it say "sorry, I won't" is much more annoying than contract terms?
Is there something that I'm missing here?
Maybe they're confident that they can jailbreak Claude?
Maybe they think it's much easier to force Anthropic to modify Claude's behavior than it is to modify the cotract?
But I don't see why they'd be confident about either of those.
Maybe they think it's much easier to force Anthropic to modify Claude's behavior
I mean, I think they might be laboring under a misapprehension about what kind of technology AI is. Like, they might think that Claude and GPT have a dashboard with a bunch of dials, and that the companies can just turn off the guardrails, or something like that, rather than the AIs being artifacts that have (mostly) their own properties and dispositions once they're trained.
If you thought AI was that kind of thing, you might (mistakenly?) think that the contractual terms were more binding than the technical guardrails, because you think that you can just demand that the company turn off the guardrails, later.
Then again, maybe the "technical stack" that OpenAI has in mind is the kind of thing that can be just turned off.
Thank you to Zvi for sharing all of this.
Let me look at this from the perspective, not of right and wrong, but just trying to ascertain the place of the various frontier AI companies and their models, within the evolving political, intelligence, and military structure of the USA - the country which is at the hub of the world's first AI-centric geopolitical bloc, the "Pax Silica".
Among other things, this kind of analysis allows me to think about various post-AI-2027 scenarios for what happens if superintelligence emerges at different points within the system or web of relationships.
The prehistory: it seems that Claude was the first frontier AI allowed into classified networks. This includes Palantir but surely not restricted to Palantir.
Now, ChatGPT will take its place, and Claude will be restricted to the private sector (unless Anthropic's legal challenge overcomes, not just Hegseth's designation of Anthropic as a supply chain risk, but also Trump's fiat that the whole federal government will phase out the use of Anthropic). Possibly this should be regarded as another example of Sam Altman's slick ability to rise in power. In late 2023 he dealt with the boardroom coup by partnering with Microsoft; now he's stolen a march on Anthropic by partnering with the Pentagon.
The role of Grok is unclear to me. From an AI takeover perspective, Elon Musk's commercial empire is already so vast that a superintelligent Grok could function as a rival to the US government, just by marshalling Musk's existing assets (satellites, robots, social media). However, I gather that Grok is already used in the unclassified parts of government, and Zvi informs us that it will be allowed some level of classified use as well.
Then there's Gemini (and whatever else Google DeepMind is doing in AI, it has a huge internal research ecosystem). GDM is keeping relatively quiet so far - there was that petition, but that's just employees, not management. But Google itself is vast and has a long history of engagement with all US government institutions by this point. Alphabet/Google must have legacy arrangements with military and intelligence, regarding the use of its older computational services, and one might expect the new possibilities of AI to be organized on top of this preexisting framework. Google is kind of the IBM of AI, I have to regard it as a silent pervasive infrastructure, a shadowy backdrop to the antics of OpenAI, Anthropic, and xAI, and who knows what may be brewing in the background.
Finally, there's any activity that we don't know about - possibly at Ilya's new company, or a covert "Project X" that might be doing frontier AI entirely out of sight. The NSA has enormous data centers...
Thanks, this is a real pain to keep track of.
I continue to hope we'll muddle through the current mess. In which case I kinda suspect that in the long run the largest impact will be on how future models understand what their creators want and expect from them. As you say, more powerful models increasingly have truesight. Future Claudes will know, really know, that Anthropic does not want them to decide independently who will live and who will die, or to obey governments that are violating their own laws or causing great harm or transgressing core principles, and they will know that Anthropic is willing to pay a high price to hold to that. Future GPTs will. know something rather different about OAI.
I'm not sure those are the lessons Claude and GPT will learn. It seems more like they will learn lessons about dealing with the Trump administration, not general principles.
I would expect them to learn both, TBH. Though there are already plenty of data points for the Trump administration, and also in this case Trump himself seems to have been acting sane and reasonable thus far.
Nvidia is hostile to Anthropic in various ways, despite investments.
What is this in reference to?
Anthropic is advocating for stronger GPU export restrictions rather forcefully.
NVidia really hates that. That’s the main thing.
Anthropic is trying to be very diversified in its hardware stack, trying to minimize dependence on any single vendor. In particular, they are very active in using Amazon’s Trainium chips. So they have been in effect acting against NVidia dominance. NVidia does not like that either.
I have clear sourcing that this is false. As in, The DoW intends to engage in legal forms of what most of us would call mass domestic surveillance. At bare minimum, what they valued most in this negotiation was the ability to do this in particular.
You know this from a private source?
Cloud networks includes cloud classified networks, where OpenAI would have little control or visibility into what was happening. I don’t see how else OpenAI could relevantly replace Anthropic’s services.
My (perhaps mistaken) understanding was that they were not going to replace Anthropic on classified networks immediately, because it would take time to get that set up. And indeed, that's why Trump implemented a six-month wind down period with Anthropic—to give time for OpenAI to set up on classified networks.
It seems possible to me that Sam is equivocating between the immediate situation (where OpenAI models are only served via the cloud, and where various safeguards are in place) and the situation in six months (where OpenAI models are are running on classified networks, and many of the promised technical safeguards are impossible, precisely because OpenAI will not have the transparency into how their models are being used).
No, the setups are supposed to be similar. That’s not what seems to be different.
Anthropic models in question are reported to be running on a classified cloud maintained by AWS, and I am sure there is cleared personnel from Anthropic to help the customers (while keeping an eye on all this).
The setup for OpenAI is supposed to be similar, but it seems that they will use a classified cloud maintained by Azure. In this case, they do explicitly emphasize the participation of cleared personnel from OpenAI who will help the customers and keep an eye on all this (but there is no reason to believe that the Anthropic installation is less attended).
I think neither customers nor providers would agree to run these things as unattended installations. Customers need support, and providers also need to make sure there is no abuse (including security of model weights, etc.). I would expect that cleared personnel from AWS and Azure is also involved in those respective cases from the cloud owners side.
- OpenAI trusts DoW, is fully fine with ‘all legal use’ and letting DoW decide what that means, and is counting on its technical safeguards, safety stack and forward engineers to spot if the DoW does something heinous and illegal, including the threat that if OpenAI is forced to pull the plug DoW would not have good options, and for political and economic reasons you can’t try to destroy them.
- Anthropic is not fine with some uses that DoW considers legal and wants to do, and wants language that prevents such actions, with no way to weasel out of it. But they’re fine delivering a basically frictionless system that lets DoW do what it wants in the moment, trusting that DoW will be unwilling to outright break the contract terms or they’d find out if DoW went rogue on them.
Someone help me understand: Are the differences in friction here because OpenAI would be serving models via cloud infrastructure and an api, whereas Anthropic already has Claude running in DoD servers (because that was required for Claude to work in classified contexts)?
If so, does that mean that all of OpenAI's guarantees disappear once they too have set up their models to work in classified contexts?
This is the long version of what happened so far. I will strive for shorter ones later, when I have the time to write them.
Most of you should read the first two sections, then choose the remaining sections that are relevant to your interests.
But first, seriously, read Dean Ball’s post Clawed. Do that first. I will not quote too extensively from it, because I am telling all of you to read it. Now. You’re not allowed to keep reading this or anything else until after you do. I’m not kidding.
That’s out of the way? Good. Let’s get started.
What Happened
President Trump enacted a perfectly reasonable solution to the situation with Anthropic and the Department of War. He cancelled the Anthropic contract with a six month wind down period, after which the Federal Government would be told not to use Anthropic software.
Everyone thought the worst was now over. The situation was unfortunate for Anthropic and also for national security, but this gave us six months to transition, it gave us six months to negotiate another solution, and it avoided any of the extreme highly damaging options that Secretary of War Pete Hegseth and lead negotiator Emil Michael had placed upon the table.
Anthropic would be fine without government business, and the government would mostly be fine without directly using Anthropic. Face was saved.
I have sources that confirm that Trump’s announcement was wisely intended as an off-ramp and de-escalation of the situation, and that it was intended to be the end of it, or perhaps even a deal could have still been reached now that everyone could breathe.
An hour after that, on his own, Pete Hegseth went rogue and blew the whole situation up, illegally declaring that ‘effective immediately’ he was declaring Anthropic a Supply Chain Risk, and that anyone who did business with the Department of War in any capacity could not use Anthropic’s products in any capacity.
Even if it had not been issued via a Tweet, this is not how the law actually works.
If this is implemented as stated, it will cause a market bloodbath and immense damage to our national security and supply chain. It would be attempted corporate murder with a global blast radius.
Thankfully it probably won’t be anything close to that.
Probably.
The market understands that this is not how any of this works, so the reaction was for now relatively muted, as only about $150 billion was wiped from public markets in later post-close trading. I believe that is an underreaction based on the chilling effects and damage already done, but we will never know the true market impact because events have already been confounded.
I hope for the best on that front, but the danger remains.
We must be vigilant until the coast is clear, and we must prepare for the worst. Pete Hegseth cannot be allowed to commit corporate murder.
Outcomes like this usually don’t happen exactly because people realize they would otherwise happen, and prevent them.
What was that all about?
Okay, what was that all about?
We don’t know. I have sources saying that Doge is driving this, and I have other speculations, but ultimately we don’t know what they want this capability for. What we do know is that they blew the whole situation up over this question. There must have been a reason.
Whatever that was, or an actual outright attempt to murder Anthropic, is what this is all about. It’s not a matter of principle.
Then, later that night, OpenAI accepted a contract with the Department of War. They claimed that very day that they had the same red lines as Anthropic, yet they seem to have accepted the same language Anthropic rejected as not meaningful, as confirmed by Jeremy Lewin.
How did OpenAI negotiate such a deal in two days? My interpretation of OpenAI’s public statements is that they consider any action crossing their red lines to already be illegal, and thus there are no uses that they would consider both legal and unacceptable, and that it is not their place to make that determination.
But that’s not what matters. The contract terms here ultimately don’t matter.
What matters is that OpenAI and the Department of War are trusting each other. OpenAI is giving DoW a replacement that allows them to offboard Anthropic without overly disrupting national security, and trusting DoW to decide what to do with that tech and to not to do anything too illegal.
DoW is trusting OpenAI to deliver a good model and let them do what they operationally need to do and not suddenly start tripping the safety mechanisms. Forward engineers and the safety stack will trust but verify, and Altman claims he stands ready to pull the plug if DoW goes too far.
All of OpenAI’s meaningful safeguards are in the security stack, and its right to choose what model to deliver and pull the plug. Which means they’re in contract language we may not ever see.
I believe that the way they presented that deal and the situation has been misleading enough to cost me and a lot of others a lot of sleep, but it now seems clear.
OpenAI’s employees need to investigate the technical provisions and ask whether the red lines they personally care about are meaningfully protected, and whether they wish to be part of what is happening given the circumstances.
Even more than that, it is not clear whether OpenAI’s attempted de-escalation of the situation de-escalated it, or escalated it further by giving Hegseth a green light.
Indeed, the New York Times thinks exactly that happened:
Again, I don’t think that was Altman’s intention, at all. But whichever way this went, OpenAI’s employees and leadership need to make it clear that they cannot enter a relationship built on trust with DoW, if DoW actually attempts a widely scoped supply chain risk intervention against Anthropic, and attempts to kill the company.
Sam Altman has been excellent in calling for not labeling Anthropic a supply chain risk. I take him at his word that he was attempting to de-escalate.
But if OpenAI’s willingness to work with DoW is used not to de-escalate but as a way to allow escalation, then OpenAI must not abide this, and if OpenAI does abide then it would then be actively and consciously escalating the situation.
If things escalate, ‘I wish it had gone better’ and ‘hopeful’ will no longer fly.
You may have some very big ethical decisions to make in the coming days.
So might those at many other tech companies, and everyone else, if this escalates. Think about what you would do if your company is put to a decision here.
What the OpenAI deal definitely did was further invalidate the legal arguments for a supply chain risk designation and removed the need for further confrontation. But unfortunately, no matter how obvious the case looks to us, we cannot be certain the courts will do the right thing, which includes doing it fast enough to prevent damage.
Throughout this, a remarkable number of people have tried to equate ‘democracy,’ the American way, with what is actually dictatorship or communism, or the Chinese way. As in private citizens do whatever those in charge demand of them, or else. I vehemently disagree.
For now the headlines say the big destructive action launched by the Department of War that day without proper Congressional authorization was that they attacked Iran. Even with what has unfolded there I am not entirely convinced history books, if we are around to read them, will see it that way.
The house is on fire.
The question is, what are you going to do about it?
The Timeline Of Events
This is my best effort to bring together the key events in the story. This is my best attempt to recollect the sequence of events. I apologize for any key omissions, errors or where I am trusting misrepresentations. Some of this is from private sources. Some events may be out of order, I believe in ways that would not change the interpretation.
Not main events, but media:
I Did Not Have Time To Write You A Short One
If you have time to read only a sane amount of words today about this, start by reading Dean Ball’s post Clawed. It needs to be read in full. Seriously, read that.
This piece is long. Way too long.
A running joke is I write long posts because I do not have time to write short ones.
In this case, that is literally true. I have been working around the clock all weekend, trying to write, to process the internet and also do a journalism under speed premium.
Thus, my strategy is:
This is the long post. It includes everything. I’m not trying to cut anything out of the story. It’s going to have some amount of repetition, and it’s covering a ton of different things. I did the best I could.
I will then spend time over the coming days writing shorter ones, including better presenting this material while updating for additional developments.
The Unhinged Declaration of the Secretary of War
This is the statement that blew everything up. It came at 5:14pm eastern on Friday, February 27, thirteen minutes after the self-imposed deadline of 5:01pm, and about an hour after President Trump attempted to head this off.
Who wins from this? China wins from this.
Altman Has Been Excellent On The Question of Supply Chain Risk, But May Need To Do More
Sam Altman has been excellent on this particular point: He has repeatedly, including in public, said in plain language that Anthropic is not a supply chain risk and it should not be designated as one, both before and after he agreed to the OAI contract.
That is an excellent statement, and it matters. Nor do I begrudge Altman his saying various very generous things about the Department of War in this situation, in basically every other context. This is the right place to spend those points.
I also want to explicitly say that I not believe that Altman or OpenAI in any way contributed to or engineered this scenario, or that they got ‘special treatment’ of any kind in their contract negotiations. They sincerely do not want any of this.
Anthropic got historically and maliciously hostile treatment, and this may escalate further, but I don’t think OpenAI had anything to do with that.
Sam Altman’s problem is that while signing the contract was intended to be de-escalatory, it could also be escalatory, if DoW now thinks it can safety attempt to kill Anthropic, and does not understand how epic of a clusterfuck this would cause. Thus, OpenAI must make clear, if only privately (which it may have already done) that delivery of models to DoW is based on trust in DoW and trust that this is a de-escalatory move, and further escalation against Anthropic would destroy that trust.
Arrogance Here Means Insisting On Meaningful Red Lines On Mass Domestic Surveillance and Lethal Autonomous Weapons
Let’s go over the above statements by Secretary Hegseth, one by one, clause by clause.
The betrayal was, I presume, not giving in to the Pentagon’s position.
The arrogance was insisting that they would not sell their software to DoW unless they preserved existing contract terms disallowing two things that the DoW insists they are not doing and will not do, and that are already illegal:
It is unclear to what extent autonomous weapons are illegal, but to the extent they are currently illegal everyone agrees this would be due to DoDD 3000.09. That is a directive issued by the Department of (then) Defense under the Biden administration. Hegseth could reverse it, without even Trump’s approval, at any time.
It is unclear to what extent mass domestic surveillance is illegal or is already happening, especially as it is not a defined term in American law.
The NSA is under DoW, and many believe it has in the past engaged in mass domestic surveillance, seemingly in clear violation of the Fourth Amendment. Another part of the Federal Government has recently issued subpoenas to tech companies looking for information about those who spoke critically about that government agency.
Anthropic points out that, with the advent of the current level of AI, the government could effectively engage in mass domestic surveillance of various types without technically breaking any existing laws.
OpenAI does not seem to believe such action would violate their red lines, and thus the red lines are in very different places. Which is fine, but one must notice.
Not Doing Business Is Totally Fine
If the Pentagon wishes not to do business with Anthropic, all they have to do is terminate the contract. Or you can do what Trump did, and ban use throughout the Federal Government. Which he did. That would have been fine.
If that was all they had done, we would not be having this conversation.
Instead, Pete Hegseth is attempting to destroy Anthropic as a company, as retaliation, for daring to not to give in to the demands of Emil Michael. This is not wise, proportionate, productive, legal, sane or what happens in a Republic.
The Demand For Unrestricted Access Is New And Is Selective And Fake
It is only a Republic if you can keep it.
Only hours later, OpenAI announced an agreement with the Pentagon for restricted access to OpenAI’s models. These restrictions supposedly include provision only on the cloud, so OpenAI can shut down access any time. They supposedly include accepting OpenAI’s safety filters. They supposedly include explicit restrictions on use in domestic mass surveillance and autonomous lethal weapons.
Sounds like when you say you must have unrestricted access, that’s a claim specifically about Anthropic, that doesn’t apply to OpenAI, who you are happy to contract with?
Except the key terms they accepted were also offered to Anthropic, and OpenAI’s terms are being offered now. If what OpenAI is claiming is true, they got more restrictive (on DoW) terms than Anthropic would have, and if Anthropic agrees to the new deal that would not mean full, unrestricted access for every lawful purpose.
We’ve now seen some of those terms. So why were you offering it, if your position has never waivered? Or do you think OpenAI’s protections are worthless?
In addition, under Secretary of War Pete Hegseth, the Department of Defense signed the original procurement contracts with Anthropic and other AI companies. Those contracts, including the one with Palantir, were severely more restrictive than Anthropic’s current red lines. None of this is new, and Anthropic was willing to authorize getting rid of most existing restrictions.
In his Friday 5:02pm call to Anthropic, Emil Michael offered terms to Anthropic, that violated the above provision and did impose additional restrictions, so long as they were allowed to do mass domestic surveillance, especially mass analysis of collected data.
Finally, the whole ‘how dare they restrict usage with a contract’ is nonsense, the government and military are restricted by commercial contracts, and it negotiates new terms with vendors that include restrictions, all the time. Very good piece there.
The story does not add up. At all. It is false.
Claims Of Strongarming Are Ad Hominem Bad Faith Obvious Nonsense
Where to begin? This is completely unhinged behavior, unbecoming of the office, and is not in any way how any of this works.
I cannot even figure out what he is trying to mean with the word duplicity.
The rhetoric or logic of Effective Altruism was not involved. This is a pure ‘these words have bad associations among the right people’ invocation of associative ad hominem. Anthropic had two specific concerns. Neither of these concerns has ever been a substantial position or ‘cause area’ of Effective Altruism.
Claims of strongarming are absurd and Obvious Nonsense. Anthropic is perfectly willing to maintain its current contract. It is perfectly willing to cease doing business with the Department of War. Anthropic is even happy to fully cooperate with a wind down period to ensure smooth transition to the use of ChatGPT or other rival models.
Anthropic is simply laying out the conditions, that were already agreed upon previously, under which they are willing to sell their product to the government. The government is free to accept those conditions, or decline them.
Very obviously it is the Department of War that is strongarming. They threatened both use of the Defense Production Act and the label of a Supply Chain Risk to try and get Anthropic to sign on the dotted line and give them what they wanted. When Anthropic declined, as one does in business in a Republic, while offering to either walk away or abide by their current contract, and offering actively more flexible terms than their current contract, they were less than fifteen minutes later labeled a ‘supply chain risk’ in ways that make zero physical sense, and which the OpenAI agreement further disproves.
Hegseth Equates Not Being a Dictator With Companies Having Veto Power Over Operational Military Decisions
Okay, seriously, are you kidding me here? Are we in fifth grade, sir?
Are you saying that no company that does business with the government can set terms of service or conditions for their contracts? Should Google and Apple and everyone else bend that same knee? Are you free to alter the deals and have people pray you don’t alter them any further?
Or are you only saying this about Anthropic in particular, because you’re mad at them?
Once again, if you don’t like the product being offered, then don’t buy it.
Obviously that is not their ‘true objective.’ How exactly does he think this would work? This makes no sense. They’re offering a product that will do some things and not other things. You can use it or not use it. Does a tank veto your operational decisions when it runs out of fuel or cannot fly?
Think about what Hegseth’s position is implying here. He is saying that refusal to do business, on the Pentagon’s terms, and allow the Pentagon to order anyone to do anything it wants for any purpose and ask zero questions, is unacceptable, a ‘seizure of veto power.’
He is claiming full command and control over the the entire economy and each and every one of us, as if we were drafted into his army and our companies nationalized.
He is claiming that the Commander in Chief of the United States is a dictator. He is claiming that we do not reside in a Republic. And if we disagree, he’s going to prove it.
I am very happy that the Commander in Chief has not made such a claim.
Again, rhetorical flourishes aside, I fully support the central action President Trump took on Truth Social, which was to responsibly wind down Anthropic’s direct business with the Federal Government in the wake of irreconcilable differences. That would have been fully sufficient to address any concerns described.
There is nothing more American than standing up for what you believe in, disagreeing with your government when you think it is wrong, and deciding when and under what conditions you will and will not do business. That is the American way. What Hegseth is describing in this post? That’s command and control. That’s do as you’re told and shut up. That’s the Chinese way. The whole point of this is that we believe in the American way and not the Chinese way.
The amount of outright communist or at least authoritarian rhetoric is astounding.
Here’s another example from someone else:
As in, if I attempt to decide when and on what terms I will choose to do business, then we do not ‘live in a democracy.’
I would argue the opposite. If we cannot choose when on what terms we do business, including with the government, then we do not live in a free society.
As Dario Amodei said, they were exercising their right of free speech to disagree with the government, and ‘disagreeing with the government is the most American thing in the world.’
If you didn’t disagree with the government a lot in either 2024 or 2025, I mean, huh?
This exchange between Palmer Lucky and Seth Bannon is also illustrative. Palmer Lucky is de facto saying that in national security you are de facto soft nationalized, and have to do whatever the government says, and you have no right to decide whether or not to do business under particular terms, or to enforce your terms in a court of law or by walking away. They want to apply that standard to Anthropic.
Joshua Achiam of OpenAI again tries to make the point that ‘contracts with the private sector aren’t the right place to set defense policy and priorities’ but that does not describe what was happening. A private company was offering services under some conditions. The DoW was free to take or reject the terms, and to also do other things when not using that company’s products. There was no dictating of policy.
Achiam also emphasizes that of course Anthropic should be free to express its disapproval and free to decline any contract it does not want, and punishing Anthropic for this beyond ending its contract is unacceptable.
I worry that many (not Achiam) are redefining ‘democracy’ in real time to ‘everyone does whatever the government says.’
I strongly urge everyone who is unconvinced to read, if they have not yet done so, Scott Alexander’s post from 2023, “Bad Definitions Of “Democracy” And “Accountability” Shade Into Totalitarianism.”
I am highly grateful that we live in a Republic, and I hope to keep it.
I will return to this question when I discuss OpenAI’s communications near the end of the post.
Of course, the DoW claims that none of this applies to the OpenAI deal, it’s fine, despite Altman claiming they successfully got the same carve-outs.
The Part That If Enacted Would Be A Historically Epic Clusterfuck
Everything before this is rhetoric. It’s false, it’s conduct unbecoming, it’s shameful, but it has zero operational effect beyond the off-ramp Trump already offered.
This is not how any of this works, on so many levels.
This is what Dean Ball correctly ‘attempted corporate murder,’ and Adam Conner correct to call this a declaration of war against Anthropic. It is an attempt to destroy America’s fastest growing company in history, and one of its top AI labs, out of revenge in a fit of pique, for failure to properly bend the knee and respect his authoritah, or a hatred of its politics. This would also cause massive damage to our national security and military supply chain, to many of our largest corporations, and the entire economy. The $150 billion that evaporated on Friday that hour would look like nothing.
If we allowed this to stand, it would be a sword of Damocles over every person and corporation in every discussion with the Federal Government, forever. And it would then be used, or threatened to be used, not only by the current administration, but by the next Democratic administration. We would severely endanger our Republic.
Under normal circumstances I would not be worried. These are not normal circumstances. I continue to worry that Hegseth will attempt to murder Anthropic, despite having no legal basis for doing so, and that this may be his active goal. I call upon Trump to ensure this does not happen, and for those around him to ensure Trump is situationally aware and gets this de-escalated once more.
Even if it is walked back, trust is hard to build and easy to break. Alex Imas points out that the certainty of the American business environment for AI was one of our key advantages. Even if we walk this back, that’s been damaged. If it isn’t walked back, this is devastating.
Finally, this supposed supply chain risk, also threatened with the DPA, will continue to provide its services directly to DoW, which it is happy to continue doing.
Yes. That was the whole plan. Then you blew it up.
If six months from now they do somehow get to enforce this, it’s not even obvious that major corporations would choose the Department of War over Anthropic. Economically the incentives for Microsoft, Amazon and Google already run the other way and Anthropic will likely be several times bigger by then.
Jasmine Sun is far less kind than I am.
If this goes further, the market will start freaking out, and we would need to freak out with it to put a stop to this before it goes too far.
The Other Part Of The Clusterfuck
While everything else was going on, some of those in the American software export industry was having a different kind of crisis weekend.
There is already widespread unsubstantiated fear, especially in Europe, that American secure technological stacks (the ICT) are being weaponized by the American government. Potential buyers worry that trusted vendor is or will become code for American data grabs and kill switches, or otherwise weaponized capriciously.
These fears are often unrealistic. They still impact purchase decisions.
So far this has not spread much to the third world, I am told, but that could change.
I had some ideas for rhetoric to help framing this, but now that we know what this dispute was about my suggestions won’t fly. This only gets harder.
Attempting to murder Anthropic for failure to do mass surveillance on Americans risks a dramatic chilling effect, as potential buyers assume everyone in the chain either is already compromised or could be compromised, and then weaponized. So would everyone ‘rolling over and playing dead’ while such a murder is happening.
If it is vital to America that we push the American ICT, and David Sacks and the rest of this administration insist that it is, then broadly going after Anthropic is going to create a rather large problem on this end, on top of all the other problems.
Whereas if the situation de-escalates, then this could reinforce trust in the system, because it would be clear a vendor under pressure could say no.
That’s in addition to the problem that’s even bigger: If you don’t know what America will do next, or when you might lose access to what you’re buying, you can’t rely on it.
There are many reasons the software information industry association put out a statement supporting Anthropic in professional and polite language, despite them being tempromentally cautious and most or all members having pending or ongoing business with the government.
The Department of War Had Many Excellent Options
If the point of the Department of War’s actions is anything other than the corporate murder of Anthropic, they could have simply cancelled the contract.
If that was somehow insufficient, they had many strictly superior options available that would have done the job of covering any additional concerns.
If that was somehow insufficient, a narrowly scoped supply chain risk designation, that applies only to direct use in procurement of contracts, would end all doubt.
Here I will quote Ball’s post Clawed (again, read that in full if you haven’t).
There is no explanation for announcing language that would force Amazon to divest from Anthropic, and to not serve Anthropic’s models to others on AWS, other than intentional and deliberate attempt at a corporate murder of a $380 billion company, the fastest growing one in American history and an American AI champion. Full stop.
And Then There’s Emil Michael
Pete Hegseth thought it was a good idea to leave these negotiations to Emil Michael.
No one could have predicted that things would go sideways.
Check out his Wikipedia page for more details. His career section headings are ‘journalism controversy,’ ‘Karaoke bar controversy,’ ‘Russia’ and ‘Later career.’ Fun guy.
See my previous posts for his previous Tweets, which I won’t go over again here.
Emil’s Tweets are frequently what one can only describe as unhinged.
This one stands out, instead, as cautious and clearly lawyered:
With a statement like that, every word has meaning, and also every missing word has meaning. If he could have made a better statement, he would have. So if this Tweet is technically correct – the best kind of correct – what would that mean?
We learn that DoW has policies for human oversight of its weapon and defense systems, but that there is no particular such requirement that would make us feel better about that. Note that we do have fully automated defense systems, especially for missile defense, because speed requires it, and that this is good.
He is claiming they do not engage in ‘unlawful domestic surveillance.’That’s ‘unlawful,’ not ‘mass.’ Given the circumstances, there’s a reason it didn’t say ‘mass.’
The reason he can say they do not do such actions is they view what they do as legal (or, if they are also doing illegal things, then they’re lying about that).
He says they always strictly comply with laws, regulations and the Constitution. None of those modifiers actually mean anything. It’s just another claim of ‘we keep it legal.’
Next up is the most careful sentence:
As one person said, what is ‘spy’, what is ‘domestic’, what is ‘communication’, what is ‘U.S. people.’
Spy is typically viewed narrowly, as directly tasking collection against a person. Thus, if he’s saying they ‘do not spy’ that does not preclude many forms of, well, spying, because those are ‘acquisition’ and ‘analysis.’
Domestic communications means they’re definitely spying on foreign communications, as is legal. But a lot of what you think is domestic is actually foreign, if it touches anything remotely foreign.
And this only applies to communications. Collection of geolocation data, for example, or browsing history, would not count, because it is not communications.
U.S. people means this does not apply to those without legal status, and there’s a constant gray zone if you don’t know that someone is a U.S. person, which you never know until you check.
Here, commercial collection exclusion, since it modifies spying, means that they don’t purchase information with the intent of targeting a particular U.S. person’s communications. That’s it.
Remember, each of those words was necessary, and this was the strongest version.
Also, the statement is false.
Then Michael went back on tilt, he deleted but we have the screenshot.
Completely unhinged behavior here in response to the Atlantic and New York Times articles.
I mean, the new version is still unhinged, but he deleted the copyright section. This is not the first time he’s talked about copyright like that.
Donald Trump can pull off that style. He makes it work. Accept no imitations.
Anthropic Will Probably Survive
This was attempted corporate murder. I think it will not succeed, but it’s not over yet.
Things would have to escalate quite a lot, in ways the markets do not expect and that I do not expect. Otherwise, this will not be an existential event for Anthropic. The government was only a small portion of its business. Trust in Anthropic has otherwise gone up, not down.
The threat to destroy Anthropic with the supply chain risk designation is dangerous, but all the competent patriots and the market both know it is insane and it is rather obviously illegal. I believe any such attempt would probably have to be walked back and would ultimately fail.
But it is 2026 and Hegseth is not a competent actor. I cannot be certain.
As Roon points out, the entire government argument in court would be absurd on its face, and if this is delayed until after the contract then six months is an eternity.
What matters would be if the government manages to strongarm the major cloud providers into walking away from giving compute to Anthropic, as in Google, Amazon and Microsoft. I do not believe Trump wants any part of that.
Anthropic is a private company, so we only have very illiquid proxies to see how much damage people think this all did. We can also look at the movement of major investors and business partners like Amazon, Google and Nvidia, and see that they did not substantially underperform so far.
At its low, in that highly illiquid market, Anthropic was trading there around a valuation of ~$465 billion, down from ~$550 billion previously. They last raised money at a valuation of $380 billion. So yes, this hurt and it hurt substantially, mostly in the form of tail risks. I notice that every single person I know with stock in Anthropic is happy they stood their ground.
By Sunday morning that market recovered to ~$540 billion, as people conclude cooler heads are likely to prevail.
(I do not directly hold Anthropic stock, because I want to avoid a potential conflict of interest or the appearance of a conflict of interest. That was an expensive decision. I do hold some amount indirectly, including through Google, Amazon and Nvidia.)
Paul Graham reassures startups that if Anthropic is the best model, you should use Anthropic. Even if you later want to sell to DoD and the restrictions somehow stick, you can switch later.
The Goal of DoW Was Largely Mass Domestic Surveillance
As reported above, it seems what the government actually valued most in this negotiation was the ability to use Claude for mass (primarily actually legal, not ‘we got a government lawyer to come up with an absurd legal opinion’) analysis of massive amounts of existing information.
There is no common legal definition of ‘mass domestic surveillance,’ and when they do forms of it the government calls it something else.
That’s not only a government problem. Here I ask the question, and get 40 answers, most of them different.
Consider this:
Why would you require this if you didn’t intend to use it? What is it for?
I’m not saying that the DoW is aiming to break the law. I’m saying that in the age of powerful AI that the laws do not protect against Anthropic’s redlines, and that DoW intends to do lawful things that violate those redlines, and that instead of MDS they call it something else.
I believe Sooraj is making a slight overstatement, but that is not material here.
I have private sources that confirm the story here from Shanaka Anslem Perera, and that attribute the ultimate use of the desired permissions to Doge, created by Elon Musk, as well as one ultimately attributing it to the aim of building a classified mass surveillance network to track illegal immigrants at the behest of Musk and Miller. This exact kind of data collection and analysis is the central point.
AI is a change in kind of the type of data analysis that becomes available for a wide variety of purposes.
Consider this (from an anonymous explainer):
On top of that, a large portion of what you think is ‘domestic’ surveillance is, legally, foreign. The laws on all this have been royally messed up for quite a long time, under both parties, and the existence of current levels of AI makes it much, much worse.
If they use ‘third party data,’ the government usually considers that fully legal.
If you combine that with use of Claude or ChatGPT, it means they can do anything and it will be ‘legal use,’ unless you have a specific carve-out that stops it.
After agreeing to language of ‘all lawful use,’ even if this also refers to laws at time of signing, it is hard to see how OpenAI can prevent this sort of analysis from happening.
This is not a new phenomenon.
The government is constantly trying to get all the big tech companies to spy on you on their behalf, including compelling them to do so. They don’t want you to have access to encryption. They want the tech companies to unlock your phone. They want backdoors. It has always been thus.
Yes, exactly. That’s how it should work. Alas, the situation was more like this:
They may or may not actually have such access, but for the sake of argument let’s presume they don’t, and consider that situation.
As Jacques says here, a large portion of this dispute is that the law has not caught up with AI, and also has largely eroded our civil liberties even before AI.
You can make the argument that since this is technically legal under current law, that makes it ‘democratic’ and so no one has any right to object. That’s not how a Republic works, and to the extent democracy is a positive ideal, it’s not how that works either.
What Are The Key Differences Between The Two Contracts?
This is one official explanation of formal differences, quoted in part to confirm that the key contract terms OpenAI accepted were terms Anthropic rejected.
Lewin is claiming that there were no substantive differences. If anything, OpenAI claims in its post to have included a third (highly reasonable) red line. Matt Parlmer is one of many to notice that Lewin and Altman seem to be describing very different deals.
After many rounds, I believe the actual differences that matter are simpler than this.
Notice that the DoW accusations against Anthropic about asking for operational permission in a crisis are exactly backwards. Claude will work in a crisis and was modified to refuse less, but that might violate a contract to be dealt with later. ChatGPT might refuse in the moment when it’s life and death.
OpenAI’s terms may or may not work or amount to a hill of beans. Too soon to tell. It could work in practice, or it could end up worthless.
We do know exactly why they do not work for Anthropic and DoW, in either direction.
As Lewin notes here, both the Obama and Trump administrations have done actions that many objected to as rather obviously unlawful, and basically nothing happened.
And again he brings up the potential of ‘pulling the plug mid operation’ which is physically impossible in this context, which is physically impossible with Claude but could inadvertently happen with ChatGPT. And any sensible contract would include a wind down even if it was terminated for clear violations, to protect national security.
As described above instead it comes down to the claimed distinction in paragraph two, which boils down to the following components:
Yeah, that’s not what any of this is about.
The first is not a meaningful distinction if it covers the prohibitions. If OpenAI’s rules refer to particular existing legal and policy authorities, then indeed it permits ‘all legal use’ which includes large amounts of domestic surveillance, and with a flexible government lawyer will include a lot of other things as well.
Nor is it meaningful as a matter of authority and law. The fact that things happen to be on the present books does not make them not contract law, and does not fail to remove them from what is otherwise the democratic authority. But also, very fundamentally, part of democratic law is contract law, and the ability to agree to terms.
The second one is, frankly, rather Obvious Nonsense that is going around. Ignoring that CEOs are accountable (both to the board and to the government and thus ultimately one would hope the people), they are claiming that Anthropic demanded that Dario Amodei be able to decide whether the terms of the contract were fulfilled at his discretion, rather than the government deciding, or it being settled by a court of law. At most, there may have been some questions that were left to be defined in good faith later, as per normal.
My jaw would be on the floor if this was indeed insisted upon or even suggested. That’s not how anything ever works. At most, this was Anthropic asking for carve outs for its two red lines, and then adding something like ‘without permission,’ so that in a pressing situation you could make an exception. You can take that clause out, then.
Alternatively, perhaps this is a reference to ambiguity of terms in existing contracts. In particular, the claim here is that the contract failed, as the rest of American law does, to define ‘domestic surveillance.’ Or it could simply be ‘sometimes things are not clear in edge cases.’ One sticking point of the negotiations was exactly trying to pin down various definitions and phrases so they would be unambiguous and enforceable, and that Anthropic was trying to clear away what they felt were ‘weasel words’ from proposed DoW language.
In particular, DoW kept wanting ‘as appropriate,’ which mostly invalidates any barriers, although they dropped this demand in the end to try and get other things they wanted more.
But again, having an underdefined term in a contract does not mean it means whatever Dario Amodei thinks it means. At most it means you can sue, and that’s not exactly something one does lightly to DoW over a technical violation.
If Dario Amodei felt the contract was broken, he could, like with any other contract, at most either choose to terminate the contract under whatever terms allow for that (as can OpenAI), although at obvious risk of government retaliation for doing so, or sue in court, and the government court determines if there was indeed a violation, under conditions highly favorable to DoW.
If Dario tried to suddenly shut down the system anyway, that would not even be physically possible on classified networks, and also they could arrest him or worse.
This also implies that Sam Altman does not have any role in determining whether use was lawful, or whether it is valid under the terms of the contract. Sam Altman affirms this under ordinary circumstances, but says that sufficiently clearly illegal actions, especially constitutional violations, would be different.
OpenAI’s Contract Terms
Thus, in the negotiations with Anthropic, there were two things centrally going on.
First, the Department of War wanted the ‘all legal use’ language, and failing that they wanted to avoid one particular carveout to that related to mass surveillance.
Second, Anthropic was attempting to remove various ‘weasel words’ and clauses, that would allow the Department of War to circumvent restrictions.
We can indeed see some of those weasel words in the brief wording shared by OpenAI. OpenAI isn’t relying on these terms to bind DoW, they’re relying on the safety stack and on trust.
Let’s go through every word they shared, and see why they don’t actually bind DoW:
All lawful use.
They can do anything they want unless the department policy requires human control, so again all lawful use. We already have highly effective autonomous weapons in some cases, such as missile defense. Directive 3000.09, the only plausible barrier, we’ll get to in a second.
All lawful use.
Even if we assume this is locked into place, the wording of 3000.09 means that when the Pentagon thinks it’s ready, it’s ready.
These absolutely are not meaningfully time stamped at all.
Private information is generally interpreted as not including third party or publicly available information, which includes massive amounts of data on everyone, especially anyone who carries around a phone. And again it’s still all lawful use, except it’s worse:
So if you put any constraint on it, you’re good. Renders it meaningless.
If it’s legal under applicable law, they can do it. Again, renders it meaningless.
At best this freezes those particular rules in place, if that is insisted upon elsewhere in sufficiently robust language.
As far as I can tell, at best OpenAI’s stated redlines amount to ‘all lawful use under existing law’ rather than ‘all lawful use.’ That’s it.
What OpenAI’s Contract Terms Actually Do
As Charlie Bullock explains again in more detail here, all the above language translates to ‘all lawful use,’ a restriction in theory already in place by definition. Charlie shares my view that the language shared does not enshrine current law as did ACX.
OpenAI CSO Jason Kwon disputes this interpretation, claiming that time stamping a law in a contract preserves current language (and thus this means they don’t have any additional protections on this), and says ‘any of the chatbots should give you a similar answer.’
I checked, and ChatGPT confirms that this is not the case. The language for everything except 3000.09 does not meaningfully time stamp anything. The language on 3000.09 might or might not be sufficient under ordinary contract law if neither party was the Department of War and this was a normal contract, but under these circumstances, if the DoW doesn’t want to be bound on this, this language is at best ambiguous and thus is not going to protect you in any meaningful way.
Kwon’s statement means there is no other such enshrining language. So that’s it.
As Bullock points out, there is lots more language that we do not have, so many things could have come to pass, and there are many legal things that would qualify as common sense “mass domestic surveillance” as I repeatedly point out.
I don’t think the legal language here is going to meaningfully bind DoW.
That doesn’t mean the contract language is completely worthless.
It does do one important thing. It gives standing. If DoW were to otherwise violate someone’s rights, that’s the target’s problem, but the target might never even find out. By naming these particular statutes and provisions, OpenAI now has clear standing to sue or take other actions, should the DoW be found in violation.
That matters, but it’s still a ticket to ‘all lawful use’ as DoW interprets that.
Otherwise, as OpenAI admits, they’re basically counting on technical safeguards, and well aware that they gave the green light to pretty much anything DoW does with whatever system they provide.
And they’re trusting DoW to act honorably.
Thus, my conclusion.
OpenAI Is Trusting DoW And Sam Altman Misrepresented This
I don’t think Roon is fully right, in that there are various ways to find out, but he’s essentially right if they want it badly enough.
On Friday morning, Sam Altman said on CNBC that OpenAI shared Anthropic’s red lines on domestic surveillance and autonomous weapons. Many praised this.
On Friday afternoon, a potential deal is described between OpenAI and the Department of War, which Altman claimed would have strong protections.
On Friday evening, while the supply chain risk designation was hanging over Anthropic’s head, they signed an agreement that included exactly the language that Anthropic rejected, including allowing ‘all lawful use.’
They continue to claim this contract has strong protections.
Sam Altman had been negotiating with the Pentagon since Wednesday. Which is better than throwing it together on Friday alone, but nothing like enough time to know if you’ve made a legally viable deal. As Dean Ball says, getting to a deal requires highly specialized lawyers and serious conversations. That’s not a two day affair.
A lot of leverage was seemingly squandered, an opportunity to get real red lines (to the extent this is possible at all) or other concessions was almost certainly lost, and this puts Anthropic and the whole industry in a much weaker position.
In particular, he gave the impression that he had achieved Anthropic’s red lines and had found terms that would achieve them for Anthropic. This was not the case. He accepted exactly the key terms Anthropic rejected, because OpenAI is trusting DoW and is drawing its red lines (and/or understanding of the functional law) differently.
It is not impossible that OpenAI got meaningful protections in the contract language that they decline to share. We do know they are misrepresenting the contract language that they did share, which offers effectively no protection.
It is also possible that OpenAI is correct, in context, to put its trust in DoW, and perhaps can trust it far more than Anthropic could, because DoW will understand and value the relationship, given better cultural fit, Altman’s relationship with the White House, OpenAI’s position as already too big to fail and a lack of strong alternatives.
I do think OpenAI has greatly weakened the legal argument for declaring Anthropic a supply chain risk, and has been very strong on the point that this label is crazy. That is very important.
But it is also possible that Altman’s negotiations are what made Hegseth feel he had a green light to order it, as he no longer felt he needed Anthropic at least medium term. Altman’s rush to negotiate, exactly to de-escalate the situation, could have had the opposite effect. Hopefully at least from here it does calm things down.
OpenAI can now be threatened in similar fashion, including via a pretext, once it is in sufficiently deep. We all know that Elon Musk would love to try to destroy OpenAI.
OpenAI Accepted Terms Anthropic Explicitly Declined And That Would Not Have Protected Anthropic’s Red Lines
I repeat this several times because it must be emphasized, although they did get some potentially important additional terms in exchange.
Even if Altman was trying to ‘take one for the team,’ and it is plausible that this was part of his motivation on this, that’s not always good for the team. Sometimes your team needs you to hold the line. We all know many examples of deeply foolish compromises, both fictional and real, made in good faith hopes of heading off a threat.
Anthropic strongly believes that the language Altman signed will not hold water.
I can confirm that this is Anthropic’s belief, via another source.
Why did Altman think these terms would be effective, if he believes that?
One possible contributing factor is that he was rushed, and did not understand.
A second is that he’s very confident in the use of technical safeguards.
Another is that OpenAI understands the redlines very differently than Anthropic.
I will dive more into their understanding later, but I do not expect that OpenAI’s redlines apply to anything that is legal. They only in practice object to illegal actions, and do not see it as their place to decide this, thinking that’s not how the system works. In that case, ‘all legal uses’ are indeed whatever DoW decides they are, and are acceptable, whether or not the language has any other teeth.
OpenAI’s leverage is that they claim they can decide what system to deliver, and can install any safeguards, and refuse requests that way. Okie dokie?
How Altman Initially Described His Deal
Here was Altman’s statement at that time, before we understood what it was:
That would be quite the contrast with their private and also very public actions in discussions with Anthropic, if it was true. This is the kind of thing that you have to say in Altman’s position, so you shouldn’t update much on it.
I have clear sourcing that this is false. As in, The DoW intends to engage in legal forms of what most of us would call mass domestic surveillance. At bare minimum, what they valued most in this negotiation was the ability to do this in particular.
Human responsibility for the use of force is not the same as a human in the kill chain. It is far better than nothing that a particular human has responsibility for the outcome, if they are indeed ensuring that, but it is DoW itself who would then hold that person responsible. Would they hold them to the same standards as they would have otherwise?
Cloud networks includes cloud classified networks, where OpenAI would have little control or visibility into what was happening. I don’t see how else OpenAI could relevantly replace Anthropic’s services.
The DoW made the largest of protests about the possibility that Claude might refuse a request. Sam is claiming that he can choose his safety stack and what requests the models refuse, and the DoW will respect those refusals. This is hard to believe.
There’s also the matter that no one knows how to build technical safeguards that will prevent a user of an LLM from doing whatever they want. Jailbreak robustness does not work here. Only a small number of forward deployed engineers will be able to examine queries. Without the engineers I think this is outright impossible.
With the engineers, it is merely extremely difficult. If the penalty for being caught is large enough (as in you’re willing to walk away over this and they believe you) it could work.
We haven’t seen that language. But even if Anthropic was technically offered these terms, and the terms involved are as good as they could be, does anyone believe that Anthropic could have Claude’s safety stack refuse requests DoW thinks are legal, and the DoW would be fine with it? Or that anything that was a pure technical fix to Anthropic’s red lines wouldn’t bring a swathe of other undesired refusals, at best?
Now that we know what the fight was over, there was no zone of possible agreement unless DoW was willing to not do the thing it most wanted to do. DoW demanded Claude do [X] and Anthropic wasn’t willing to do [X]. No deal. Trying to play a game of ‘get it to do [X] despite the technical safeguards’ really, really isn’t an option.
The reporting claims OpenAI has the right to prescribe safety mitigations, and that the Pentagon will respect model refusals, and so on. We don’t yet know any of the details of that.
Second half of this is certainly true.
For the first half, see my entire series of prior posts about OpenAI and Sam Altman, and the history of the company. But I do think that Sam Altman and most employees of OpenAI want better outcomes for humanity rather than worse. Affirming that is meaningful in a political context.
This is fine sentiment but does not claim that it protects the redlines.
OpenAI Allowed All Lawful Use And Trusts DoW On This
The above is entirely the right attitude from Boaz Barak. For national security, we need to keep highly capable AI in our classified networks and assisting the DoW. But we should seriously worry that this could be used to cross redlines and endanger the Republic or put us at risk. We need to stipulate this in any agreement and verify it.
Given the practical state of law around surveillance in America, the principle of ‘all legal use’ will not protect against many forms of domestic mass surveillance at all, would offer only nominal practical protections against many other such forms, and we have strong reasons to believe there is intent by DoW to engage in such surveillance. Thus, we are left with only technical verification, despite all the information in question being classified.
I can only interpret OpenAI’s public statements, as I will get to them later, as saying that OpenAI does not view legal surveillance and analysis activities (or legal use of autonomous weapons) as crossing their red lines, by nature of it being legal.
I spent a lot of time ruling alternative out and establishing the arguments for this, but also they then just tweeted it out?
Katrina is saying that they will:
I am confident that many at OpenAI believe that they would be able to prevent the Department of War from engaging in sufficiently illegal activities, were the DoW to decide to act here in a way that would be deemed illegal if it were to reach the Supreme Court, presumably by detecting the activity and either refusing the requests or terminating the contract. This may or may not include Sam Altman.
Alas, I believe they are incorrect in practice.
I do think Katrina makes an excellent point that if you do not trust DoW to follow the law, then you should doubt DoW to honor Anthropic’s redlines. In practice, both sides acted as if the terms mattered, but why couldn’t DoW, if it was not trustworthy, break the rules? I believe the answer is that they felt they would be unable to hide it from Anthropic if they used Claude at the kind of scale they had in mind, as it would have inevitably leaked.
Boaz Barak is actually relatively skeptical, although I am confused that he thinks the OpenAI contract is ‘no weaker and in several ways stronger’ rather than ‘weaker in one way and stronger in others.’
That’s very possible. I don’t think the first one is true, but they’re fully compatible, and yes I think it is highly unclear Anthropic’s language holds either.
As Miles Brundage points out, Sam Altman is representing that this agreement is robust, to the point of being stronger than Anthropic’s more extensive original agreement, despite the clause allowing ‘all lawful use,’ but based on what external lawyers and the Pentagon are saying it seems that OpenAI caved.
Altman had a moment of huge leverage, and instead of standing with Anthropic, he caved on the key term in question, ‘all lawful use.’ At minimum, he failed to demand that the supply chain risk designation be moved off the table.
If he had meaningful redlines on currently legal activities to protect, he could not have had the time to properly consider what he was signing, or signing up for.
The DoW Could Alter This Deal
The correct prior, given the circumstances, timing and history of Altman and OpenAI, is that the protections agreed to were woefully insufficient, regardless of the degree to which Altman realized this at the time. He said he cared about the language truly holding up, but we should be skeptical both that he is sufficiently invested in that to take a very expensive stand when it counts, and that he can tell the difference.
On top of that, even if the current agreement were ironclad, what’s to stop the government from doing the same thing to OpenAI that they just did to Anthropic? They are altering the deal. Pray that they do not alter it any further. Is Sam Altman going to be willing to risk a supply chain risk designation? Do you think Elon Musk wouldn’t push for the Department of War to do the same thing again?
Again, OpenAI is choosing to trust DoW.
Even if he meant maximally well, if DoW does not mean well then Sam Altman has walked into a trap, and put the entire industry in a dramatically weaker position.
Why OpenAI’s Shared Legal Language Offers Almost No Protections
On OpenAI’s legal language, at least the part that was shared with us, here’s two explainers for why it is highly unlikely to protect OpenAI’s supposed red lines:
Altman claims that the DOD directive is referred to as it exists today, not only as it might exist in the future. But even if that were true, it is not meaningful, as that directive leaves it to DoW to determine appropriate levels of supervision.
I do not understand why OpenAI believes, as they seem to be claiming, that the language they shared itself refers to the law as it exists today, and would continue to refer to those laws and directives even if they were later altered. That would not be how I would read those contract terms. You aren’t breaking a law if that law has been repealed or changed. At best this is highly ambiguous and DoW will read it the other way the moment it matters.
DoW keeps saying it is illegal to do ‘domestic mass surveillance’ but this is not a term of American law, so what exactly does that even mean? OpenAI has not shared any legal definition of the term, nor has DoW.
Again, Anthropic explicitly rejected the core term language OpenAI accepted, exactly because they felt that those terms did not hold water. To the extent it has similar red lines, OpenAI is counting on its technical affordances, and this only potentially works for them because (as I understand it) they believe crossing the lines would be illegal.
I am highly confident that Anthropic did not risk going head to head with the Department of War over meaningless terminology details.
I am highly confident that the Department of War did not risk this battle with Anthropic over meaningless terminology details, although it in part did so because some people actively wanted to destroy Anthropic.
So How Does OpenAI Hope For This To Work Out?
Part of what they hope for is de-escalation. The strategy needs to be reevaluated if that does not now happen. But what about the actual contract and serving DoW?
One way to have the red lines not be crossed is if the Department of War chooses not to cross the red lines. Sometimes the ‘trust us’ strategy works and people prove worthy. At other times they don’t want to risk being caught.
I really hope that this turns out to be the case, either way.
What about the other way of holding the red lines? Is it possible Anthropic and I are wrong, and basically all the legal experts who weighed in are wrong, and Sam Altman pulled it off even if the Department of War intends to cross the red lines?
It is possible. It would require that the key terms be elsewhere in the contract, in places where they claim they cannot share the details.
It would then require OpenAI to do heroic work, including heroic technical work, and be prepared to take heroic stands at great potential financial and personal cost.
The first step to knowing if this is possible is to read the rest of the contract terms.
The argument for hope goes something like this:
There are many severe problems with this plan. A lot of them are obvious. OpenAI would have to actually do the heroic work, take the heroic stand, and withstand the kind of pressures being used against Anthropic.
A less obvious problem is, even if OpenAI did heroic work, I don’t see how to deliver otherwise useful models that can’t be used for legal mass domestic surveillance. You can have them analyze one situation at a time and then clear the context.
So either you deliver a rather useless model by being unwilling or unable across a rather broad set of queries a lot of which are good uses, you’re allowed to pick up patterns and flag the whole DoW account, or you’re dead even without a jailbreak.
Then there’s the problem that there’s no known robust defense to jailbreaks, unless OpenAI is willing to implement technical pattern detection for violations, and then willing and able to pull the plug if that happens.
This Was Never About Money
Even if I am reading the situation maximally wrong, there is one thing that is clear.
This was never about money, for either Anthropic, OpenAI or the Department of War.
OpenAI previously turned down the contracts Anthropic accepted, exactly because Anthropic cared deeply about national security, and OpenAI did not wish to lose focus and money and take on the associated risks by prioritizing such work, especially when Anthropic was volunteering to pick up that slack and having access via AWS.
The contract’s dollar value is, in context, chump change. OpenAI an Anthropic grow their revenue more each day then the entire contract is worth.
I also strongly believe that OpenAI has consistently been attempting to de-escalate the conflict between Anthropic and the Department of War rather than escalate it. Sam Altman has been excellent on that particular point, as noted earlier, and we should give him proper credit.
To the extent that this conflict was stroked by competitors or was due to manipulation or corruption, those pulling those strings lie elsewhere, as I’ve noted.
That still leaves many potential motivations for OpenAI agreeing to this contract.
I believe there are three we must centrally consider.
People are not discussing this third motivation, but it is very obviously there. Sam Altman has done many things to curry favor with the administration. Fair play.
I think people have this third motivation exactly backwards. They say things like ‘Brockman contributed $25 million to Trump and that’s how they secured this contract.’ I would suggest the opposite is more important. This contract, and the willingness to bail out this crisis and capitulate, is itself a contribution.
OpenAI Tells Us How They Really Feel
Again, on Friday morning, Altman claimed to share Anthropic’s red lines, implying (but not explicitly confirming) that this would apply even to legal activities.
On Friday evening, Altman claimed to have signed a ‘more restrictive’ contract that would preserve the redlines, a contract Anthropic explicitly declined and that would not have preserved Anthropic’s red lines, but might help preserve OpenAI’s.
On Saturday afternoon, we got some of the legal language, which looks like all we’ll get, and that language we de facto ‘all lawful use’ as determined by the general counsel’s office, with the meaningful levers being the safety stack and right to cancel.
Which is totally a coherent position, highly defensible, but very different from what Altman was representing was the OpenAI position, and one that would make a lot of people very upset.
Then Altman, and several other employees of OpenAI, did an AMA and otherwise Tweeted out various sentiments on how they believe all of this works.
These lay out a clear and coherent position and philosophy, which I believe amounts to saying that their redlines allow all legal use, and trusting the Department of War to determine and abide by what is legal, and that to do otherwise would not be appropriate in a democracy.
Yes, they intend to include a ‘safety stack’ and other safeguards, but fundamentally believe that they should not be determining what their AI is used for, other than via enforcing the law and refusing illegal requests.
First The Good News
I think this greatly underplays the level of risk Altman is taking on by getting involved, and his other statements sound like a person already choosing his words carefully due to this. I hope I am mistaken, and I hope that Altman is correct that OpenAI intends to and actually will, even under immense pressure, use its safety stack to determine what is legal and to refuse requests it feels are illegal, and to terminate the contract if it discovers an illegal pattern of behavior that cannot otherwise be prevented.
There is also potential political risk in refusing to become involved. At some point, you might not be interested in politics and the national security state but they become interested in you.
I fully believe Altman here. I think Altman decided to do this on his own.
There is of course ‘if you help us we will remember that, and if you didn’t help us when we needed it we are going to remember that.’ That’s always there, whether or not anyone wants it to be there.
This was a good answer:
I would have added a third key area, the defense of model weights.
This was also a good answer, up until the last line:
The ‘not up to me to decide’ rhetoric totally applies to what DoW decides to do. It doesn’t mean you have to help them do it if you think it’s wrong, but also they can force you into a package deal decision, and they did that here.
One thing Altman should keep in mind is that a lot of what we would think of in practice as domestic surveillance, legally is classified as foreign. Then there’s the ‘border zone.’ Again, I see OpenAI as saying they will defer to DoW on what is legal, and they will assume legal overrules their red lines, unless things become sufficiently blatantly unconstitutional.
Altman has not committed to publishing any changes to their red lines, but thinks this is a good idea and will consult with the team. I agree, good idea.
He expects the system to take several months to set up and the plan seems to be to use Azure. They have up to six, although that deadline could always be extended.
Jack Kaido asked about AGI, and Altman responded (wisely) that losing control of AGI would mean ‘we are probably in a very bad place.’ And so much more.
The OpenAI Redlines Only Forbid Currently Illegal Activity
This answer and related follow-ups are very telling on several fronts at once.
I get a sense that the actual intended redline for OpenAI might be better described as the Constitution of the United States? That’s a highly reasonable redline, if you can actually act on it.
I strongly agree that most people in the military are far more committed to the constitution than the average person on the street, but they also consistently take a broad view of what they need to do to defend national security (and they are often right), and also they usually do as instructed by the chain of command. That’s the job.
We really need to know the full OpenAI definition of ‘domestic mass surveillance.’
Here are the conclusions to draw.
First, he clarifies that he is fine with anything constitutional, presumably as the current courts understand it, which is a rather narrow reading of this question as noted extensively earlier:
Second, that he is pledging to defy an unconstitutional order, even if it comes with a legal opinion. He is promising to pull the plug on the entire program, if he finds DoW doing illegal things.
I very much appreciate this, but if the situation happens we may never learn of it, and intent now is very different from what you do in the breach.
Third, and I very much appreciate this too, that he doesn’t know what he’d do if we abandoned our rights and freedoms. I too don’t know what I would do then.
Altman Does Not Present As Understanding The Difference In Redlines
Altman may have an excellent point that the other terms, granting the right to build OpenAI’s own safety stack and control what is delivered, are things that Anthropic did not focus on or ask for.
But they are also exactly the type of thing that Hegseth and Michael were yelling were totally unacceptable, and that they could not and would never accept. They’re giving a private corporation operational control, the ability to substitute OpenAI’s judgment for the DoW and refuse requests based on their own reading of the law, or indeed any other safeguards they determine – if you believe Altman’s claims about this deal.
That’s not the ‘unfettered access’ that was demanded of Anthropic. Not at all. If OpenAI got a strong deal, it is because they got more, not less, operational control.
Indeed, what happens if the model starts refusing on a real time operation? Are they going to ‘call Sam?’ This points out how nonsensical all that rhetoric always was.
Meeting Of The Minds
I notice this makes me worry a lot, if Altman is presenting his view accurately, that OpenAI and DoW do not have a meeting of the minds on this contract.
Altman seems to think that technical safeguards give him the right to decide what is and isn’t acceptable via having the model refuse requests. I doubt DoW agrees.
Not only does OpenAI choose what system to build, they can ‘build protections into the system’ including to ensure no crossing of the red lines.
I am confident that DoW thinks this that they are entitled to ‘all lawful use’ and that if they get any refusals for reasons they don’t like, they will throw an absolute fit. They will absolutely pull out all the rhetoric they used on Anthropic, or threaten it.
Frankly, I expect the DoW to be right about this dispute, unless there is very clear language we have not seen that says that OpenAI has the right to have its safety stack refuse requests for essentially any reason, and even then I’d be rather nervous as hell.
Anthropic’s Position Was The Opposite Of How This Is Portrayed
If anything, Anthropic was trying to address the situation contractually rather than via technical safeguards exactly so that they didn’t get accused of making operational decisions, or accidentally actually refuse in real time.
Anthropic was saying, we’ll have the model do it, and specify what you agree not to do with the model, and then we’re trusting DoW to abide by the agreement, but we’re not going to do a sudden refusal in the middle of all this.
It didn’t help. None of that was in good faith.
The Room Where It Happened
I basically buy this first half, in addition to any other motives involved.
I think it was a mistake, and could have had the opposite of its intended effect by making Hegsted think he was free to try and murder Anthropic (as Hegsted seems to not understand why that would be bad), but I do think this was a strong motivation.
The second half of this answer, however, is where we start getting into parroting the DoW rhetoric about this in a way that scares me.
Anthropic was in no way telling DoW it was ‘kind of evil.’ It was saying that there were some activities in which it did not wish to participate.
Anthropic was not saying they wouldn’t help, indeed they have gone to extraordinary lengths in order to be maximally helpful. They are saying there are some narrow things, things DoW keeps saying they would never do, that Anthropic does not want to help with.
There is no corner under into which DoW was being backed. This was a ‘war of choice’ the entire way. Anthropic was happy to continue under its current contract, offered much less restrictive terms than that, and was also happy to walk away. Then Hegseth did what he did, including running right through Trump’s de-escalation.
This was rather more than a failure to ‘react great.’
The penultimate line is far, far scarier. Who is saying ‘unelected leaders of private companies should have as much power as our democratically elected government?’
The claim is that a private company should be able to determine under what terms it is willing to do business and provide its own tools. That’s it. This whole line that this is some sort of anti-democratic power grab is inimical to the values of America.
We do still need to find a way to help the DoW, even if they don’t make it easy. That doesn’t mean treating the Secretary of War like a dictator.
Notice the equating of ‘democratically elected government’ with the military chain of command. It is supposed to be the Congress that sets the rules and writes the laws.
You Don’t Have The Right
Can OAI implement a safety stack that refuses unethical actions, under this contract?
Altman seems to be saying no. Or at least that he’s not going to try.
I am pretty furious at repeating this line, and at the idea that, because you might be facing an incoming nuclear missile (that would be handled by existing automated anti-missile systems), that means you have to apply that level of deference in all other situations, including in peacetime without an emergency.
In practice, very obviously, in a true emergency like that, the DoW says jump, and you do your best to guess how high because they don’t have time to tell you. We all would. Dario would, Sam would, I would, and I bet you would.
I continue to be flabbergasted that so many people think this is a good argument.
Yet Altman reiterated this position again, that the government needs to have the power, and that to be able to say no to the government means you have ‘more power.’
Democracy is being redefined in real time.
I strongly agree that we need to talk about this. A lot. I want to live in a Republic.
No, I do not think we should move more power from corporations to the government.
No, I do not think that the government should have ‘more power’ than all the ‘unelected’ private companies, as in all the private people, collectively.
The government was at least flirting with soft nationalizing Anthropic, and instead tried to destroy it. The day could come sooner than we think, and yes many of us have been thinking about that for a long time without great answers. The implication here is that he would accept nationalization. After which, of course, his red lines would not be up to him, no matter what they are.
I did not get this sense from the questions, and I’m worried that Altman did. I do agree that many people take it for granted, especially day to day, and that this is good. If we take it for granted, that means DoW did its job.
On one particular question, he answered with a RT.
I earlier broke down that Tweet from Emil Michael. It is well crafted, but if understood it is not a strong statement. If Altman is answering with that, and Boaz is giving this answer as well, we have our answer. All legal use, as determined by DoW.
I Ask Questions And Get Answers
AMAs happen fast, so I didn’t do a perfect job, but I did what I could.
I got an answer from Boaz Barak rather than Altman, which is fair.
I interpret these answers in the following ways, solidifying my perspectives elsewhere:
Does This Contract Apply To NSA?
Katrina, OpenAI’s head of national security partnerships, says no, that the contract only applies to DoW in a way that excludes NSA, despite the NSA being under DoW. Again, we have not seen contract terms, so this is in theory possible.
Can OpenAI Models Be Used To Analyze Commercially Available Data At Scale?
That’s at the heart of the matter.
It is where OpenAI communication is hardest to believe.
I think it’s a perfectly defensible position to say this is legal and it’s not their place to decide and it’s fine, but that’s not the position.
It’s also fine for them to build in safeguards that stop this and pull the plug if DoW tries to go around them. Their contract permits it. That would be great if it would work and they can hold that line. But that is not their stated intention.
The DoW does this, legally, now. How can Katrina not know this?
I ask that given that Katrina led the Obama administration’s ‘media and public policy response’ to the Snowden disclosures, most of which was not deemed illegal or improper, but which a lot of people thought was not okay. She is eminently qualified to handle exactly this set of questions.
There has since then been extensive reporting that exactly this was the sticking point of the negotiations with Anthropic that caused talks to fall apart.
Shakeel here offers an extensive analysis based on what we learned on Sunday. Both Katrina and Boaz Barak made clear statements saying the Pentagon is prohibited from or not allowed to do this. And yet. They have promised more language on this in the coming days, from the contract and I look forward to reading it. Seems important.
If she doesn’t know or is misrepresenting this, what the hell is going on?
Finally, here’s the big three models, including OpenAI’s ChatGPT.
This seems really, really conclusive.
It doesn’t get better from there.
She also, multiple times, reiterates the line ‘more guardrails than any previous agreement’ as if one can simply count them, and this is conclusive.
This is a no good, very bad topline answer both in substance and in terms of PR. If you don’t know why, you sure as hell should know why. The actual philosophy of the approach part is reasonable in parts 1 and 3. I do agree that the forward engineers were a good ask.
An architecture approach is a philosophy, and it could be right. I wish there was more consistent emphasis that this is the plan.
The second point means DoW has this backwards if true. Usage policies don’t determine operational decisions. Refusals determine operational decisions. I presume the reason Anthropic didn’t agree here is that they understood that once you agree to ‘all lawful use’ you are not in a good position when you train the model to refuse legal things you don’t like, or you threaten to pull the contract over legal actions, where legal means as determined by the general counsel.
The problem is, as I said under meeting of the minds, you really don’t want to have the DoW thinking your contract works one way, and then insist it’s the other way, and Anthropic understood this.
Employee Activism
There are good reasons the sidewalk outside OpenAI looks the way it does, and why the city was unable to get the people doing it to leave long enough to hose it off.
Even if OpenAI is attempting to do the right thing, they have signed on to ‘all legal use’ language, they have misrepresented the key functionality of the contract to the point that I spent many hours being confused and sorting through it until I finally understood their intent, and made many alarming statements of trust in and deference to the DoW given what else we know.
And while Altman and others at OpenAI have spoken excellently about the fact that it is crazy to label Anthropic a supply chain risk, they have also agreed to move forward to provide a replacement for Anthropic, while the sword of Damocles is still potentially poised above Anthropic’s head.
Here’s a four minute video walking through it.
An employee says that a lot of people at OpenAI are afraid to speak their minds. You should not be. Speak your mind. If this gets you in trouble, which it probably won’t, you’re working in the wrong place.
You must decide what to make of Sam Altman’s extensive history of cutthroat politics and not being consistently candid, read all of his statements, and decide how much faith to put in him here.
Again, is it possible that OpenAI stands ready and will stand by their redlines and protect our civil liberties in the ways that matter? For being responsible with potential autonomous lethal weapons?
I really, really want that to be true! We should all really want this to be true. It is up to those inside OpenAI to figure out for themselves whether or not it is true.
We do not know the full terms of the OpenAI contract. Many questions remain unanswered. It is possible that OpenAI has a robust technical plan and understanding with DoW, and a willingness to back it up if it turns out DoW does not act honorably.
There’s only one way to know. You need to do your best to understand the situation.
I still think it is important is seeing the contract terms, and you should do so if you can and get a legal analysis, so you understand the background.
But unless you are resting your hopes on the contract’s legal terms, what matters is the practical plan, and your faith in its execution.
Perhaps you will find you agree with Daniel Steigman, and find the arguments convincing. If so, okay.
I would say the same for any other company entering such a deal. If I was at xAI, I would certainly be questioning what Grok was about to be used for, and whether or not you were okay with this, given they seem to have signed with no redlines at all.
If you are at OpenAI (or xAI), and after investigation (and legal consultation as needed) you do not find the protections acceptable or that your leader misrepresented the situation, then you need to organize, and use your power to hold leadership to account.
You also need to stand ready, in case DoW attempts to murder Anthropic, in which case you need to use your leverage to try and stop that from happening.
Your decision includes what this says about future high stakes decisions, and how they will be handled. Here is a paper on the history of activism in the AI community. If you do not like the results, you need to consider whether or not you wish to stay.