Commercial AI is moving deeper into the Pentagon's classified operating environment, making cloud platforms, chips, models, data integration and technical support part of the same defense supply chain. In May 2026, the department announced agreements with Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection and SpaceX for AI capabilities on classified networks. The question is no longer only which model wins a contract, but who controls the interconnected system after it becomes operationally important.
The unresolved dispute is over acceptable use and meaningful human control. Anthropic's absence from that seven-company group followed its resistance to broad government-use terms, while OpenAI says its own classified agreement preserves protections. Neither a longer vendor list nor a company's public safety statement establishes that the underlying contracts, technical controls and operational decisions are independently verifiable.
From prototype awards to classified workflows
The May announcement extended a procurement drive publicly launched in July 2025. The Chief Digital and Artificial Intelligence Office selected Anthropic, Google, OpenAI and xAI for agreements with ceilings of $200 million each. Those were prototype workflows across national-security missions, including agent-like systems executing multistep tasks rather than simply answering prompts. A ceiling is not evidence that the entire sum has been spent, and the 2025 four-company list is distinct from the later seven-company group.
Military personnel were already accessing AI through GenAI.mil, the Pentagon's official generative platform. Classified-network access raises the stakes because a system may influence intelligence analysis, logistics, cyber operations, mission planning or target assessment. A prototype can remain isolated from operational decisions; a model connected to sensitive data and decision software may not. Maintenance summaries and surveillance or target recommendations carry very different consequences.
The Pentagon says some tasks have fallen from months to days, but the public announcement did not identify which tasks, disclose model error rates, explain review procedures or describe consequences of incorrect outputs. That is a speed claim, not a sufficient measure of high-consequence reliability. It does not show every classified use is reckless, either: predictive maintenance, translation, document search and logistics optimization can offer benefits with more manageable consequences.
Foundation models are broadly trained, adaptable systems, unlike a weapons platform with a narrowly defined role. Updates, integrations, prompts and additional data can alter behavior. Contracts, surrounding applications and technical controls therefore define their operational boundaries. One acceptance demonstration cannot capture all future behavior, increasing the need for repeated tests and continuing vendor support.
The infrastructure market underneath the model contracts
The relationship predates ChatGPT. In 2022, the Department of Defense awarded Amazon, Microsoft, Google and Oracle the Joint Warfighting Cloud Capability contract, with a $9 billion ceiling, covering cloud services across security classifications. Computing, storage, identity controls, networking and secure data access give these infrastructure suppliers an advantage when agencies add AI.
The firms perform different but overlapping roles. Microsoft supplies cloud and has a major OpenAI relationship; AWS hosts multiple developers' models and has invested in Anthropic; Google operates cloud and Gemini; Nvidia supplies widely used chips and software libraries. A developer can depend on a cloud provider using Nvidia hardware, while a defense integrator connects the resulting application to government data. Commercial consumer and enterprise demand finances faster development, but military buyers also inherit proprietary interfaces, scarce hardware, specialist staffing and vendor-controlled updates.
Palantir illustrates the importance of the integration layer. Its command and data software combines sensors, intelligence databases, plans and weapons-platform information spread across incompatible systems and classifications. According to the Brennan Center study, the Army consolidated 75 Palantir arrangements in 2025 into one enterprise agreement with a ceiling of up to $10 billion over ten years. This is another contractual ceiling and time period, not a payment total to combine with the model awards.
Aircraft, missiles, sensors and communications still require established defense contractors. New software companies increasingly interpret information across those assets, creating mutual dependence with traditional suppliers and military-experienced integrators. Venture-funded Anduril, Shield AI and Scale AI also participate, often on larger cloud, chip or data foundations. Startups are not simply replacing old contractors: competition in applications can generate revenue for a small set of underlying platforms.
The Anthropic dispute concerns who sets the limits
Anthropic sought contractual protections against mass domestic surveillance and fully autonomous weapons—systems selecting and engaging targets without meaningful human control. Defense officials argued suppliers should permit any lawful government use, placing responsibility with government. Anthropic treated some uses as unacceptable even if officials considered them lawful. The difference concerns authority after purchase, not merely wording.
The Pentagon proceeded with other providers. OpenAI says its agreement addresses domestic surveillance, autonomous weapons and human oversight, prohibits mass domestic surveillance and embeds existing legal and policy standards. These are important company claims, but classified details and undisclosed language prevent a full independent comparison with Anthropic's requested terms. It would be premature to declare the protections identical or conclusively stronger.
Procurement can establish practical governance before legislation or court review. The strictest vendor does not automatically set the standard: alternative providers accepting broader terms let government move workloads and weaken a holdout's leverage. Multi-vendor resilience can therefore coexist with pressure toward less restrictive terms. Conversely, government wants interchangeability to avoid one model supplier controlling mission rules.
Inconsistent safeguards also create integration problems. One restricted model might summarize intelligence that another system subsequently uses for operational planning. Public policies can change: OpenAI removed its blanket military-use prohibition in 2024 while retaining restrictions on weapons development and harmful activities, and other developers have revised policies as government work expanded. Contracts usually create stronger obligations than public policies, but their effect depends on precise definitions, monitoring, technical enforcement and remedies.
Government can switch suppliers, cancel work or classify a firm as a supply-chain concern, affecting wider federal prospects. That possibility adds commercial and political pressure to negotiations. A voluntary safeguard matters only if the company maintains it under that pressure. The conflict is thus between suppliers seeking limits over their models and military leaders seeking operational authority over publicly purchased systems; neither side's preferred allocation alone proves a working safeguard.
Vendor diversity can hide common dependencies
Competitive frontier models require advanced chips, large datasets, specialized researchers and substantial compute that relatively few companies supply at scale. Smaller application contractors may still depend on the same infrastructure. Ten battlefield tools could share one cloud, chip supplier or foundation model, leaving an apparently diverse portfolio exposed to a common outage, cyberattack, model failure or contractual dispute.
Multi-cloud and multi-model purchasing addresses only part of that risk. Genuine resilience requires workloads to move without losing essential functionality. Proprietary interfaces, access controls, data handling, output formats and performance differ, so replacing a provider can require retesting every connected workflow. Contract counts do not demonstrate interoperability.
Suppliers remain important after award because they understand proprietary models government staff may not independently inspect or reproduce. Evaluation, security support, tuning, training and incident response can continue throughout the lifecycle. The buyer is acquiring evolving capability and its maintainers, not merely a finished product. Changing prompts, data, context and updates reinforces that structural dependence.
Nature frames these overlapping relationships as an AI-centered military-industrial complex. Technology executives and investors participate in defense procurement, regulation, export controls and federal-computing debates; some move between government and business, while others fund political organizations favoring faster adoption or opposing rules. These are legal forms of participation, not proof of misconduct. Their combined effect merits scrutiny when the same firms seek contracts and influence the rules governing them.
Formal human approval is not necessarily meaningful review
Automation bias means accepting a computer recommendation despite contrary evidence. Fluent explanations, apparent confidence and frequent correct answers can encourage it under military time pressure and incomplete information. A model may falsely link a person, vehicle, location or communication; an analyst may treat the association as a useful lead even without reliable underlying evidence.
Errors can travel through a pipeline: one component labels an object, another summarizes the label and a planning tool incorporates the summary into a recommendation. By the end, a polished interface may hide both uncertainty and the component that introduced the mistake. Classified input does not remove hallucination, inconsistent response or behavior changes after updates.
Context and adversaries complicate evaluation. An assistant good at maintenance records may fail on unfamiliar intelligence abbreviations or deliberately deceptive material. Opponents can manipulate data and probe commercial systems for weaknesses shared with government deployments. Classification makes reproducing failures and comparing company claims with operational evidence harder for outside researchers.
Retrieval, access controls, test suites and human review can reduce risk, not guarantee every mission. Oversight requires time, authority, contrary evidence, training on model limitations and a practical ability to reject recommendations or stop the system—not merely a final approval click. Georgetown CSET's Helen Toner warns against overdependence and emphasizes understanding utility as well as limits. Human involvement alone does not show these conditions hold.
Evaluate behavior and preserve evidence without ignoring privacy
Useful evaluation would examine false positives, missed signals, calibration, operator behavior and adversarial performance during deployment as well as demonstrations. Offices seeking funding and vendors selling capability have incentives to showcase successful pilots and time savings; subtle deterioration in judgment or routine failure to challenge outputs is harder to see. Testable standards should follow the capability across vendors and settings rather than rely on voluntary descriptions.
Logs recording model inputs, outputs and human responses can help investigators reconstruct harmful decisions. Those records also carry privacy and security risks and need retention limits, controlled access and independent review. Traceability is not a justification for unrestricted retention. Naming logging or human oversight as a safeguard differs from demonstrating that it works under pressure.
Public oversight has not kept pace with the technical stack. Ceilings are often visible while operational details, evaluations and safeguard wording remain unavailable. Senator Elizabeth Warren has sought disclosure of which systems operate on classified networks, their safeguards, and answers on autonomous weapons and domestic surveillance. Broad assurances of legality do not show how controls function in practice, or how AI shapes the evidence and options a human sees before approving an action.
Contracts, portability and audits will show where control lies
Comparable contract terms or enforceable summaries could clarify surveillance, autonomous weapons, human review and secondary uses of military data. Continued secrecy leaves uncertainty over whether protections differ among vendors. Sensitive mission detail can remain restricted while inspectors, congressional committees and auditors receive fuller access; aggregate reporting need not disclose operational secrets.
Demonstrated workload portability and common evaluation standards would test the multi-vendor argument more directly than another list of agreements. Operational reporting on where AI is used, how often humans reject recommendations and how agencies respond to serious errors would test accountability. Neither has been established simply by announcing suppliers, and liability among model vendors, integrators and users remains important.
These precedents may extend into policing, border enforcement, intelligence and civilian agencies through public purchasing, and into enterprises using AI for consequential decisions. Dependence, updates, auditability and human review are not uniquely military concerns. The central question is whether public institutions can enforce durable limits after becoming dependent on private compute, data, models, integration and expertise. Contracts, interoperability tests and operational audits offer evidence; speed claims and formal approval alone do not.
Sources and related reading
Associated Press on classified agreements · CDAO frontier-model prototype announcement · Brennan Center military-AI study · OpenAI's account of its agreement · Nature analysis · Senator Warren's contract questions · Related reading: personal and team AI knowledge bases