Why behind AI: The Anthropic meltdown
We are one week into war in the Middle East, powered by the latest Anthropic models.
We are also witnessing an unprecedented rebuff of the company away from government workloads, driven by a very aggressive legal and communications strategy. The approach that Anthropic took was very reminiscent of “flood the zone” approach of trying to saturate the news cycle with a combination of statements around the situations and product announcements.
In “#133: War Time” I warned about the risks they are taking:
The choice here to try and play semantics with what the Department of War can interpret as fair or not fair is a strategic blunder which will be very difficult to recover from.
I’m repeating myself, but the reason why “the stick” works when it comes to national security usage of software, is because the legal paths to try and counter government oversight can take years to be remedied, and even then the benefits are very unlikely to cover the massive opportunity loss. Anthropic has been extensively hiring employees who are aligned with their mission, but this test is unprecedented.
There are several possible outcomes here:
Bend the knee: Basically cave in and beg for forgiveness, predominantly pushed by your largest investors lobbying for you through every single channel they have access to. The optical exit here is by taking the Sam Altman “terms”, something that would be so humiliating for Dario that I genuinely don’t believe he can do it.
Keep operating as it is and hope the government doesn’t push the point: This is essentially what they are saying they will do with their press release, claiming that all other contracts are not impacted in any shape or form. If the government doesn’t press the point, this should not lead to immediate churn across their business, however will likely limit growth significantly, as most orgs will be very cautious with overinvesting in a way that doesn’t allow them to switch to a different model provider. Short term they have the opportunity to try and play this, as the nation’s focus moves towards the conflict with Iran.
FAFO: Go on the offensive and push for the supply chain risk designation to be removed through lobbying, PR and customer pressure. Based on their leadership behavior so far, I wouldn’t be surprised if they decide they can afford to take the risk and go on a big campaign + lawsuit.
Unfortunately for Anthropic, they went with the FAFO option.
It started with Dario sending this email internally:
I want to be very clear on the messaging that is coming from OpenAI, and the mendacious nature of it. This is an example of who they really are, and I want to make sure everything [sic] sees it for what it is. Although there is a lot we don’t know about the contract they signed with DoW [shorthand for the Department of Defense] (and that maybe they don’t even know as well — it could be highly unclear), we do know the following:
Sam [Altman]’s description and the DoW description give the strong impression (although we would have to see the actual contract to be certain) that how their contract works is that the model is made available without any legal restrictions (“all lawful use”) but that there is a “safety layer”, which I think amounts to model refusals, that prevents the model from completing certain tasks or engaging in certain applications.
“Safety layer” could also mean something that partners such as Palantir [Anthropic’s business partner for serving U.S. agency customers] tried to offer us during these negotiations, which is that they on their end offered us some kind of classifier or machine learning system, or software layer, that claims to allow some applications and not others. There is also some suggestion of OpenAI employees (“FDE’s” [shorthand for forward deployed engineers]) looking over the usage of the model to prevent bad applications.
Our general sense is that these kinds of approaches, while they don’t have zero efficacy, are, in the context of military applications, maybe 20% real and 80% safety theater. The basic issue is that whether a model is conducting applications like mass surveillance or fully autonomous weapons depends substantially on wider context: a model doesn’t “know” if there’s a human in the loop in the broad situation it is in (for autonomous weapons), and doesn’t know the provenance of the data is it analyzing (so doesn’t know if this is US domestic data vs foreign, doesn’t know if it’s enterprise data given by customers with consent or data bought in sketchier ways, etc).
We also know — those in safeguards know painfully well — that refusals aren’t reliable and jailbreaks are common, often as easy as just misinforming the model about the data it is analyzing. An important distinction here that makes it much harder than the safeguards problem is that while it’s relatively easy to, for example, determine if a model is being used to conduct cyberattacks from inputs and outputs, it’s very hard to determine the nature and context of the cyber attacks, which is the kind of distinction needed here. Depending on the details this task can be difficult or impossible.
The kind of “safety layer” stuff that Palantir offered us (and presumably offered OpenAI) is even worse: our sense was that it was almost entirely safety theater, and that Palantir assumed that our problem was “you have some unhappy employees, you need to offer them something that placates them or makes what is happening invisible to them, and that’s the service we provide”.
Finally, the idea of having Anthropic/OpenAI employees monitor the deployments is something that came up in discussion within Anthropic a few months ago when we were expanding our classified AUP [acceptable use policy] of our own accord. We were very clear that this is possible only in a small fraction of cases, that we will do it as much as we can, but that it’s not a safeguard people should rely on and isn’t easy to do in the classified world. We do, by the way, try to do this as much as possible, there’s no difference between our approach and OpenAI’s approach here.
So overall what I’m saying here is that the approaches OAI [shorthand for OpenAI] is taking mostly do not work: the main reason OAI accepted them and we did not is that they cared about placating employees, and we actually cared about preventing abuses. They don’t have zero efficacy, and we’re doing many of them as well, but they are nowhere near sufficient for purpose. It is simultaneously the case that the DoW did not treat OpenAI and us the same here.
We actually attempted to include some of the same safeguards as OAI in our contract, in addition to the AUP which we considered the more important thing, and DoW rejected them with us. We have evidence of this in the email chain of the contract negotiations (I’m writing this with a lot to do, but I might get someone to follow up with the actual language). Thus, it is false that “OpenAI’s terms were offered to us and we rejected them”, at the same time that it is also false that OpenAI’s terms meaningfully protect them against domestic mass surveillance and fully autonomous weapons.
Finally, there is some suggestion in Sam/OpenAI’s language that the red lines we are talking about, fully autonomous weapons and domestic mass surveillance, are already illegal and so an AUP about these is unnecessary. This mirrors and seems coordinated with DoW’s messaging. It is however completely false. As we explained in our statement yesterday, the DoW does have domestic surveillance authorities, that are not of great concern in a pre-AI world but take on a different meaning in a post-AI world.
For example, it is legal for DoW to buy a bunch of private data on US citizens from vendors who have obtained that data in some legal way (often involving hidden consents to sell to third parties) and then analyze it at scale with AI to build profiles of citizens, their loyalties, movement patterns in physical space (the data they can get includes GPS data, etc), and much more.
Notably, near the end of the negotiation the DoW offered to accept our current terms if we deleted a specific phrase about “analysis of bulk acquired data”, which was the single line in the contract that exactly matched this scenario we were most worried about. We found that very suspicious. On autonomous weapons, the DoW claims that “human in the loop is the law”, but they are incorrect. It is currently Pentagon policy (set during the Biden admin[istration]) that a human has to be in the loop of firing a weapon. But that policy can be changed unilaterally by Pete Hegseth, which is exactly what we are worried about. So it is not, for all intents and purposes, a real constraint.
A lot of OpenAI and DoW messaging just straight up lies about these issues or tries to confuse them.
Here is where things get more unhinged:
I think these facts suggest a pattern of behavior that I’ve seen often from Sam Altman, and that I want to make sure people are equipped to recognize:
He started out this morning by saying he shares Anthropic’s redlines, in order to appear to support us, get some of the credit, and not be attacked when they take over the contract. He also presented himself as someone who wants to “set the same contract for everyone in the industry” — e.g. he’s presenting himself as a peacemaker and dealmaker.
Behind the scenes, he’s working with the DoW to sign a contract with them, to replace us the instant we are designated a supply chain risk. But he has to do this in a way that doesn’t make it seem like he gave up on the red lines and sold out when we wouldn’t. He is able to superficially appear to do this, because (1) he can sign up for all the safety theater that Anthropic rejected, and that the DoW and partners are willing to collude in presenting as compelling to his employees, and (2) the DoW is also willing to accept some terms from him that they were not willing to accept from us. Both of these things make it possible for OAI to get a deal when we could not.
The real reasons DoW and the Trump admin do not like us is that we haven’t donated to Trump (while OpenAI/Greg [Brockman, OpenAI’s president] have donated a lot), we haven’t given dictator-style praise to Trump (while Sam has), we have supported AI regulation which is against their agenda, we’ve told the truth about a number of AI policy issues (like job displacement), and we’ve actually held our red lines with integrity rather than colluding with them to produce “safety theater” for the benefit of employees (which, I absolutely swear to you, is what literally everyone at DoW, Palantir, our political consultants, etc, assumed was the problem we were trying to solve).
Sam is now (with the help of DoW) trying to spin this as we were unreasonable, we didn’t engage in a good way, we were less flexible, etc. I want people to recognize this as the gaslighting it is.
Vague justifications like “person X was hard to work with” are often used to hide real reasons that look really bad, like the reasons I gave above about political donations, political loyalty, and safety theater. It’s important that everyone understand this and push back on this narrative at least in private, when talking to OpenAI employees.
Thus, Sam is trying to undermine our position while appearing to support it. I want people to be really clear on this: he is trying to make it more possible for the admin to punish us by undercutting our public support. Finally, I suspect he is even egging them on, though I have no direct evidence for this last thing.
I think this attempted spin/gaslighting is not working very well on the general public or the media, where people mostly see OpenAI’s deal with DoW as sketchy or suspicious, and see us as the heroes (we’re #2 in the App Store now!). [Anthropic’s Claude chatbot later rose to no. 1 on one of Apple’s App Store download rankings.] It is working on some Twitter morons, which doesn’t matter, but my main worry is how to make sure it doesn’t work on OpenAI employees.
Due to selection effects, they’re sort of a gullible bunch, but it seems important to push back on these narratives which Sam is peddling to his employees.
This was presented as “leaked” to The Information. However, Anthropic has operated with a very tight-lipped model internally (good luck finding anybody from GTM discussing their approach outside of several podcasts). However, this looks like another part of the campaign, aimed at riding the negative sentiment towards Sam Altman and OpenAI’s agreement with the DoW.
Following the leak, Dario went on a weird “apology tour”, which again seemed to be an attempt at expanding the coverage around this, while working on launching a lawsuit.
The full document can be reviewed here, the key points:
What are they trying to achieve:
Core statement in the introduction
“Anthropic brings this suit because the federal government has retaliated against it for expressing that principle. … Anthropic turns to the judiciary as a last resort to vindicate its rights and halt the Executive’s unlawful campaign of retaliation.”
(¶ 1, Page 4)
Closing request in the introduction
“There is no valid justification for the Challenged Actions. The Court should declare them unlawful and enjoin Defendants from taking any steps to implement them.”
(¶ 17, Page 6)
Formal Prayer for Relief (what they are literally asking the judge to order)
“For these reasons, Plaintiff respectfully requests an order that:
As to the Secretarial Order: a. Declares the Secretarial Order, and the implementing Secretarial Letter, arbitrary, capricious, an abuse of discretion, and contrary to law … d. Sets aside and vacates the Secretarial Order, and the implementing Secretarial Letter, in its entirety …
As to the Presidential Directive: a. Declares that the Presidential Directive exceeds the President’s authority and violates the First Amendment and Fifth Amendment …
As to all of the Challenged Actions: a. Permanently enjoins Defendants … from implementing, applying, or enforcing the Challenged Actions; b. Directs Defendants … to rescind any and all guidance … c. Directs Defendants … to immediately issue guidance … to disregard the Challenged Actions …” (¶¶ 1–4 of Prayer for Relief, Pages 46–47)
Main arguments in their favour:
Trump’s own words (Presidential Directive, Feb. 27, 2026)
“The UNITED STATES OF AMERICA WILL NEVER ALLOW A RADICAL LEFT, WOKE COMPANY TO DICTATE HOW OUR GREAT MILITARY FIGHTS AND WINS WARS! … I am directing EVERY Federal Agency … to IMMEDIATELY CEASE all use of Anthropic’s technology. … Anthropic better get their act together, or I will use the Full Power of the Presidency to make them comply, with major civil and criminal consequences to follow.”
(¶ 88 & Exhibit 1, Page 21)
Hegseth’s immediate follow-up (Secretarial Order, same day)
“Anthropic’s stance is fundamentally incompatible with American principles. … In conjunction with the President’s directive … I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security. Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.”
(¶ 89 & Exhibit 2, Page 22)
Hegseth explicitly tying punishment to ideology
“Anthropic’s stance is fundamentally incompatible with American principles. Their relationship with the United States Armed Forces … has therefore been permanently altered.”
(¶ 91, Page 22)
Pentagon insiders admitting the order was ideological, not security-based
“One official who manages information security said that the Secretarial Order was ‘ideological’ rather than an accurate description of risk. Another official … acknowledged ‘there is no evidence of supply-chain risk’ from Anthropic’s AI model and reiterated that the Secretarial Order was ‘ideologically driven.’”
(¶ 102, Page 26)
Trump later confirming retaliation
“Well, I fired Anthropic. Anthropic is in trouble because I fired [them] like dogs, because they shouldn’t have done that.”
(¶ 103, Page 26)
No prior security concerns (FedRAMP, clearances, etc.)
“The federal government has never once expressed concerns about Anthropic’s security or Claude’s competencies. … Claude’s FedRAMP authorization represents the highest level of cloud security certification … Never during any of these security-focused processes did the government determine that Anthropic or its services posed a supply chain risk.”
(¶ 97, Page 24)
Counterarguments:
Anthropic admits it refused the Pentagon’s demand for “all lawful use”
“Anthropic substantially agreed to the proposal—except in two important respects. First, Anthropic did not develop Claude … to deploy lethal autonomous warfare without human oversight. … Second, Anthropic is unwilling to agree to Claude’s use for mass surveillance of Americans.”
(¶¶ 75–77, Pages 14–15)
Hegseth ordered Anthropic to keep supplying the Pentagon for six more months
“Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition …”
(Secretarial Order, quoted in ¶ 90, Page 22)
The Pentagon used Anthropic tools in a real strike hours after the ban
“Within hours of the Challenged Actions, moreover, the Department reportedly ‘launched a major air attack in Iran with the help of [the] very same tools’ that are ‘made by’ Anthropic …”
(¶ 101, Page 25)
Anthropic repeatedly offered to help transition to another provider
“Should the Department choose to offboard Anthropic, we will work to enable a smooth transition to another provider, avoiding any disruption …”
(¶ 87, Page 17)
What could possibly be the response from the administration to a direct lawsuit?
It turns out that escalating a confrontation with the administration in the middle of the highest-stakes military engagement that the US has entered since the invasion of Iraq makes people prickly. Nobody could’ve possibly predicted this!
While the Claude app shot up in usage on the App Store and many developers expressed support for picking a fight with the government, the executives actually approving budgets are definitely not excited about going through internal legal reviews and trying to figure out what the potential damage to their business would look like if they keep working with Anthropic.
The situation is bad enough that a small institutional investor in Anthropic known simply as Microsoft ($5B in the last round), filed a support motion for the lawsuit:
Main asks:
Microsoft’s direct request for a TRO
“As an Anthropic partner, Microsoft believes the Court should temporarily enjoin implementation of the Determination for all existing contracts and their ongoing use of Anthropic products, including with and through Microsoft products. … This pause will balance the equities and serve the public interest in three critical respects.”
(p. 2)Why a TRO is needed right now
“A temporary restraining order will enable a more orderly transition and avoid disrupting the American military’s ongoing use of advanced AI. Otherwise, Microsoft and other technology companies must act immediately to alter existing product and contract configurations used by DoW. This could potentially hamper U.S. warfighters at a critical point in time.”
(p. 2)Final ask in the conclusion
“To mitigate the risks outlined above and allow time for a more orderly resolution of the contract dispute between Anthropic and DoW, Microsoft respectfully requests that this Court grant Plaintiff’s motion for a temporary restraining order.”
(p. 9)Supporting arguements:
Microsoft explains why they are directly harmed and why the ban is unprecedented
“Microsoft has established a close business relationship with Anthropic PBC … including by integrating Anthropic’s products, services, and technologies into the products and services that Microsoft makes available to DoW and other customers. As an Anthropic partner, Microsoft is directly impacted by DoW’s designation that Anthropic presents a supply chain risk to national security pursuant to 10 U.S.C. § 3252 (the ‘Determination’).”
(p. 1)The Determination is overly broad and never used this way before
“The Determination has, without explaining the basis, labeled Anthropic a ‘supply chain risk’ against whom extraordinary measures are needed ‘to protect national security.’ … This drastic action has never been taken publicly against an American company.”
(p. 6)Microsoft agrees with Anthropic’s core safety restrictions
“Microsoft’s position is that AI should be focused on lawful and appropriately guarded use cases. For example, AI should not be used to conduct domestic mass surveillance or put the country in a position where autonomous machines could independently start a war. Microsoft believes the government itself appreciates and respects this position.”
(p. 3)Immediate enforcement would hurt the military and innovation
“The Determination immediately requires DoW to modify existing contracts to remove ‘covered item[s] of supply’ and ‘covered system[s].’ … Because those statutory terms sweep broadly, the Determination could be interpreted to ban the procurement of products and services that merely use or make available Anthropic’s products, thus imposing immediate financial harms on Microsoft and other similarly situated industry partners.”
(p. 4)Industry impact:
Massive immediate costs on contractors
“If the Determination takes effect immediately, Microsoft and other government suppliers will be compelled to expend significant resources assessing the contractual impacts of excluding Anthropic and Anthropic products. … The costs for these actions—including reengineering, re-procurement, and associated legal and administrative costs—will be incurred immediately.”
(p. 5)Unintended consequences for the entire tech sector
“The technology sector powers innovation through interconnectedness. … If a single piece of that interconnected offering (long accepted and supported by the government) can be disrupted by a supply chain risk determination, companies will change the way they approach their commercial and public sector relationships in future. … the Determination creates significant risks for commercial collaboration.”
(p. 6–7)Call for negotiation instead of litigation
“The harms articulated above may be avoided through a negotiated resolution, which weighs in favor of the public interest. There is reason to believe a negotiated resolution is possible here. … Maintaining the status quo while this Court considers the issues raised would simultaneously allow one or more of these alternative pathways to non-judicial resolution to be realized.”
(p. 8)Big-picture warning about hurting America’s AI lead
“As the Administration has recognized, the United States is in a ‘race to achieve global dominance’ in artificial intelligence and ‘[w]hoever has the largest AI ecosystem will set global AI standards and reap broad economic and military benefits.’ … This is not the time to put at risk the very AI ecosystem that the Administration has helped to champion.”
(p. 9)
Keeping in mind the significant investments from both Google and Amazon in Anthropic, we might be seeing a unified “big tech vs government” conflict brewing. This could mark the first significant shift from the dynamic established during the last election and could result in significant spending against the administration during the midterms. Currently I am not convinced of this outcome because most of this situation is Anthropic’s own doing; it’s also reversible if they bend the knee. The more cynical viewpoint would be that this is a token show of support in order to protect shareholder interests, but that all the hyperscalers have a vested interest in Anthropic’s rapid growth being curbed.
This is counterintuitive since all of them hold significant equity in the company, but with the launch of Claude Marketplace as a significant competitor to all the workflow tools and security plugins, and the general attitude of Dario to pick fights with anybody, it’s not difficult to see that behind the scenes everybody would breathe a little bit easier if Anthropic is pushed back to second place in the AI race.