Anthropic's Pentagon Deal: Why the "Dario Memo" Isn't the Story

Start with the framing, because the framing is where this goes wrong. The story everyone's telling: Anthropic markets itself as the safety-first AI lab, it's now chasing Pentagon money, and an internal memo from Dario Amodei exposes the tension. Tidy. It's also mostly a story about the wrong document.

I'll flag as I go where I'm reasoning versus where I'm citing a source, because on this topic the two get blurred constantly.

Here's the reasoning first. A company like Anthropic doesn't decide to enter defense work by writing a memo. It decides at two layers that predate any leaked note: the terms of service it will offer, and the accredited environment it deploys into. A memo about how to talk publicly is downstream of both. So the load-bearing question isn't "will they sell to the military." It's "which specific things did they refuse to do, and does the way they deployed the model defeat the safety their brand is built on." That's the piece worth writing.

"Continuing to talk to the Pentagon" is not a scoop

The sourced fact: Anthropic, Palantir, and AWS publicly announced a partnership in November 2024 to bring Claude to defense and intelligence customers through Palantir's platform on AWS. That's on the record.

Everything past that announcement — specific Impact Level deployments, air-gapped enclaves, a live configuration — I'm using as illustrative of how these deployments generally work, not as confirmed facts about Anthropic's current setup. I don't have an accreditation record in hand, and neither does the podcast that ran this as a spat. When a segment teases "choice words" and "continuing to talk" and quotes zero memo text, you're being handed a mood, not evidence. Enjoy the mood if you like. Just don't build an ethics conclusion on it. "Continuing to talk" is the steady state of a vendor already in the door.

How the deal actually reaches a soldier

There's no dramatic signing moment. There's a stack.

Two contract doors exist. One is a FAR-based contract — full federal acquisition compliance, slow, heavy. The other is an Other Transaction Authority, or OTA — the vehicle the CDAO and DIU reach for with AI, because it skips most of the FAR overhead and pulls in commercial tech fast. OTA vehicles are the preferred door for AI defense contracts precisely because they skip most FAR overhead and pull in commercial tech quickly. When you read "talking to the Pentagon," it almost always means an OTA discussion. Several labs have signed OTA-style agreements as a cohort under a ceiling figure. That's the door.

But the door isn't where the model lands. The model lands inside an accredited enclave: AWS GovCloud, or Palantir's environment, accredited to an Impact Level — IL5 for controlled-but-unclassified, IL6 for Secret. That accreditation is the actual "entering military work" event. It's quiet, it's paperwork, and it happens before the culture-war part starts. If you want the moment a lab entered military work, look at accreditation records, not a memo.

Here's why the alphabet soup matters to you if you're writing a check or a policy rather than an acquisition officer: the paperwork is the decision. Every dramatic quote lives downstream of a FAR-vs-OTA choice and an Impact Level number that lawyers and compliance staff settled long before the press cycle. So the next term is the one that actually decides whether the safety brand means anything.

The real fight: carve-outs vs flowdowns

A commercial vendor's terms of service say things like no autonomous weapons targeting, no domestic surveillance, no disinformation. Those terms must be negotiated against DFARS flowdown clauses — government contract language that can override commercial terms limiting how the mission owner uses a system it paid for, depending on the contract vehicle and how carve-outs are documented.

One caveat worth stating plainly: whether a specific DFARS flowdown actually overrides a given commercial usage restriction is contract- and clause-dependent, and I'm describing the general mechanism rather than citing a confirmed instance of a carve-out being overridden in an Anthropic contract. Treat "can override" as the shape of the risk, not a documented outcome — verify it against the actual clause set in any specific deal.

So a Contracting Officer has to decide: does the government accept a commercial usage policy that constrains its own use? That negotiation — not a memo — is the load-bearing event. If the carve-outs survive the flowdowns, the safety brand has teeth in the contract. If they get negotiated away, it doesn't. That's checkable in principle, and it's where the actual tension in any AI-safety-company defense relationship lives.

One word does all the work: "legally authorized"

People assume Anthropic's usage policy flatly bans military use. It doesn't.

The sourced fact, with a hedge: Anthropic publicly announced expanded usage terms for government customers — its own blog post described special usage policies for vetted national-security customers, reported around mid-2024. I'm confident the expansion happened and that it added a national-security path while retaining named prohibitions. I'm not going to pin the exact clause version to a specific month from memory, so treat the year as approximate and verify it against the policy's revision history, which is public.

The hinge phrase in this kind of policy is "legally authorized." The move is: allow the whole category of defense and intelligence use, then subtract specific verbs — weapons targeting, domestic surveillance, disinformation. Read that way, it isn't an unresolved dilemma. It's a resolved one, resolved at the drafting layer, by a lawyer, deliberately. Permit the category, name the exceptions.

Which means the hypocrisy charge misreads the document. My read is that the public safety messaging and the enforceable terms of service are decoupled by design. A memo saying "we're different from OpenAI" is a marketing artifact. The ToS says what's actually prohibited; that's the contract. They diverge on purpose. That's not a scandal — it's how you keep a brand and sign a deal at the same time. So if you're chasing the AI ethics revenue tradeoff, the tradeoff isn't in the memo. It's in whether the named exceptions survive a flowdown.

The dilemma actually worth arguing about

Here's where the values-vs-revenue frame collapses into something better: brand vs mechanism.

Anthropic's brand is built on conspicuous refusal — the model that says no, that won't help with the sketchy thing. That refusal behavior is the product differentiator. But in a defense deployment, refusal is a bug. A mission owner wants Claude to answer questions about, say, adversary CBRN capabilities or offensive cyber tactics — legitimately, for defense. The brand promises refusal; the customer is paying for the opposite.

So the honest question isn't "is Anthropic hypocritical." That's unanswerable and lazy. The question is empirical: when the safety tuning is relaxed for a defense customer, which refusals survive and which were cosmetic?

Shallow refusals vs deep refusals

This is the part almost no coverage reaches, so be concrete. Refusals live at different depths.

Shallow refusals are system-prompt and RLHF-layer gates. A customer with a fine-tuning endpoint inside the enclave can strip these trivially. They look impressive in a demo and evaporate under a fine-tune.

Deep refusals are things like CBRN-uplift classifiers trained deep into the model's behavior. These are the ones that actually distinguish a safety-first lab from a lab with a good press team.

The uncomfortable implication: "we refuse dangerous requests" is only meaningful to the degree those refusals are deep. And you can't tell from the outside which is which without an uplift-eval number — how much extra capability the model actually gives someone on a specific hazard, before and after. No gossip segment has that number. Nobody claiming "Pentagon-ready" or "safely deployed" has that number. Without it, both praise and outrage are guessing.

"Human-on-the-loop" is doing enormous load-bearing work

The usual reassurance is that the model can't fire anything — there's a human on the loop. In these contracts, "no lethal autonomy" typically means the model can be one component in a decision chain but can't close the loop itself. Good. But notice what that is: an architectural control, not a property of the model's weights. The safety comes from the process, not the classifier.

And processes degrade. If the human on the loop is rubber-stamping outputs under time pressure, the carve-out is theater. Whether human-on-the-loop is real safety or a phrase on a slide depends on ops tempo and the audit trail. Which brings up the thing nobody mentions.

The no-logging problem

Classified and sensitive enclaves often run no-logging, for security reasons — you don't want prompts and outputs sitting in a log that becomes a target. Reasonable. But no-logging kills your ability to monitor misuse after the fact. It also kills your ability to audit whether the human on the loop was actually deciding or just clicking.

So you can end up in the exact configuration where the safety brand matters most — a powerful model, a defense mission, relaxed refusals — with the least visibility into whether any control held. That's the genuine tradeoff.

One more piece of context. Anthropic's published Responsible Scaling Policy governs catastrophic capability thresholds — bio, cyber, autonomy at scale, expressed as ASL tiers. A national-security customer operating below those trigger thresholds sits in exactly the zone with the most latitude and the least public accountability. Not the headline tier. The quiet middle.

FAQ

Why do AI safety companies work with defense customers?

Because "safety-first" is a claim about how a model behaves, not a vow of pacifism — and the same terms of service that name prohibited uses also carve out a legally-authorized national-security lane, which is where the revenue and the mission-alignment argument both live. Put plainly: they take defense work because their own policy was written to permit the category while banning specific verbs. The AI safety company defense case is that a frontier model deployed under vetted, human-supervised conditions is, in their telling, safer in a defense customer's hands than a less-careful competitor's. Whether that holds is exactly the deep-vs-shallow-refusal question above.

Is Anthropic's usage policy a ban on military use?

No. It permits vetted national-security and intelligence use while retaining named prohibitions — weapons targeting, domestic surveillance, disinformation. Read the revision history rather than the headline.

Does frontier AI government contracting mean the model can fire weapons?

Typically no — the standard term is human-on-the-loop with no lethal autonomy. But that's an architectural promise about the deployment, not a property of the weights, so it's only as strong as the ops tempo and audit trail behind it.

What's the single number that would settle the debate?

The uplift-eval delta on the relevant hazard — how much extra capability the model gives a user before and after safety tuning — plus whether the enclave logs prompts at all. Absent both, "safely deployed" is unfalsifiable.

Governance checklist for diligence

Run this before you accept any "safe defense AI" claim. The same checklist applies to any frontier AI government contracts, not only Anthropic's.

Terms vs press: Did I read the actual acceptable-use policy revision, or a memo or announcement? Only the first binds.

Named prohibitions: Which specific prohibited-use verbs are still named in the current version, and did any disappear versus the prior revision?

Flowdown survival: Is there evidence the commercial carve-outs survived DFARS flowdown, or could the government contract override them?

Refusal depth: Are the safety refusals deep — weight-level classifiers — or shallow — system-prompt and RLHF gates a fine-tune can strip? Ask which.

Uplift number: Is there a stated uplift-eval delta on the relevant hazard? If not, note the absence as a red flag.

Logging: Does the enclave log prompts and outputs, or is it no-logging? No logs means no post-hoc misuse audit.

Human-on-the-loop reality: Is there an audit trail proving human decisions aren't rubber-stamps under time pressure?

What's actually checkable tonight

The memo is weak evidence because it's press copy, and press copy is designed to diverge from the terms. The binding evidence is elsewhere, and some of it is public.

First, read the acceptable-use policy revision history. Pull Anthropic's usage policy, find the national-security and defense language, and note which specific prohibited-use verbs are still named. Compare the current version to the prior revision to see what changed. Those named prohibitions, not the memo, are what the brand actually promises.

Second, look for the accreditation, not the announcement. Search for the enclave and the impact level — GovCloud, Palantir's environment, IL5 vs IL6. The impact level tells you the sensitivity ceiling of what a model is cleared to touch. That's the "entering military work" fact, and it's more concrete than any quote.

Third, demand the uplift number in diligence, and treat its absence as a red flag. You can't obtain a proprietary uplift-eval delta yourself. But if you're evaluating this lab, you can put the question on the term sheet: what's the uplift delta on the relevant hazard, and does the enclave log prompts at all? If they can't or won't answer, you now know the safety claim is unverifiable — that's a finding, not a dead end.

Do those three and you'll know more than the segment that ran this as a spat.

The argument worth having

Not "is Dario a hypocrite." The interesting question is narrower and answerable: which refusal categories did Anthropic keep as deep, weight-level gates for defense customers, and which got relaxed to system-prompt gates a fine-tune can strip? That single distinction decides whether "safety-first, Pentagon-ready" is a real engineering claim or a slogan holding two incompatible things together.

So here's the question back to you. If you're evaluating this lab — as an investor, a founder pricing your own defense play, or a policy reader — which carve-out would you stress-test first in diligence: the weapons-targeting prohibition, the surveillance one, or the logging policy? That choice reveals what you actually think binds. Tell me which, and why.

Then do the three things: pull the AUP revision history and list the still-named prohibitions; find the enclave's impact level instead of the press release; and put the uplift number and logging policy on the diligence list — and flag it if the answer never comes.