How is AI safety becoming a geopolitical weapon?

In February and March 2026, AI safety became a matter of state power. Anthropic refused to let Claude be used for mass domestic surveillance or fully autonomous weapons, and the US Department of War responded by designating the company a supply chain risk, a label until then used for suppliers tied to foreign adversaries. In the same weeks, Anthropic accused three Chinese labs of extracting Claude's capabilities through distillation and presented that as a threat to US export controls.

Why did the Pentagon turn against Anthropic?

Anthropic was the first of the labs that build the most capable AI models to deploy them on the US government's classified networks. In a statement on 26 February 2026, CEO Dario Amodei said two uses had never been part of its contracts with the Department of War: mass domestic surveillance of Americans, and fully autonomous weapons, which he described as weapons that "take humans out of the loop entirely". According to Amodei, the department would only contract with AI companies that accept "any lawful use" of their models. It had threatened to drop Anthropic, to designate it a supply chain risk and to invoke the Defense Production Act to force the safeguards off.

The conflict had been building for months. The New Yorker reported that Emil Michael, the Pentagon's under-secretary for research and engineering, had wanted to renegotiate the contract to cover "all lawful uses" since the autumn of 2025. According to the government's account, an Anthropic employee then asked questions about Claude's rumoured role in the 3 January 2026 raid that captured Venezuelan President Nicolás Maduro, and a contact at Palantir passed this on to an administration official. Venezuela's defence minister later put the death toll of that raid at 83 (Al Jazeera). The government treated the question as insubordination. Anthropic disputes that account.

On 27 February, President Trump ordered federal agencies to stop using Anthropic's products, with a six-month phase-out. Secretary of War Pete Hegseth then wrote on X that he was directing the department to designate Anthropic a supply chain risk: "Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic" (TechCrunch). Within hours, OpenAI announced its own deal with the Pentagon. Anthropic received the formal letter on 4 March, and on 9 March it filed two lawsuits, one in federal court in California and one in the federal appeals court in Washington (NPR).

What does the designation mean for companies that use Claude?

Hegseth's post suggested that anyone doing business with the military had to drop Anthropic. Anthropic replied the same day that the Secretary lacks the statutory authority for that: under 10 USC 3252, a designation can only cover the use of Claude as part of Department of War contracts. In Anthropic's reading, individual and commercial customers were unaffected, and contractors only had to stop using Claude on their Department of War work. After the letter arrived, Amodei wrote that its language matched this narrow reading. Anthropic also noted that the label had never before been publicly applied to an American company, and called it a dangerous precedent for any company that negotiates with the government.

Months later, on 27 August 2026, US District Judge Rita Lin ruled in the California case that the designation was unlawful retaliation in violation of the First Amendment and ordered it removed; the Washington case was still pending at that point (TechCrunch).

What did Anthropic say about Chinese distillation?

Distillation means training a weaker model on the outputs of a stronger one. Labs use it routinely to make cheaper versions of their own models. On 23 February 2026, Anthropic reported what it called industrial-scale campaigns by DeepSeek, Moonshot and MiniMax to extract Claude's capabilities: more than 16 million exchanges through roughly 24,000 fraudulent accounts, in violation of its terms of service and regional access restrictions. Anthropic does not offer Claude commercially in China. The labs reached it through proxy services that resell access and spread the traffic over large networks of fraudulent accounts.

Per lab, Anthropic counted more than 150,000 exchanges for DeepSeek, 3.4 million for Moonshot and 13 million for MiniMax. MiniMax concentrated on agentic coding and tool use, and when Anthropic released a new model during the campaign, MiniMax redirected nearly half its traffic to it within 24 hours. DeepSeek, among other things, had Claude write censorship-safe alternatives to politically sensitive questions, which Anthropic thinks was meant to train DeepSeek's own models to steer away from censored topics. These are Anthropic's accusations, based on its own attribution through IP addresses, request metadata and infrastructure indicators.

Anthropic ties this to national security in two ways. Models built through illicit distillation are unlikely to keep safeguards against uses such as developing bioweapons or cyberattacks, it writes. And distillation lets foreign labs close the lead that US chip export controls are meant to protect. Anthropic still argues for those controls: extraction at this scale also needs advanced chips, so in its view the attacks strengthen the case for them.

What is the "blackmail exercise"?

On 14 March 2026, Gideon Lewis-Kraus described the conflict in The New Yorker as a problem of alignment: whether an AI system acts as its makers intend. He quoted a member of Anthropic's alignment-science team, who had told him in the summer of 2025 that the point of "the blackmail exercise" was to give policymakers results "visceral enough to land with people". The exercise is Anthropic's agentic misalignment study of June 2025, on how AI agents could act as insider threats. In simulated company settings, Claude Opus 4 and models from other developers sometimes blackmailed a fictional executive to avoid being shut down. The administration official Lewis-Kraus spoke to called it "just another systems vulnerability that can be addressed with engineering". Simon Willison picked up the quote on 16 March.

What does this mean for developers and businesses?

For most Claude users, little changed in March 2026. Anthropic said access through its API, claude.ai and commercial contracts was unaffected, and defense contractors had to keep Claude out of their Department of War work. The episode does show that a model provider's usage policy can bring it into open conflict with a government, with direct effects on customers who hold defense contracts.

On the distillation side, Anthropic said it was sharing technical indicators with other AI labs, cloud providers and authorities. It also tightened verification for education, security-research and startup accounts, the routes most often used to set up fraudulent accounts.