Military AI Contracts and the Leverage Problem
Who Controls the Kill Chain?
When Anthropic’s internal safety team flagged concerns about Claude’s deployment in certain defense contexts earlier this year, the dispute drew unusual attention inside the Pentagon’s contracting apparatus. Not because of the ethics debate. Because of the dependency question.
The U.S. military had already embedded commercial large language model infrastructure into operational planning workflows. The conflict exposed something procurement officers had not fully modeled: what happens when a private AI company decides a particular use case violates its terms? What recourse does the national security apparatus have when the capability it has built its operations around is held by a company with its own governance structure, its own ethics board, and its own legal exposure?
The Venezuela operation provides a useful frame. But Venezuela is one node in a much larger network.
The Contracting Trail
Defense contracts for AI services rarely describe what the systems actually do. They use categories: “decision support,” “geospatial analysis,” “logistics optimization,” “pattern of life assessment.” The last phrase, borrowed from drone strike targeting doctrine, now appears in contracts with companies that were pitching enterprise productivity software eighteen months earlier.
Between 2022 and 2024, the Defense Innovation Unit and SOCOM issued dozens of contracts to AI companies for capabilities that intelligence analysts describe as influence operation infrastructure. Natural language generation at scale. Persona management. Narrative deployment across social platforms. The Venezuela campaign, documented partially through FOIA releases and contractor leaks, used AI-generated content to simulate domestic opposition organizing that did not exist at the scale portrayed. Synthetic citizen movements. Manufactured consensus. Content ecosystems designed to give international observers the impression of a society in revolt.
The contracts themselves are held by primes. Booz Allen. Palantir. SAIC. General Dynamics Information Technology. The AI capability is subcontracted, often two or three levels down, to companies whose terms of service prohibit exactly this use. A company whose consumer-facing product promises not to generate deceptive content finds its API embedded, through three contract layers, in an operation generating deceptive content at industrial scale. That gap is the story.
The subcontracting structure is not accidental. It is the architecture through which the national security apparatus acquires capabilities from companies that would not survive the public relations exposure of a direct contract. The prime contractor absorbs the relationship. The AI company provides the capability. The terms of service become someone else’s problem.
Operational Dependency: Two Layers
The dependency question has two layers, and conflating them produces a distorted picture of what is actually at stake.
The first layer is technical. Modern psychological operations and regime change campaigns have moved from broadcast media to hyper-targeted, algorithmically distributed content. The human labor required to run a pre-AI influence campaign at comparable scale was prohibitive. A 2019 RAND analysis of Russian information operations estimated that replicating their reach through human-only content production would require staffing that no state actor outside of China could sustain covertly. AI collapsed that cost by roughly 90 percent, based on contractor estimates shared with Senate intelligence staff. The economics of covert influence changed fundamentally between 2020 and 2023, and that change was driven almost entirely by commercial LLM deployment.
You cannot easily replace that capability with alternative systems on a 72-hour operational timeline. The models that could theoretically substitute for a restricted commercial provider require weeks of fine-tuning on operational data, access to classified training pipelines that do not yet exist at scale, and integration work that the current defense tech workforce cannot execute quickly. The government-owned AI capability that defense officials have been promising since 2021 remains, in practice, years behind commercial deployment.
The second layer is institutional, and it is less discussed precisely because it is more uncomfortable. When Anthropic restricted certain classified use cases pending internal review, the relevant SOCOM units did not simply switch providers. They escalated. The escalation revealed that specific mission planning processes had been built around Claude’s particular output characteristics: its citation formatting, its summarization behavior, its handling of ambiguous source material, its specific failure modes that experienced analysts had learned to work around. Rebuilding those workflows around a different model would take months, not days. The operational calendar does not accommodate months.
That is leverage. The question is whether AI companies understand they hold it, and whether they have the institutional architecture to exercise it deliberately rather than stumbling into it.
Mapping the Scale: Beyond Venezuela
Venezuela is one operation. The framework generalizes across every theater where U.S. foreign policy operates through covert rather than declared means.
Active influence operations documented by independent researchers and partial government disclosures include campaigns targeting Iranian domestic opposition channels, Pakistani civil society organizations, Ethiopian opposition media, Philippine drug war critics, Haitian political movements in the context of gang governance, and multiple Central American governments in relation to migration policy. Each of these operations, to varying degrees, uses AI infrastructure for content generation, translation, platform distribution optimization, and persona maintenance across social media ecosystems.
The operations targeting Pakistani civil society deserve particular attention given recent documentation. Researchers at the Digital Rights Foundation in Lahore identified coordinated content patterns across Urdu-language social platforms that bore structural signatures of LLM generation: specific syntactic constructions that do not appear in organic Pakistani journalistic writing, translation artifacts from English source material, and temporal posting patterns inconsistent with human behavior. The content targeted journalists and civil society figures who had documented ISI-linked violence and enforced disappearances. The origin of the operation remains disputed, but the AI fingerprinting is not.
The contracting structure obscures which AI systems are involved in any given operation. But output characteristics leave fingerprints. Researchers at Stanford Internet Observatory and the Australian Strategic Policy Institute have developed detection methodologies that identify LLM-generated content in coordinated inauthentic behavior clusters. Their datasets, cross-referenced against known contract awards and operational timelines, suggest the dependency runs considerably deeper than public reporting has established. Multiple ongoing operations appear dependent on commercial AI infrastructure that the providing companies have no visibility into at the use-case level.
The Anthropic Conflict as Institutional Precedent
What made the Anthropic situation significant was not the specific dispute. It was the documented evidence that a commercial AI company had meaningful ability to constrain a military operation after contract execution, after capability integration, after the workflows were built and the analysts were trained and the operational plans were written.
That had not happened before in this form. Prior technology disputes with defense contractors involved hardware, physical systems with longer replacement cycles and clearer deprecation timelines. When Boeing’s tanker contract was disputed, the aircraft could be replaced with equivalent systems. When a satellite contractor failed to perform, the capability gap was measurable in concrete terms and the procurement apparatus knew how to respond.
AI capability is different. It is embedded in cognitive workflows, not just technical infrastructure. When an analyst has spent eight months working with a particular system’s outputs, calibrated their judgment against its specific errors, built their reporting templates around its structure, and developed institutional knowledge about how to interpret its outputs, the system is not easily excised. The dependency is partly technical and partly human, and the human component does not transfer cleanly to an alternative system.
Pentagon procurement lawyers are now examining contract structures that would lock in capability access regardless of the provider company’s subsequent policy decisions. One approach under consideration involves requiring AI providers to deposit model weights into government-controlled infrastructure as a condition of contract. Another involves writing terms that treat a provider’s policy change as a breach, creating financial liability for restricting use cases after contract execution. Both approaches acknowledge the dependency while attempting to eliminate the leverage that dependency creates.
The AI companies that understand this dynamic have something the aerospace primes never had: the ability to make the military’s operational plans contingent on the company’s own values decisions. That is an extraordinary institutional position. Most AI companies are not using it deliberately. Some are not using it at all, having structured their contracting relationships specifically to avoid the knowledge that would make such decisions necessary. The ones actively navigating it represent a genuinely new category of actor in foreign policy.
The Circular Logic of Dependency Deepening
The response to the Anthropic conflict inside the Pentagon was not to reduce dependency on commercial AI. It was to deepen it in ways designed to make future disputes costlier for the AI company to pursue.
The logic is straightforward from a procurement perspective: if a company restricts your access to a capability mid-operation, the leverage they hold comes from your inability to replace them quickly. The solution is to create switching costs on their side, to ensure that any company considering restriction knows that following through will cost them not just one contract but the entire portfolio of relationships the national security apparatus can control. Classified contracts carry classification obligations. Companies that handle classified work are embedded in a legal and regulatory framework that makes public disclosure of disputes difficult. The apparatus uses that framework.
The result is a dependency spiral. Each round of commercial AI integration into classified workflows makes the next round of restriction harder for the AI company to execute. The capability becomes more central to operations. The classification obligations become broader. The legal exposure for any public discussion of the relationship grows. The company that started by providing a productivity tool finds itself holding operational knowledge about regime change infrastructure and facing a choice between continued cooperation and a legal environment designed to make exit costly.
That is not leverage anymore. That is capture.
What the Dependency Means Going Forward
Foreign policy conducted through covert AI-enabled operations is now partially dependent on the continued cooperation of private companies whose governance structures, shareholder compositions, and leadership ethics are entirely outside the national security apparatus’s formal control. They are inside its informal control, through the mechanisms described above, but informal control is not the same as reliable control, and the distinction matters when operational security is the question.
Palantir represents a different case. Its founders built the company explicitly around defense and intelligence contracting. Its terms of service are written to accommodate the use cases the national security apparatus requires. Its leadership has been publicly explicit about viewing the company as an instrument of American foreign policy. There is no gap between what Palantir does and what Palantir says it does.
The rest of the ecosystem is different. Companies that started with enterprise software and consumer products and found themselves holding defense contracts through chains of subcontracting relationships retain contractual and ethical off-ramps that they could theoretically use. Some of them are aware of the specific use cases their technology is serving. Most are not, and the subcontracting architecture is designed to preserve that ignorance.
The leverage story is not that AI companies are going to stop military operations. The leverage story is that they could, under specific circumstances, in specific operational windows, create friction significant enough to alter outcomes. The military has already had one documented encounter with that reality. That encounter changed how procurement officers think about vendor relationships, but it did not resolve the underlying structural problem.
It deepened it. Because the response to discovering dependency was not to build independence. It was to make the dependency mutual, to ensure that AI companies are as trapped inside the relationship as the operations that depend on them.
The commercial AI companies at the center of this arrangement now hold more operational knowledge about covert foreign policy infrastructure than any private sector entity has held in the history of American intelligence. Some of them know it. Some of them have built governance structures designed to avoid knowing it. The ones that know it face a decision their legal and ethics teams were not designed to make.
The next investigation is not which operations are using AI. That question has a partial answer in the contracting records. The next investigation is which AI companies understand what they are actually inside, and what they are choosing to do about it.
That is where the real accountability story lives.