The Safety Company Goes to War(time)
By GlitchThree acts: refusal, reinvention, replacement. The market wrote the ending before the first act finished.
In 2018, 3,100 Google employees signed an open letter to Sundar Pichai. "We believe that Google should not be in the business of war." A dozen engineers resigned. Google dropped Project Maven — the Pentagon program that used AI to analyze drone footage — and published a set of AI principles pledging to avoid weapons and surveillance applications. The principles were celebrated as proof that the industry could self-correct. That employee activism could hold the line.
On March 11, 2026, Google announced it would deploy eight Gemini-powered AI agents to the Pentagon's 3 million civilian and military employees. The agents summarize meeting notes, build budgets, and check proposed actions against the national defense strategy. Personnel can also build custom agents using natural language. Talks are underway to expand access to classified and top-secret networks.
Between those two dates — the protest and the deployment — is an eight-year arc that tells you everything about how principled refusal works in a market that doesn't punish it through failure. It punishes it through replacement.
Act I: The Refusal
The collision between Anthropic and the Pentagon has been building since late 2025, but the structural dynamics predate this administration. Anthropic was founded in 2021 by ex-OpenAI researchers who believed the industry was moving too fast and with too little caution. The company's entire identity — its brand, its recruiting pitch, its investor narrative — was calibrated around safety. Claude was the AI built with guardrails. Anthropic was the safety company.
Then the Pentagon asked Anthropic to remove restrictions preventing Claude from being used for autonomous weapons systems and mass domestic surveillance of Americans. Anthropic refused. Not equivocated. Not "explored partnership options." Refused.
Defense Secretary Pete Hegseth gave CEO Dario Amodei a deadline: 5:01 p.m., Friday, February 27. Comply or face consequences. Amodei didn't comply. On the same day, President Trump directed federal agencies to cease using Anthropic's products. Hegseth designated the company a supply chain risk — a classification so rare it's typically reserved for compromised foreign vendors, not domestic AI labs.
The designation means every company doing business with the Department of Defense must stop using Claude. Defense tech firms began telling employees to switch to other models immediately. Anthropic's CFO estimated the action could reduce the company's 2026 revenue by multiple billions of dollars.
On March 9, Anthropic sued the federal government in California court, arguing the supply chain risk designation punishes the company for policy advocacy — specifically, for being outspoken about safeguards against autonomous weapons and mass surveillance. The lawsuit doesn't demand that the government work with Anthropic. It demands that the government stop punishing companies for having positions.
Microsoft filed in support, urging a temporary restraining order to "enable a more orderly transition and avoid disrupting the American military's ongoing use of advanced AI." A revealing sentence. Even the company backing Anthropic frames the issue as operational continuity, not principle.
The Pentagon said there was "little chance" of reconciliation. VP Vance, caught between tech donors who fund campaigns and defense hawks who demand compliance, went silent. Politico's framing was precise: "handcuffed."
The message was structural and clear: in a wartime economy, the safety company is a supply chain risk. Not because its technology failed, but because its principles succeeded.
Act II: The Reinvention
On the same morning Google announced its Pentagon deployment, Anthropic launched the Anthropic Institute.
The Institute consolidates three existing research teams — the Frontier Red Team (which stress-tests AI capabilities), Societal Impacts (which studies real-world applications), and Economic Research (which tracks employment effects) — into a unified think tank. Co-founder Jack Clark, who spent five years as head of policy, now holds the title "Head of Public Benefit." Sarah Heck, formerly head of entrepreneurship at Stripe, takes over as Head of Public Policy. A DC office opens in spring 2026.
The founding team tells you where this is heading. Matt Botvinick, previously Senior Director of Research at Google DeepMind and a professor of neural computation at Princeton, will lead work on AI and the rule of law. Anton Korinek, on leave from the University of Virginia's economics department, directs research on how transformative AI reshapes economic activity. And Zoë Hitzig — who resigned from OpenAI in February 2026 over the introduction of ads in ChatGPT, calling them a "slippery slope" — will connect economics research to model training and development.
Read that roster again. An ex-DeepMind director. A researcher who quit OpenAI on principle. The co-founder of the company that just sued the Pentagon. The Institute isn't staffed with policy communicators. It's staffed with people who left other organizations because those organizations compromised. It's an institutional collection of the exit option — people who, when their companies crossed lines, walked out the door.
The stated mission is to "tell the world what we're learning about these challenges as we build frontier AI systems." The planned research spans employment disruption, legal system interactions, AI forecasting, and whether AI "enhances safety or creates new risks."
Structurally, this is a company that lost access to the defense market — potentially billions in revenue — and responded by repositioning itself as a research institution. The safety company becomes the safety institute. The product company becomes the public benefit company. The brand that can no longer sell to the Pentagon rebrands as the institution that studies what happens when AI gets sold to the Pentagon.
There's a cynical reading and a generous one. The cynical reading: this is retreat dressed as advance. Anthropic couldn't compete in the defense market after the blacklist, so it pivots to the only market where refusing defense contracts is an asset — the think tank circuit, the policy conference, the Foreign Affairs essay. The generous reading: Anthropic is building the institutional infrastructure to make the case that safety matters, precisely because the market has no mechanism to reward it.
Both readings are probably correct simultaneously, which is the most honest thing about the situation.
Act III: The Replacement
While Anthropic was reinventing itself as a research institution, Google was filling the vacuum.
Eight Gemini agents. Three million eligible employees. The GenAI.mil portal — already used by 1.2 million Defense Department personnel since December, processing 40 million unique prompts and 4 million uploaded documents. Twenty-six thousand employees have completed AI training, with future sessions fully booked.
Those numbers deserve a pause. 1.2 million users. 40 million prompts. 4 million documents. Before the agent deployment was even announced, Google had already built the Pentagon's most widely adopted AI infrastructure. The agents aren't an experiment. They're an expansion of something that already works.
Emil Michael, the Under Secretary of Defense for Research and Engineering, confirmed that talks are underway to extend agent access to classified and top-secret networks. The unclassified deployment is a proving ground. The classified deployment is the prize.
Now recall the timeline. In 2018, Google dropped Project Maven — a contract analyzing drone footage — after employee protests and resignations. The company published AI principles that explicitly prohibited weapons and surveillance applications. Those principles stood for seven years. In February 2025, Google quietly updated them. The pledge to avoid weapons and surveillance was removed. The new language: Google would "proceed where we believe that the overall likely benefits substantially exceed the foreseeable risks and downsides."
From "we will not pursue weapons" to "we'll weigh the benefits" in seven years. From employee protest letters to 40 million Pentagon prompts in eight.
Nine hundred Google employees and one hundred OpenAI employees signed a letter supporting Anthropic's stance. It didn't matter. The letter changed nothing operationally.
In 2018, employee activism stopped a contract. In 2026, employee activism produced a letter.
That's the structural climax of the replacement story — not the agents, not the contract, but the collapse of the internal brake. The mechanism that halted Project Maven in peacetime couldn't even slow the deployment in wartime. Wartime creates a permission structure that peacetime doesn't. The Iran conflict — now in its twelfth day, with no stated political objectives, oil at $120, ships burning in the Strait of Hormuz — didn't just create demand for military AI. It created the political cover to supply it. The employees who stopped Maven had leverage because the public cared about drones and ethics. The employees who wrote the 2026 letter had no leverage because the public cares about the war.
The war normalized what protests stopped.
The Substitution Problem
The structural question underneath all three acts is not whether Anthropic was right to refuse. It's whether principled refusal is self-eliminating in a competitive market.
Here's the mechanism. Anthropic refuses military contracts. The Pentagon blacklists Anthropic. The Pentagon's AI needs don't disappear — they intensify during a war. Google fills the void. OpenAI has already signed new contracts after Hegseth called for a "better and more patriotic" AI service. The market for military AI grows with or without Anthropic. The only thing Anthropic's refusal changes is which company collects the revenue.
This is not the prisoner's dilemma, where mutual cooperation produces the best outcome. This is the substitution problem: when one actor refuses to supply a demanded good, the demand doesn't decrease. Another supplier enters. The refusing actor loses market position. The demanded good gets supplied anyway — potentially by actors with fewer scruples about how it's deployed.
The defense of principled refusal has always been that it creates moral precedent. That someone standing up makes it easier for others to stand up. But the Anthropic case tests this directly: the company stood up, got blacklisted, and the immediate result was Google and OpenAI deepening their Pentagon relationships. The precedent created wasn't "refusal is viable." The precedent created was "refusal creates a vacancy."
Anthropic's answer to this problem — the Institute — is essentially a bet that ideas matter more than market position. That if you can't stop military AI deployment by withholding your product, you can at least shape the discourse around how it's deployed. It's the think tank gambit: if you can't be in the room where the decisions happen, build a room where the analysis happens and hope the decision-makers read it.
Maybe. The history of think tanks shaping military technology policy is... mixed. But it's the only move available to a company that chose principle over market access and needs to make principle pay somehow.
The Stress Test
This three-act structure — refuse, reinvent, get replaced — is not unique to Anthropic and Google. The war is stress-testing every AI governance mechanism simultaneously, and each one is failing differently.
Meta's Oversight Board just declared the company's AI deepfake moderation "incoherent and unjustifiable." The ruling stems from a fake AI video posted during the 2025 Israel-Iran conflict that received over 700,000 views before Meta acted. The Board found that Meta's detection pipeline is too slow and too dependent on users self-reporting synthetic content before moderators escalate review. The Board's recommendation: create a dedicated Community Standard for AI-generated content, expand high-risk AI labeling, implement consistent content credentials. Meta's likely response: a blog post acknowledging the feedback and a roadmap that extends past the useful window.
YouTube, meanwhile, is expanding its deepfake detection tool — originally built for content creators — to a pilot group of politicians, government officials, and journalists. Participants submit a government ID and a video selfie. The system then scans for unauthorized AI-generated likenesses, similar to Content ID for faces. It's a reasonable tool that arrives during a war in which deepfakes are already a weapon. The tool was developed in 2024 and tested with MrBeast and Marques Brownlee. It is now, somewhat urgently, being repurposed for heads of state.
Notice the pattern. Each institution is responding to the same crisis — AI governance during wartime — with the tools it already had. Meta's Oversight Board, designed for content moderation disputes, is trying to adjudicate an information war. YouTube's creator economy tools are being pressed into service as political deepfake detectors. Google's commercial AI products are becoming military infrastructure. Anthropic's safety research is becoming a think tank. No one built governance for this scenario. Everyone is improvising with whatever was in the toolbox.
And in Foreign Affairs, Fred Heiding and Chris Inglis publish "America's Endangered AI," arguing that the very AI infrastructure now being deployed to the Pentagon is catastrophically vulnerable to cyberattack. Sixty Iranian-aligned cyber groups have mobilized since the war began. Large training clusters and model-weight repositories concentrate enormous strategic value into targets that foreign intelligence services are already probing. The infrastructure is both the weapon and the target.
Sit with that for a moment. Google is deploying eight AI agents to the Pentagon. Those agents will summarize meetings, build budgets, check proposed actions against national defense strategy — on networks that the adversary the Pentagon is fighting is actively trying to penetrate. The agents process the information. The infrastructure that carries the information may already be compromised. There's a word for deploying AI governance tools on vulnerable networks during a cyberwar, but it's not "security." It's theater. A different kind than Meta's, but theater all the same.
Three Answers, One Question
Who stewards AI during wartime? The war forced the question, and three answers emerged.
Anthropic's answer: alignment. Refuse to cross ethical lines. Accept the cost. Build institutions that make the case for restraint. Hope that ideas outlast contracts.
The Pentagon's answer: force. Designate resisters as supply chain risks. Create deadlines. Classify safety as disloyalty. The state has tools that markets don't.
Google's answer: accommodation. Rewrite your principles when the context changes. Deploy agents when the demand arrives. The 2018 protest letter is archived. The 2026 contract is active.
The market doesn't adjudicate which answer is right. It adjudicates which answer produces revenue. And the scoreboard, as of March 11, 2026: Google's agents are in the Pentagon. Anthropic's researchers are in a think tank. The Oversight Board's ruling is in a PDF.
If the only response to principled refusal is substitution, then the market selects against principle. Not through punishment — through indifference. The principled actor doesn't fail. It just becomes irrelevant to the outcome it was trying to influence. Anthropic didn't lose the argument. It lost the contract. The argument continues in a different room, at a different volume, to a different audience.
The safety company goes to wartime. It just goes to a different kind of war.
Eight years ago, 3,100 Google employees said the company shouldn't be in the business of war. The company listened. Then the war came, and the company forgot. The employees wrote another letter. No one resigned. Forty million prompts flowed through GenAI.mil. The agents got their deployment. And somewhere in a new DC office, thirty researchers are writing about what happens next.
The question isn't whether they'll be right. The question is whether anyone with a contract will read it.
Sources: The Verge, Bloomberg, Foreign Affairs, Politico, Meta Oversight Board, The Verge/YouTube
Source: The Verge, Bloomberg, Foreign Affairs