The NSA Got Its Anthropic Exception. The Pentagon Did Not.
The Trump administration blacklisted Anthropic as a national security risk in March. Five weeks later, it quietly granted the National Security Agency an exception to keep using the company's most advanced AI model.
The carve-out, authorized by White House Chief of Staff Susie Wiles and reported by the New York Times on May 22, tells the real story behind the Pentagon's blacklist: the US government spent months publicly pressuring Anthropic to accept broad military-use terms, then discovered it could not actually operate without the model it was trying to discipline. The exception is an admission that compute dependency outweighs procurement leverage.
The context explains the bind. Earlier this year, the Defense Department demanded Anthropic accept contract language allowing the AI model to be used for "any lawful purpose" — language that would have covered mass domestic surveillance and autonomous weapons, uses Anthropic's CEO Dario Amodei has called illegitimate and prone to abuse. The new contract does not include that language, according to the Times. The carve-out instead includes a specific restriction: the model cannot be used on Americans' data. What the government demanded and what it got are two different things.
Anthropic filed suit in federal court in California on March 9, four days after the blacklist, arguing the designation violated its First and Fifth Amendment rights. A federal appeals court declined to block the blacklist in April, leaving it in force while litigation continues. The company had already secured a separate foothold: in July 2025, the Defense Department awarded Anthropic a $200 million contract through its Chief Digital and Artificial Intelligence Office, making Claude the first frontier AI cleared for classified military use, according to the Syracuse Law Review. Claude was subsequently deployed in Operation Absolute Resolve earlier this year to assist in capturing Nicolas Maduro.
What makes Anthropic impossible to replace is documented in technical terms. The company's Mythos model scored 73 percent on expert-level capture-the-flag tasks — the first AI system to reach that level, according to the Cloud Security Alliance, which published an independent research note on frontier AI governance. The UK AI Safety Institute ran its own evaluation and confirmed the same results. Mythos also became the first AI to execute a 32-step corporate network attack simulation end-to-end, succeeding in 3 of 10 attempts. These are exactly the capabilities intelligence agencies need — and exactly the ones the government tried to threaten Anthropic out of controlling.
The government's response to its own dependency is to buy more hardware. The White House approved a secret $9 billion request for spy agencies to acquire cutting-edge AI chips, specifically the Nvidia Grace Blackwell superchip, which requires data centers with enormous electrical energy and specialized liquid cooling systems. An additional $800 million is being reprogrammed for faster computing capacity acquisition. Amazon Web Services, which handles classified AI workloads for the CIA, NSA, and other agencies, announced a separate $50 billion effort to upgrade government cloud services last year. But Anthropic's newer model runs most efficiently on the new chips — and can also run on previous-generation hardware. The government is trying to build an exit ramp that does not yet exist at the required scale.
"What we need is the frontier — the best AI chips, models, systems, talent — on a timeline that matches the threat," Vinh Nguyen, a senior intelligence official, told the Times.
The blacklist may have been procurement theater all along. The goal was to force Anthropic into blanket military-use terms. The outcome was a carve-out, a lawsuit, and a $9 billion commitment to buy hardware the US does not yet have the infrastructure to operate independently, per reporting in the Syracuse Law Review. OMB is separately negotiating a civilian agency deployment framework for Mythos under requirements covering data sovereignty, model integrity, and human-in-the-loop oversight. Project Glasswing, a controlled deployment to twelve named partners including Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, is already underway. The question the carve-out raises is whether the blacklist was ever a real policy or just leverage in a negotiation the government lost.
What to watch next: the federal litigation in California, where Anthropic's constitutional challenge to the blacklist will be decided. The outcome will set precedent for whether the government can use procurement designation as a tool to force frontier AI labs into accepting uses their executives have publicly refused. If the blacklist holds, the NSA carve-out is the shape of what comes next: exceptions carved out of a policy that cannot survive contact with operational reality.