EMERGENCY POD: Iran + Anthropic

+ essay contest deadline extended

To discuss America’s brand new war — plus Hegseth vs Anthropic — we are joined by Emmy Prabasco from CSET, Henry Farrell of Johns Hopkins, Penn professor Mike Horowitz, and Bryan Clark from the Hudson Institute.

Our conversation covers…

• The role of “precise mass” on both the US and Iranian sides,

• Why the IRGC can keep fighting despite leadership decapitations, and whether US operations will lead to protracted conflict,

• What China is learning by watching the US military in action,

• How Anthropic’s red lines would fit into the culture of the Pentagon,

• How China benefits from Anthropic’s blacklisting.

Listen now on your favorite podcast app.

---

We’re holding the $3000 ChinaTalk economic security essay contest open until midnight EST on March 8th. And if you want to write for ChinaTalk about other stuff, read this!

Also, good job alert: ‘Part-Time Analyst Role at a Stealth-Mode China Tech OSINT Startup’—the founder I respect tremendously. Apply here.

---

A Theory of Victory (?)

Jordan Schneider: Mike, let’s start with you. This is our first major American precise mass campaign, right?

Mike Horowitz: I don’t know if I’d call it a precise mass campaign. What’s notable is that the United States used a system called the LUCAS, which is America’s first precise mass system. It costs less than $100,000 and can travel a couple thousand kilometers. You can shoot it down, but you have to try.

Ironically, it’s reverse engineered from Iran’s Shahed 136 — effectively using Iran’s own technology against them. Though Iran itself copied some West German tech from the ’80s to design the Shahed, so what goes around comes around.

From a military technology perspective, it’s interesting to see the mix in the Iran operation. We’re seeing American legacy strike capabilities like Tomahawk missiles alongside emerging capabilities like the LUCAS. Claude is even in the mix — who would’ve thought after Friday’s events that Claude would enter the chat so early?

Jordan Schneider: Let’s start at the strategic level. I was discussing with someone how Pape’s “Bombing to Win” captures much of the 20th century story — bombing people doesn’t always get you what you want. But the difference between bombing in 2026 versus 1943, or most of the 20th century, is that now you can actually kill all the people who run the country.

I asked Claude for historical comparisons of killing leaders without invading. It gave me examples like Jugurtha of Numidia and the Byzantines overthrowing boyars. This is relatively rare in human history — pulling off an assassination from hundreds or thousands of miles away without having someone inside the country ready to take over.

Where are we on air power now? We’re four days in, so obviously TBD, but I’m curious about everyone’s takes on the theory of victory here.

Bryan Clark: You need somebody to pick up the pieces and run with them afterwards. Any competent autocrat in the 21st century will eliminate potential competition. It’s not like when the British faced the American Revolution — we had people who could take charge, and they didn’t bother assassinating them in advance.

Air power can be very effective at eliminating leadership, but you need civil society that can pick up the pieces, or you need to be willing to put that in place with people on the ground. That still seems to be the missing element.

Mike Horowitz: Pape’s original argument was more nuanced. He argued that coercive bombing — when you precisely hit targets — can generate concessions from the target. The issue is that punishment bombing — hitting random targets in a country — generally creates a rally-around-the-flag effect and makes it difficult to extract significant concessions.

What’s different today is the scale and velocity of precision strikes. Reports indicate Israel launched more than 500 attacks on the first day — frankly, the United States has never conducted that many strikes in a single day, despite our weapons stockpile. This illustrates how the world is changing.

However, if you want to argue nothing has changed, the Israelis once again demonstrated exquisite intelligence on every regional actor except Hamas. They knew exactly where leadership meetings were happening, enabling them to execute decapitation strikes on day one.

Bryan Clark: Air power can achieve these results when there are no air defenses to contend with. In Ukraine, air power isn’t cutting it because air defenses prevent unimpeded airspace operations. Iran’s air defenses are largely neutralized, allowing Israel to fly around launching JDAMs at targets. They don’t need standoff weapons — they can operate at volume and execute an effective coercive campaign, taking out infrastructure that would be difficult to hit with precision standoff weapons.

Mike Horowitz: It’s unbelievable. We’ve never seen the United States attempt a military operation of this scale with such incoherent goals. Sometimes it sounds like regime change; sometimes it’s about “eliminating the threat” — whatever that means.

Ironically, the Trump administration has broken Colin Powell’s Pottery Barn rule — “If you break it, you buy it.” That’s not how this administration sees the world. They’re willing to take actions no previous American administration would consider because they don’t feel responsible for governing the places they bomb.

Henry Farrell: Is it a good idea? That makes sense, but the question is whether it’s a good idea in the long run. Mike, you know better than I — you’re a real national security person, I’m not. But there are countless arguments, articles, and books discussing how this kind of intervention doesn’t necessarily end well over the longer term.

Do you think this will have benefits? Or will this be a disaster — not quite like Iraq, but something similar where we see continuing problems for years, perhaps longer? What’s the long-term strategy beyond just going in and reducing everything with air power?

Mike Horowitz: I’m not sure the Trump administration has a strategy beyond 2028. It would be a real bad look for our political science business if the Trump administration could do Venezuela, then Cuba — which is obviously next — with no backlash and no negative secondary effects.

Everything we’d expect theoretically suggests instability is likely to occur in these places. You have power vacuums, which increase the risk of terrorism and militia-like groups lashing out. This would be very dangerous.

It’s possible we don’t see that in the short term but do see it in the long run. But the effects might look disconnected enough from the initial operation that the Trump administration doesn’t care as much. You’re absolutely right — I just think they’re unconcerned with instability per se or increased risk of terrorist attacks.

Emmy Probasco: Should we also give airtime to the argument for why now? I concur with everything you’re saying — we’ve opened Pandora’s box. But there’s another perspective that’s at least worth discussing.

Bryan Clark: The argument would be that Iran’s on its back foot. There’s an opportunity to eliminate it as a military threat. If you’re Israel, this is a terrific opportunity to eliminate Iran’s ability to threaten you with missiles or even a nuclear program down the road. You may not care that much if it becomes a mess — maybe not a failed state, but not a well-governed state either.

But if you’re Qatar or the UAE, you may not appreciate that. Now you’ve got to deal with this unstable neighbor that’s probably interfering with shipping. If you’re Qatar, you depend on LNG exports for a massive portion of your economy. You can’t have the Strait of Hormuz closed off periodically like the Red Sea, or you’ll start losing economic livelihood.

For the Gulf states, this is not great. I’m surprised they didn’t push back more on the effort to mount this operation. But they’re going to be the ones that inherit it, probably not Israel.

Emmy Probasco: Not to say that Iran didn’t have problems to begin with — I don’t really understand where this goes either, to Henry’s core question of what our goal is here. We shouldn’t gloss over that Iran didn’t necessarily have a great government to begin with.

Mike Horowitz: That’s right.

Jordan Schneider: My question is, if you want to do regime change, don’t you do this while the protesters are in the streets and not after 30,000 of the most eager people are dead? The timing seems problematic.

Mike Horowitz: Sure, but it takes time to line up a military operation and get all your assets in place. I’m curious what Emmy and Bryan think about this. At any given moment, you could launch a couple of Tomahawks or send a special forces unit. But if you want a sustained campaign, you need to array the forces. This is also why I’m not worried about a US. ground invasion of Iran — the forces just aren’t there right now. It would take months to align ground forces for an invasion.

There’s another element here. If Iran goes down and then Cuba goes down, think back to the end of the Cold War period and the rogue states we used to talk about. The Trump administration is going around trying to knock off everybody on the checklist, like the end of The Godfather. It’s like a reset. What happens if we get back to North Korea?

Bryan Clark: Taking care of the family business.

Henry Farrell: What does it do to nuclear proliferation?

Mike Horowitz: Everybody’s going to get nuclear weapons now. Are you kidding? The majority of the South Korean public already wanted nuclear weapons. Why would they stop now?

Bryan Clark: The old-school way of doing this back in the ’70s or ’80s would have been having the intelligence services establish another power center that would be able to take over when the regime goes down. The CIA did this routinely in South America and Central America.

It seems like in this case we used the intelligence services to find out where all the head guys were going to be and then take them out at once. But we didn’t do anything to establish an alternative that would rise up and take its place. We haven’t really thought that through, because there doesn’t seem to be any discussion about who we would prefer to take over from the current regime.

Jordan Schneider: Trump had a line where he said, “Oh yeah, I had some ideas of guys in mind and, oops, we just killed them.” Now we’re on dude number 50, who we might not even have a case file on. When we’re that far down in the minor leagues — the Deputy Minister of Agriculture — let’s come back to something Mike said earlier about the theory of if this works. If this ends up working out, what did we not understand about the world?

Mike Horowitz: I don’t think we failed to understand something about the world. This is really a question of how you process and assess risk.

The argument against going after Iran has always been that Iran possesses chemical weapons, long-range drones, various types of missiles, and numerous USVs. They could shut down the Strait of Hormuz. Setting aside any moral or ethical considerations about whether to fight them, there’s a parametric risk of escalation. Their air defenses might function better than expected, or they could unleash substantial terrorist attacks in Europe and shut down the strait for weeks.

In some ways, it might suggest that we assessed these risks at too high a probability. Alternatively, we may have accurately assessed the risks and simply got lucky — the dice roll of reality where we didn’t see those impacts. But it’s also possible, given how history unfolds over time, that we’ll end up seeing some of these impacts, just not immediately. Maybe it’ll happen tomorrow. I don’t know.

Henry Farrell: There’s that old Bismarck quote — “God loves fools, drunks, and the United States of America.”

Mike Horowitz: I used that quote in my US foreign policy class last week.

Jordan Schneider: The terrorism angle deserves more attention. We’ve had multiple failed assassination attempts by the Iranians, but they were using the B team. They tried to contract it out and ended up contracting to FBI agents who are now busy finding immigrants. That’s a real risk. I’m not eager to see how that plays out.

I had an operational question —

Mike Horowitz: Was it about how screwed we are in the Indo-Pacific?

Bryan Clark: We’ll get there. I promise.

Jordan Schneider: The fact that you can kill this many people and Iran is still firing missiles and conducting operations — should this be surprising? Impressive? What does that tell us?

Bryan Clark: They’ve been preparing for this scenario for decades. They have the infrastructure to support distributed missile launches. They still have a couple hundred ballistic missile launchers available and an untold number of Shahed drones they can deploy.

They’ve distributed their command and control, especially within the IRGC, which is trained to operate in a distributed manner. They don’t need contact with headquarters to execute operations.

Jordan Schneider: That’s the challenge, right? The Iraqi army surrendered when Trump sent a text message saying “surrender or be killed” — they weren’t literally all going to be killed. That’s different from tanks rolling in from Kuwait. I’m concerned about the implications.

Mike Horowitz: You should be worried.

Bryan Clark: There doesn’t seem to be an easy way for this to end cleanly. It seems inevitable that this will be protracted. The only question is protracted in what way? Does it result in continued closure of the Strait of Hormuz and economic impacts? Or does it result in continued ballistic missile attacks that eventually start taking out things we care about?

Jordan Schneider: Other operational stuff? You want to go to China, Taiwan, Mike?

Mike Horowitz: It’s striking that it’s day one of the conflict and you already have articles showing up in the Journal, the Times, and the Post saying the US might run out of weapons soon.

Far be it for me to not take this moment to describe again how bad it is when somebody fires a $50,000 shot at you and you fire a million-dollar thing back to destroy it, and how thus we should be firing the $50,000 shots. But that is not sustainable.

If Bryan is correct in his assessment of Iran’s ability to continue launching, or they could even reconstitute some of that launch capacity over a month-long period, then you’re really drawing down stockpiles. The US. isn’t just protecting the US. Navy or US. military bases. The US. is also playing a role protecting all the Gulf countries. Recall how upset they have been in the past when they have faced risk in this context.

There’s a lot of pressure on the US, and that means if this keeps going, the US will have to pull — in theory would need to pull — some stockpiles out of the Pacific and send them over to the Middle East to be able to continue intercepting Iranian attacks at the rate that they’re being intercepted. That’s risky.

Bryan Clark: The air defense interceptor inventory is the big problem. We’re burning through those at a pretty high rate. Even if you’re smart and don’t use them to shoot down the Shaheds — you use your guns or something else to take down the Shahed — you’re still using a lot of them to take out ballistic missiles.

Then the Shaheds are used on all the soft targets that are undefended because you can’t protect everything at the same level. These Gulf countries are now having to come up with a way to defend against Shaheds, which they didn’t have to before. They’ve got to defend their shopping malls and airports against long-range cheap drones.

Emmy Probasco: Not to mention all the naval assets that we shift over there that could have been doing other things.

Bryan Clark: Right. 100%. Great point.

Mike Horowitz: I wonder what information we’re now communicating to China about how our air defenses operate after seeing American air defenses have to operate at scale against Iran. Where are the soft spots conceptually that could inform — look, the Chinese pay super close attention to everything we do. This will be no exception.

Obviously the world has had a very close look at offensive US capabilities throughout the war on terrorism period. They’re certainly well-versed in those, which is one reason why they’ve been nervous about them — we don’t have enough of them, but they’re pretty good. But now they’re getting a really good look at US air defense having to operate at scale.

Bryan Clark: The flip side is that US air defenses, especially the sea-based stuff, has worked. The ground-based stuff has worked too. As a retired Navy guy, it was surprising to me that this stuff actually works when the time comes — you get shot at, you pull the trigger, and it actually defends like you thought it would.

Mike Horowitz: Our $2 million interceptors should work against the Shahed.

Bryan Clark: They worked against ballistic missiles too. What’s interesting is that this stuff works. Now it’s expensive and it’s overkill for a lot of these threats. What this has done is given these guys a lot of sets and reps to evaluate what’s the right defensive system to use against the Shahed. They’re not using SM-2s against Shaheds anymore. They’re using guns, other drones, jammers.

It goes both ways. You’ve given a bunch of telemetry to China that they could employ in their own tactics development. But we also got a bunch of feedback that allows us to refine our approach. Otherwise we would’ve been doing this against China and probably not doing it nearly as well.

Emmy Probasco: Bryan’s got a great point there. I’d also add the operational experience in the Red Sea where we’ve learned a lot. The number of times I heard about what was happening on the ships out there and thought, “Oh my God, you don’t do those maneuvers unless you think you’re about to die.”

It has taught folks a lot. The reps and sets have begun, and we see them extending now, but all of this is fantastic data for China.

Bryan Clark: But it also provides combat experience, right? You have the Chinese military with zero combat experience following the most recent purge, going up against US forces. Obviously, this isn’t against a peer competitor, but it’s better than nothing.

Jordan Schneider: I did note General Caine saying “joint” a thousand times. But it’s relevant, right? We really have a lot of players in this at the moment.

Bryan Clark: Well, it’s his job. He’s the Chairman of the Joint Chiefs. It’s branding. He’s not actually in charge of anything — he’s in charge of the staff, in reality. If you’re the chairman, you’ve got to highlight the joint nature of the operation so you can call out the logistics.

Jordan Schneider: And don’t forget about the family members. He’s giving everyone their kudos. All right, Mike gave us the transition earlier. Who do you think put the story out that Claude was being used in the Iran operation — Anthropic or the Department of Defense?

Emmy Probasco: Operation Epic Fury. I don’t think it takes much to figure out that CENTCOM is using Maven Smart System.

Mike Horowitz: They tell us every single time they can.

Emmy Probasco: Maven Smart Systems is at all the combatant commands. Claude is integrated into Maven Smart Systems. That’s not to say everything Maven does involves Claude. Maven does lots of things, some of which have absolutely nothing to do with AI — it’s purely just moving data around.

But CENTCOM’s probably the furthest ahead. They’re the most experienced warfighting COCOM and the most experienced with Maven Smart Systems. General Kurilla is sort of the OG here — he was at the 18th Airborne and really did incredible work there, then went to CENTCOM. To the reps and sets conversation we had earlier, they’ve been working very hard to get as smart as they possibly can and use it in the most responsible way.

I don’t know what exactly they’re doing. I’m very happy not to know exactly what they’re doing, but they are the most experienced COCOM in the use of MSS and therefore, presumably integration with Claude.

Mike Horowitz: Fair enough. This doesn’t necessarily need to be a deliberate leak. This could easily just be somebody asked someone at CENTCOM and they happened to say it. Frankly, that’s often more likely from my viewpoint than a deliberate stratagem to get the information out there. Plus one on everything Emmy said.

Bryan Clark: Maven Smart System — not to throw shade on it, God forbid — but it’s a little clunky to use. It’s like your typical web thing where you’ve got a lot of menus to navigate and multiple things to pull down to create a workflow. Having some kind of AI tool to help you do that is almost essential to run at an operationally relevant tempo.

These planning tools have so many parts you can pull together into a kill chain. If you want to do that at any sort of scale and tempo, you need something to help you do it.

Emmy Probasco: I mean, I would — sorry, just to push it even further, Bryan — it wasn’t exactly like our weapon systems on our ships were a joy to work with or easy to manipulate or even understand. This is a step change improvement.

One of the things that’s super interesting about Maven Smart System is that it’s got lots of bells and whistles. There’s so much you can do. It’s workflow software with a bunch of data streams that you can manipulate, which is awesome and super intimidating. You can’t just sit down and expect to manipulate this thing like you’re doing Gmail. It just takes a lot of work.

AI does help, but in my mind, the AI helps less with user interface than it does with processing the sheer volume of data. There’s so much data available that it’s extraordinarily difficult to make sense of it. I don’t even know that the cloud is making sense of all the data all the time, because the use cases there are questionable sometimes. But it’s really good at writing the daily report to the command center. There are some really boring things that happen every day in an operation, and AI can be helpful in supporting people who are going to do that anyway — helping the person, not necessarily replacing them.

Bryan Clark: It helps you build that workflow too.

Henry Farrell: Here’s my sense as somebody who has spent zero time in any part of the armed forces whatsoever. My fundamental working assumption with all of this is, AI is fundamentally, in its current form, a bureaucratic technology.

It allows bureaucracies — and if there’s one bureaucracy that is the biggest bureaucracy of all, it is the DOD — to do things more efficiently than traditional paper pushing. Summarizing information, translating between different languages different branches use, all of these really mundane but nonetheless crucially important tasks.

AI is a bureaucratic technology. So is war.

When we look at this big fight between Anthropic and Palantir, how much of this is really missing the point? There are real issues here. On the one hand, you can see ways in which these technologies can be used to automate certain aspects of operations, which are highly problematic. On the other hand, they can be used — and this is clearly part of the story — for domestic surveillance. If you have a bunch of disparate data about individuals from different social media services or dating services, you can pull stuff together in ways that make sense.

But this is not actually about whether we’re going to see Terminator happening in 5 or 10 years’ time. This is about much more mundane, much more ordinary, albeit crucial and sometimes pretty scary uses that the technology could be used for. I would love to get you guys’ sense on that because that’s my sense.

Emmy Probasco: I’m in violent agreement with you, Henry. Everything you’ve said is just right. There’s so much of this that’s mundane.

I’ll give you one of my favorite examples of where I’ve seen an unclassified demonstration of something that could be used on the classified side, which is foreign disclosure. There’s this super boring task that has to happen where we have all this classified intelligence and you might want to share it with a partner. They may not have — you may not want to give them the full story. You might want to tell them, “Hey, we have aircraft in a particular area,” but we might not want to tell them how many.

You can put together an LLM, an agentic workflow that takes the original intelligence, then runs it through all the different parameters from the different guidance documents that these guys get, and then come out with a sanitized version of the intelligence. Super boring, totally a bureaucratic task. This isn’t to say that necessarily it always gets it 100% right and you should never look at it, but the time task of doing it in the first place can be so much more efficient.

If we could really help people understand that nobody really wants a Terminator, or this warbot meme that’s going around on the internet —

Mike Horowitz: Even I don’t want a Terminator.

Emmy Probasco: None of us do. I keep trying to tell people, military officers fundamentally like control. To cede so much control is not really in their DNA or their training or their bureaucracy. But anyways, this is all violent agreement with you, Henry.

Mike Horowitz: I agree with everything Emmy said. I would add one distinction, which is I would distinguish between AI and LLMs in that — this is part of where the challenge has been frankly in the warbots conversation. The Pentagon has deployed autonomous weapon systems for like 40-some-odd years, essentially. If you use the Pentagon’s definition of autonomous weapon systems, that’s true.

If you use phrases like Anthropic’s “fully autonomous weapon system” — nobody should ever use that phrase. But whether fully autonomous weapon systems or whatever phrases the NGO community uses — and frankly, they’ve probably been using autonomous weapon systems for many more years because they’re wrapping in a lot of precision guided weapons and things like that. This has created a lot of challenges in the conversation.

Anthropic is certainly correct that the last thing you would do is take Claude trained on the slop of the internet and slap it in a weapon system and hope that it would hit the correct target. Anthropic is right. That’s not ready for prime time.

Which is why you would use instead a super bespoke algorithm trained on a very bespoke dataset that probably wasn’t LLM based, but would still be an autonomous weapon system or even an AI-driven weapon system. The things you would worry about, the risks, some of the control issues that Emmy smartly mentioned are very different in that context. But that nuance has just gotten lost here.

Emmy Probasco: There’s also the fact that no perfect weapon system exists. I certainly don’t know of one.

Mike Horowitz: Perfect weapon system.

Emmy Probasco: Bryan is right. No, I’m just — odd, Mike. But they’re all flawed. We learn to operate with flawed weapon systems, and we learn when to deploy them and how to deploy them.

While I really appreciate that we’re having this conversation and I’m glad people are interested in this topic — it deserves deep thought — I don’t think people entering this conversation recognize how many fail-safes the military builds into its processes and how serious these issues are. These are still human beings who go home at night and want to sleep with a clear conscience.

We have multiple layers: First, there’s the technology. Can we get the technology to the highest level of reliability and precision? That’s one part. Then there’s extensive training for operators. You don’t get to operate these systems without going through rigorous training and having someone higher up the chain of command say, “Yes, you are authorized to push that button or conduct that operation.”

On top of that, as Henry pointed out, we have this phenomenal bureaucracy that we’ve perfected over time, building in numerous checkpoints. You may turn it on only at specific times. You may point it only in certain directions. The rules of engagement, battle applications, battle orders — there are countless bureaucratic safeguards.

We implement extensive processes and procedures to minimize the risks of imperfect systems. This doesn’t mean we should rush forward with any of these tools, but rather that we must build comprehensive doctrine and operations training around them.

Bryan Clark: It’s important to distinguish between autonomous weapons and AI-enabled command and control and planning functions. These are very different in terms of capabilities, potential guardrails, and the degree to which we’re willing to delegate control to AI systems, whether LLMs or other AI-enabled systems.

In our wargaming, we find that teams eventually reach a point where they just press the “I believe” button — accepting whatever course of action the AI recommends because the situation becomes too complex. When you’re developing your MAVEN smart system kill chain and running out of time, you think, “Okay, what do you think I should do? That’s good. We’ll execute that kill chain.”

The autonomous weapon can have extensive guardrails, but if we’ve built a plan derived from some model and we’re just expecting it to work without killing innocent civilians, we’re not actually verifying that. This essentially negates any effort to make the autonomous weapon safer because our planning process itself isn’t safe.

Henry Farrell: Let me push a slightly different version of the Dario Amodei story. I don’t buy into Amodei’s vision of a nation of geniuses in an AI lab pouring out revolutionary technology in 5 or 10 years. However, I think his ideas touch on some real concerns.

My sense — and I believe Mike agrees — is that I have complete faith in much of the military ethos the United States has created. On the same day that Hegseth made his controversial statement, he also said he would eliminate opportunities for military personnel to pursue advanced degrees at various universities, claiming professors were incredibly hostile toward the military.

My experience, like Mike’s, is that officer corps members are among the most thoughtful and interesting students you can have. They bring a standard deviation more care, principle, and ideas than most people.

Mike Horowitz: They’re awesome in the classroom.

Henry Farrell: They’re wonderful in the classroom. That’s pretty much universally agreed upon.

However, if we’re in a military where Hegseth is essentially saying “we don’t want to worry about stupid rules of engagement,” that makes me nervous. When we’re in a world where, as Emmy points out, these technologies are fundamentally imperfect with tons of slop, you have to worry about how leadership differences might intersect with these systems in unfortunate ways.

I’m especially concerned about domestic information gathering. Much of this seems to involve access to domestic information. The US military can legally circumvent Executive Order 12333 restrictions by gathering information from commercial databases. I’m frankly nervous about how this might evolve 2, 3, 5, or 6 years down the line if it’s not pushed back against.

Mike Horowitz: I worry — I agree with you macro. I’ve been very vocal that the Pentagon has been adopting AI too slowly for a long time rather than too quickly. The risks have essentially always been that the US military would rest on its laurels and has been too slow about integrating emerging capabilities. This is partly because of all the policy, procedure, and process — most of which has nothing to do with AI at all.

The risk for the US is generally going too slowly rather than too quickly. Frankly, even in the Hegseth era — though I’m less comfortable making this argument at present — all that policy and procedure still exists in ways that make it fundamentally difficult. As Emmy suggested earlier, incentives are actually aligned to have systems that work because unreliable systems, by definition, don’t work. Commanders and operators won’t want to use them because they need things they can trust. If they can’t trust these systems, they won’t use them.

Both Emmy and I have done research on automation bias — this phenomenon of over-trusting AI. It’s like Bryan’s point about people just hitting the “I believe” button. If you trust algorithms more than you should given their accuracy, you solve that with training and standard operating procedures. It’s frankly good that in these war games people get confused and press the “I believe” button, because that shows you how to improve.

Here’s something to make you feel better: I have a draft paper I’m working on with Lauren Kahn and Laura Resnick Samotin that compares West Point cadets to a similar sample of the US general public (matched for age and education). The West Point cadets are substantially less susceptible to automation bias than the general public. The mechanism is essentially the training the military gives people — not just in AI, but in warfighting and decision-making in general. This actually can make people more cautious, which supports Bryan and Emmy’s point.

Emmy Probasco: I agree. I actually did a study with Lauren Kahn where we compared how the Army uses the Patriot missile battery to how the Navy uses the Aegis weapon system. These systems are very similar, but what’s interesting — and this goes to your point, Henry — is that if we’re going to accept imperfect weapons (which frankly we have no other choice), then you need the bureaucracy to address it.

In terms of bureaucracy with the Patriot, they staff the missile battery with slightly more junior personnel who have slightly less training. In the original unclassified training documents, it basically says: “Just turn the system on and don’t touch anything because this system is smarter than you.” You can read that in the guidance documents.

If you go to the Navy, it says: “This is your responsibility, and if you screw this up, it is entirely your fault.” I was trained under that system.

Mike Horowitz: This is so true.

Emmy Probasco: This is great, very seriously. Now, that said, both sides have committed terrible mistakes. The Vincennes incident and the Navy instance — they didn’t trust the system. The system was actually correct, but they said, “I don’t trust the system,” and then they accidentally hit the wrong thing. In the Patriot fratricide, they stayed hands-off because they said, “We don’t know what we’re doing.” There’s no perfect answer here — it’s a sad story, but there are bureaucratic choices that can be made.

If we’re eroding the bureaucracy, if we’re eroding test and evaluation or all the different things that have to come after you buy the weapon system, that’s problematic. Our operators don’t love — to Bryan’s point — if you drop MSS on an operator’s desk, they’re going to be like, “Okay, this is complicated.” But if you give them proper training and get them certified, they’ll become more facile and better at their job.

I don’t want to miss Henry’s intel point, which isn’t my area of expertise. I’ve learned enough to be very humble about how intelligence works. There is a worthwhile conversation to be had about what we expect in terms of available data. While we’re concerned about how it might be used domestically — and I’m certainly in that camp — the same data is being bought by China. It’s not like it’s not available.

This is more than just a problem of how we choose to govern the way our government uses data. It’s about how we choose to allow our data to be shared and how vulnerable we are now in ways we weren’t before. The data was there, but you couldn’t really use it until you had these new tools.

Bryan Clark: You’ve got companies like Vannevar Labs and others commercializing the harvesting of commercial data, using it on our enemies, and then giving it to the US government. The US government has benefited from this availability of open source intelligence and data, and we’ve been using AI tools to harvest it.

It’s a legitimate question: How much of that is going to be US information that’s leaked over into somebody else’s network, which we’re now harvesting for military intelligence gathering? It’s similar to FISA — the same challenge. If I’m going to spy on somebody else but they’re talking to somebody back in the US, I’m now essentially spying on somebody in the US. We have to ponder this. Back to Emmy’s point, the only way to really keep it in check is to avoid giving so much data to third parties that are going to be able to provide it to somebody else.

Claude and the Pentagon

Jordan Schneider: Can we come back to the fight on Friday that happened over the weekend? On the government’s autonomous weapons stance, what do you see as the strongest piece of that argument?

Mike Horowitz: To me, this is a dispute about personalities and politics — or frankly, a dispute about personality and politics masquerading as a dispute about policy. The OpenAI deal is the clearest evidence for that.

But there’s even more evidence. First, Anthropic was the first company to do classified work. Second, Anthropic was happy to fulfill every request the government made. Third, there were no upcoming government asks that Anthropic didn’t want to fulfill — at least not publicly.

This was essentially a theoretical fight about future potential use cases and who gets to decide. The government seems to think about AI tools the same way they think about missiles from Lockheed. Lockheed doesn’t get to tell them which countries they can target with LRASM. But Anthropic views this more as a service where each use of their technology would require Anthropic personnel to help build it out.

This creates challenges, but to me, this is really a breakdown in trust. The government doesn’t trust that Anthropic will be there for important national security needs. And Anthropic doesn’t trust that the government will be responsible — perhaps for some of the reasons we’ve been discussing. But this wasn’t a fundamental disagreement over any use case that was actually on the table. That’s my perspective, but I’m curious what others think.

Bryan Clark: I agree with Mike. They definitely weren’t arguing over what was actually being discussed. Nobody was saying the government would pursue use cases that Anthropic opposed. It seemed much more about “you’re changing our terms of service.” They didn’t like the open-ended nature of the new terms, which essentially meant no terms of service. They wanted to retain the ability to put a brake on any future use case they disagreed with.

My question for Emmy and Mike is: When the government uses Claude on classified networks, is it hitting Anthropic’s server farm somewhere, acting as a service? Or are they using Claude under some kind of OTA product model?

Emmy Probasco: That’s a good question. I don’t actually know how they’re using it. My presumption is that it’s somehow hitting NGA’s compute.

Bryan Clark: But it seems like Anthropic people must still be involved in the use of Claude on a day-to-day basis. Otherwise, this would be like an LRASM situation where you gave them a version of Claude and now it’s out of your hands. The government might use it for whatever.

Emmy Probasco: I actually don’t know. To back up a little, we’ve been trying for a really long time to make strong bonds back to the commercial tech sector. They are so important to our operations. That’s where the R&D money is.

Mike Horowitz: This has been a rough week for goals that Emmy and I have had for a while.

Emmy Probasco: Right. On the level of government working with commercial tech, this was a pretty sad week. Hope springs eternal, though. I would like us to get back to it because I’d love to have a conversation with folks in the Valley and elsewhere who are doing commercial tech but thinking about defense. Now they’re wondering — we just took a step back, and that’s really unfortunate.

In terms of the terms of service, as Mike and I were discussing, if you put “autonomous weapons” in a contract, please define “autonomous weapon.” I’ll wait. It’s so hard. I can understand why there’s friction there. At the same time, there are laws around autonomous weapons, but the law is just: did you notify the government that you changed the policy? That’s the law. There could be space to do something meaningful there.

Jordan Schneider: Mike, how do you feel about your directive getting a new moment in the sun?

Mike Horowitz: For listeners who don’t know, the office that I was privileged to run in the Pentagon rewrote the Pentagon’s policy on autonomy and weapons systems in 2023. We were accused at the time of two things: one, by the NGO community, of providing a pathway for the development of autonomous weapons systems; and second, by some, of overregulating autonomous weapons systems — which made us feel like maybe we got the balance right at that point.

Part of the issue is that Defense Department directives are not meant to see the sunlight. They’re written in a super insider-y way for the largest bureaucracy in the world. The Pentagon has never been good about publicly explaining what directives generally mean. We were allowed to do one or two media things when the revision to the directive came out, and then it was back to the normal posture of “the less said, the better.” Not because anybody was specifically opposed to it — that’s just how the system generally operates. Nobody was trying to stifle information or something.

But it means that it shouldn’t take a PhD in autonomy and weapon systems to understand American policy. Just reading the directive and trying to interpret it yourself is sadly not that informative. Or it’s informative, but you could be informed the wrong way.

This says to me that we need either a new policy or some real robust public documentation on what the policy actually means. Either one of those would be reassuring if people understood what it actually said. It’s weird to see your handiwork out in public like that with everybody saying things that aren’t true about it.

Henry Farrell: Like everybody. I wonder how much of this is just a fundamental culture clash between Anthropic and DOD.

The best piece I’ve read about Anthropic and Claude is Gideon Lewis-Kraus’s piece in *The New Yorker* a few weeks back, which really gives you the sense of what it is to be in an organization where Claude actually seems to have a personality, where people are interacting with Claude every day, and where they see their job as being loosely analogous to bringing up a new intelligence.

That may seem extremely wrongheaded, but it feels a little bit like Orson Scott Card’s Ender’s Game. If you take an 11-year-old kid, bring them away and teach them to kill people and manipulate — this is not necessarily something that most parents are going to go along with super happily.

I do wonder — I also think that this is wrongheaded. Equally, I do hope that Amodei is right along the lines that Emmy suggested when he said maybe this will provoke people to start actually thinking about some of the questions of rights, some of the questions of information exchange, and what the problems are that we have created in the society that we live in.

Emmy Probasco: Ender’s Game is a fabulous leadership book, and I believe it’s on the Navy’s required reading list for leadership.

Mike Horowitz: Strongly agree with that part.

Jordan Schneider: Well, maybe we should spend a little bit of time on the political economy piece of maybe not actually doing, but threatening to put Anthropic at the same level as Huawei. Henry, do you want to start with that?

Henry Farrell: Absolutely. This was a remarkably stupid thing for the Department of Defense to do. It was also really interesting for me to see Dean Ball, who is the person who’s more responsible than anybody else for drafting the current US general approach to AI, coming out and pretty directly denouncing the administration and saying that this is evidence of how America is going to hell in a handbasket.

Mike Horowitz: It was really strong. He got really aggressive on it.

Clawed

Henry Farrell: It’s a really interesting document to read. More or less, he ends up saying — and here I’m paraphrasing — that we need to see more civic activity happening around this stuff because the guiding impetus to a better society won’t come from the government that we have.

This really is an important thing from the point of view of governance. My sense is — and I’m not a standard national security person; when people are talking about different weapon systems, I have no more idea than the next person who reads the newspapers — but if you think about this in terms of economic security and economic coercion, this is the first time that I know of where the United States has really gone all the way to suggest that the tools it uses for coercing other countries and businesses in other countries and designating businesses in other countries is going to be applied to a US. business. As far as we can tell, this is simply for refusing to sign up to changed contract terms.

Like Mike was saying about Iran earlier, it could be that the repercussions of this take some time to really begin to unfurl. But it’s going to have two consequences.

First, it’s going to mean that a lot of businesses in Silicon Valley, once they talk to their legal teams and start thinking through what the odds are and what the potential risks they run might be, are going to be much less willing to get in bed with the US. defense establishment. The risk-to-reward ratio, which used to look pretty great on a lot of fronts, is now perhaps tuned more substantially towards risk than towards reward.

Second, if the DOD wins this fight, it’s going to result in a lot of allies and third countries looking at US. tech companies in much the same way that we look at Chinese tech companies. I remember James Palmer had this fantastic phrase where he said it’s like one of those 1950s science fiction movies where a tech company appears to be independent until suddenly the body snatcher comes in and suddenly it does all sorts of things that suggest it’s acting at the behest of the Chinese state. The same fears are going to begin to bubble up around US. tech companies if they don’t succeed in pushing back and creating a clear zone for autonomy.

In a certain sense, this is returning to some of the fears and worries that happened in the tech sector around the Snowden revelations, when it became clear that there had been a lot more backdoor stuff happening in terms of active cooperation or grudging assent than anybody had known. But this could be substantially worse.

On the one hand, you have the US. effectively trying to push AI development and push the integration of AI into the Department of Defense. On the other hand, you have the US. wanting the rest of the world to use American AI. It seems to me that by emphasizing the first and pushing it to a pretty ridiculous degree, the US. has really hurt itself on the second.

Mike Horowitz: I agree with all of that. If you were a company thinking about doing tech work with the Pentagon right now, and there’s some non-zero chance that if you do a little work with the Pentagon and then decide not to, you might get slapped with a supply chain risk designation that puts you in the same class as Huawei — what does that do to your incentive structure?

This affects a workforce that maybe wasn’t the most comfortable working with the Pentagon to begin with and has gotten there over the last several years. Points that both Henry and Emmy have made at various points in this conversation. Jordan, you’ve heard me say this before — the way their tech proved useful in the context of Ukraine’s defense against the Russian invasion was actually really good for the tech sector’s willingness to work with the Pentagon. They saw that their tools could be used for good to help defend a country against being invaded. But that halo has really fallen off at this point.

This creates real tension here. There’s not a great argument for why the Pentagon wouldn’t just cancel the contract and find another vendor. Given that both xAI and OpenAI now have deals with the Pentagon to do work in classified settings, it certainly contradicts the need for a Defense Production Act designation. It also implies that the supply chain issues might not be exactly the way the department is talking about them. Who knows? Lawyers will get involved now and there’ll be filings and they’ll say things.

Bryan Clark: Mike, are you saying it’s inconsistent to say your stuff is a supply chain risk, but if you don’t let us use it, we’re going to use the DPA to force you to give it to us? “We want the supply chain risk so bad that we’re going to use the DPA to force you to give it to us.”

Mike Horowitz: But I mean, I’m sorry — Emmy Probasco: No, no, no. I guess this is more of a question than a statement, but how long is this going to take, or how long will it take to affect what we’re seeing right now? There are so many companies in the defense tech space now, and not just in the United States. There’s enthusiasm now around the European market. There’s lots of activity.

Companies that are in it for defense — the new startups that are really excited to be in the defense space — will try to stay in the defense space. It’s the companies in the middle that we might start to lose. The ones thinking, “We’ve got some pretty strong commercial applications. We think we can make a lot commercially. We’ve got engineers who might be more excited about the commercial applications.”

Even then, Anthropic’s still pretty enthusiastic about the national security mission. They just have a problem with a couple of individual points. I don’t know exactly how this is going to rejigger the relationship, but I don’t think it’ll be straightforward.

Jordan Schneider: Well, I don’t know if we can say a couple individual points when you have the president tweeting out that you guys are a terrible company.

Mike Horowitz: Right, it does matter. You can be right about the structural incentives still being there. Anthropic would like to work with the national security community. These companies are really competitive with each other, and Anthropic is like, “Our tools are the best. Of course the military should be using them.” But the vibes are not good right now.

Bryan Clark: Do you think Anthropic uses their relationship with DOD as a sign of how good their stuff is, and then they go to their commercial customers to say, “Our stuff is so good that DOD is using it preferentially”? Does it lend some cachet to them?

Jordan Schneider: I would imagine it runs the other way, if anything.

Look, this is not like a cute machine tools company that makes some stuff for Ford and maybe gets a $10 million contract with some weird corner of the Air Force industrial base. They have so much money to be made. They are growing at 10x a year, and I can assure you that the percentage of that exponential growth which comes from random government contracts is not a relevant number to the future of the company and the future of the valuation.

My assumption is that this was a little bit of patriotism, a little bit of Dario wanting to shape the future of the world, and a little bit of “maybe if we do a good job at this, they won’t screw us on X, Y, and Z other regulatory things.” Curious if you buy that, Emmy?

Emmy Probasco: I don’t know that I can comment on that, but regarding something else that Bryan said — a lot of the companies interested in working with the Department of Defense, when I’ve spoken with them, part of the interest is that the problems are really hard.

If you can prove yourself, it’s not that “if I can prove myself in the defense world, then people want to buy my stuff.” I don’t think that’s true. But if I can improve my tools, if I can improve what I learn on the world’s hardest problems, then I can translate the ability to do really exquisite things into other potential avenues. That’s a more compelling argument.

From what I’ve heard — I’ve never met the CEO of Anthropic, so I don’t know him — but everything we’ve heard from him and from other individuals in the institution is that they’re pretty pro-national security.

Each of these companies has different cultures and ways of talking. They have self-selection where people select into them. It’s significant that when all this started to happen, there was a tech sector website that popped up with signatures from OpenAI and from Google, but inside of Anthropic, it was actually pretty quiet.

Lots of people tried to compare this to the Maven Google movement, and that didn’t really hold. I know we wanted to do that, but in this instance, I don’t think it held. There might have been genuine interest and a genuine concern. I’m willing to accept that as one of the potential reasons this is happening.

Henry Farrell: The notion comes from a fundamental belief that we’re in a battle between democracy and authoritarianism, and we must do everything possible to ensure democracy wins.

On one hand, we see the Trump administration pulling back from hawkishness toward China. This has clearly caused unhappiness and prompted public statements — if I remember correctly — from Amodei about how we shouldn’t be selling chips.

The current administration’s actions in Minneapolis and other places do raise concerns. Amodei’s most recent piece contains implicit commentary about ensuring that existing democracies don’t deteriorate.

There’s been clear enthusiasm at Anthropic to embrace national security in a way that wasn’t true of many other AI companies. Looking at OpenAI, however, it’s much more of a commercial, self-interest story — but it represents a particular understanding of national security that’s somewhat out of favor with the Trump administration.

Getting back to what Mike said at the beginning, my feeling is that this is indeed a pissing competition. Much of this is about not simply egos, but who should be in charge of the world.

There’s a clear sense from many in the AI community that they are the people effectively figuring out the future state of the world. The decisions they make will have consequences for decades. When this runs up against other people who think they’re in charge, it becomes very difficult to find a way through.

Emmy Probasco: For better or worse, my suspicion is that this souring will be very difficult to overcome. The people who suffer are those currently trying to execute operations as ordered by the president — they’re the ones not getting the tools they need. I respect that everyone has their own opinions and we can have disagreements, but let’s not forget who gets affected most.

Mike Horowitz: The winner in the Anthropic versus Pentagon feud is China. If the US national security establishment ends up being deprived of the talent and technology of one of the world’s great and cutting-edge firms, that’s a loss for America.

Without making this political, we haven’t discussed the White House’s views on this matter. Anthropic, uniquely among major tech companies, has been willing to challenge the White House, particularly regarding AI export controls. All AI companies broadly share Anthropic’s view, which differs from NVIDIA’s perspective. NVIDIA sees China as a huge market with customers — they want to sell more chips. The AI companies, however, question why we’re selling these great chips to our competitors. “That doesn’t actually help us,” they argue.

Anthropic has been the most vocal about this issue. David Sacks, who runs AI policy for the White House, has reportedly characterized Anthropic as the “woke doomers” of the current crop of AI companies. While that’s not entirely fair, the point isn’t about who’s right or wrong. The context is that Anthropic was arguably already on the outs with the White House. One interpretation is that they’re being saved by how good their technology is. There’s more at play here than just the Pentagon.

Jordan Schneider: Anyone want to talk about Congress? These seem like issues that deserve legislation, not just directives.

Mike Horowitz: It depends on what you think the concerns are. Emmy did an excellent job earlier laying out all the different kinds of regulations on the use of force. In theory, there’s an entire system backed by federal law and treaties that the US is still part of, governing how force is used. These are designed to ensure, for example, that there’s always human responsibility for the use of force.

Even in a world where the Pentagon didn’t have a policy on autonomous weapon systems, the outcomes shouldn’t be very different because the testing and evaluation system should be functioning. The standards for approving something in the field would remain the same. All AI-specific policies in the Pentagon are really doing is explaining how to comply with broader requirements that exist for everything — whether it’s a bow and arrow, a machine gun, an autonomous weapon system, or an AI decision support tool.

Congress could decide it wants to legislate over this.

Jordan Schneider: It feels more like the war power issues. If we’re sitting here in 2026 talking about “all lawful uses,” when that includes double-tapping on fishers or drug runners — and no inspector general is ever going to investigate that — then that seems like the most straightforward concern. The domestic surveillance aspect — how much we want to superpower the US government — is another issue. We won’t just be worried about querying LinkedIn posts in the coming years.

Henry Farrell: Maybe one way to think about this: as Emmy said earlier and Mike mentioned more recently, many standard considerations regarding AI and national security are really boring, specific things about particular systems — how to use them, what kinds of rules apply, and so on. Congress isn’t currently set up for that debate.

I was really struck by Jasmine Sun’s piece from a couple weeks ago in her newsletter, where she describes visiting various members of Congress. There’s clearly discussion happening between some conservatives in Congress and the “woke AI” people that Sachs denounces. There’s a lot of shared concern about AI’s social consequences.

🌻 my week with the AI populists

She quoted one staffer who essentially said, “The reason we’re not working with these guys is it’s really hard for us to collaborate with people who are in polyamorous relationships in San Francisco.” You can understand that from a social perspective. But it was also clear that many people were chomping at the bit, thinking this is an opportunity to create a real populist movement against AI.

We’re going to see a big debate on AI in Congress. It’s going to be a weird debate with strange bedfellows. I don’t think it will be the technocratic debate that either the Pentagon or some people in Silicon Valley might expect.

Jordan Schneider: Any other concluding thoughts?

Emmy Probasco: We didn’t talk about China. Isn’t this called ChinaTalk?

Mike Horowitz: I mentioned China a couple times. Look, who’s laughing at us right now? The Chinese. Who benefits from all of this — arguably both the Iran conflict and the Anthropic flight? The Chinese. This is great for them.

Jordan Schneider: You don’t think this is 4D chess? We’re taking the Axis of Evil down. You said it yourself, Mike.

Mike Horowitz: Come on. Sure, that’s right. We’re going to take down the old Axis of Evil and then pivot to Asia.

Bryan Clark: Some of the Iran hawks I deal with over at Hudson are saying this is a way to poke back at China because it takes away their access to oil via the railway they were building with the Iranians. This also removes some of their access to the Gulf. But in the end, this is much more beneficial for China than for the US. There’s not really going to be a lot of upside for us, especially as this thing protracts.

Jordan Schneider: I love how some administration official gave a quote to some outlet saying, “Oh yeah, we’re just in our hide-and-bide phase” like two weeks ago.

Bryan Clark: They just think on very short terms. They’re done with the hide and bide now.

Jordan Schneider: The tech crackdown parallel that I see a few folks making — of Xi getting upset at an uppity Jack Ma for not going along with the program in the way he hoped, having too high a profile, and then blowing up Ant Financial and leaving him to hide under a rock for the next five years and hang out in the plaza in Manhattan where I ran into him on the street in 2023 — is apt but also not apt. Because if they really do the supply chain thing, Anthropic’s going to sue and they’re going to win.

From a rhetorical perspective, doing this is really jarring. But there is a difference in the powers that Pete Hegseth or David Sacks or even Donald Trump has, as opposed to someone like Xi when they try to do a tech sector crackdown. It’s clearly pretty terrible atmospherics, which we talked about for the past 80 minutes or so. But I do think it’s a difference in degree between just “oh, let’s pick a fight with this guy because he’s a shit lib,” as opposed to “oh, we’re going to throw him away and run his company out of business,” which I don’t necessarily think is the glide path that the president could take us on, even if that’s really what they decided to do.

Emmy Probasco: I was actually making a slightly different point, which is, while we’re having this argument, China continues to work hard at work. Sam Bresnick, Cole McFaul, and I just finished a piece that looked at all the different experimentation they’re doing, not just with large language models, but all sorts of different applications of AI. It’s pretty comprehensive. They really didn’t miss anything and they’re talking about it pretty openly. It’s frustrating to see all of this happening and think that we are in a competition here and we’re having what seems like an argument that got out of hand as opposed to making real progress.