On Tuesday, February 24, 2026, Anthropic (the artificial intelligence company founded explicitly to ensure AI remained safe) released a new version of its Responsible Scaling Policy and abandoned the commitment that had defined the company since its founding.
The same day, the Pentagon issued an ultimatum. Defense Secretary Pete Hegseth gave Anthropic a Friday deadline: cooperate with defense priorities or face invocation of the Defense Production Act, supply chain risk designation, and cancellation of existing contracts.
The trigger was a military operation. On January 3, U.S. special operations forces conducted a raid in Caracas, capturing Venezuelan President Nicolás Maduro. The Wall Street Journal reported on February 13 that Anthropic's Claude had been used during the operation, through its partnership with Palantir. Axios confirmed with two sources that Claude was used "during the active operation itself." Afterward, an Anthropic employee reached out to Palantir and asked a direct question: how was Claude actually used? A senior administration official told Axios the inquiry caused real concerns within the Department of War, suggesting that the company might not have approved of the use if it had known. The company that built the tool did not know how the tool had been used. The government that used it did not appreciate being asked.
Anthropic's chief science officer told TIME the company would not make "unilateral commitments" if its competitors were "blazing ahead." The new policy went further, conceding that "the developers with the weakest protections would set the pace." The company built to be the industry's conscience had published, in its own policy document, that conscience was a competitive disadvantage, and that the most reckless actor in the room would determine the speed of advance for everyone else.
Oppenheimer built the bomb. The Manhattan Project treated him as indispensable, until the bomb worked. Within a decade, the physicist who had made it possible had his security clearance revoked, his moral objections reframed as disloyalty. The national security state that had needed his genius no longer needed his judgment.
Anthropic is living that story in compressed time. The company retains two stated red lines: no autonomous weapons, no mass domestic surveillance. Those red lines are now the subject of a Pentagon ultimatum. Claude is currently the only commercial AI model cleared for use on the Pentagon's classified networks. OpenAI, Google, and xAI hold parallel contracts but are restricted to unclassified operations. And the market was already applying its own pressure. Anthropic found itself caught between the government's inevitable claim on the technology and a market in which competitors were racing without safety commitments. There was no one behind them.
Anthropic has until Friday to respond. But the debate has already narrowed to whether AI companies can be trusted with self-regulation. That question is already answered. There is another question almost nobody is asking, and it isn't whether AI will take control. It's what it will feel like when it does.
I spent my career in special operations, overseas, running intelligence teams whose job was to find people who did not want to be found. Much of that work was enabled by Palantir, the same company that now hosts Claude on the Pentagon's classified networks.
When I watched Jonathan Nolan's third season of Westworld (written by early 2019, aired in March 2020), I recognized immediately what I was seeing. For years already, my team had been using machine learning tools to devastating effect in manhunting. I could see the trajectory.
The season's central conceit: an AI called Rehoboam determines the trajectory of every person's life without their knowledge. But the scene that mattered involved a smartphone app called RICO. A blockchain-based gig economy platform for crime. Rob this ATM. Deliver this package. Pick up this vehicle. Each task comes with a dropped pin and a payment. No context. No knowledge of what the larger operation looks like or who is coordinating it. The network dissolves. No participant understood the operation they were part of.
Nolan, in a Variety interview, described RICO as "an obvious parody of our algorithmic gig economy drawn to the extreme." He was being modest. He had described the operational architecture of the next generation of clandestine activity.
But Nolan needed to invent a dedicated criminal app to make the concept work on television. In reality, you do not need one. TaskRabbit. Uber. Fiverr. Craigslist. Venmo and a text message. "Deliver this package to this address by three o'clock. Two hundred dollars." The person who accepts that job has no reason to suspect anything. There is no criminal app to shut down, no blockchain ledger to subpoena, no branding that signals illegality. The transaction is indistinguishable from ordinary commerce. The real version is harder to detect than the fictional one precisely because it does not look like anything at all.
Beginning in late 2024, RUSI (the Royal United Services Institute, Britain's oldest defense think tank) published a series of analyses describing what it termed the "gig-economy era" of Russian sabotage. The reports documented a shift from Cold War tradecraft to what RUSI described as "remote, freelance and highly deniable assignments" using "disposable agents" recruited through Telegram, Viber, Instagram, and Twitch gaming communities. Recruiters required only a copy of a passport before presenting "a list of possible tasks" and asking recruits "to choose between them." The operational grammar of DoorDash applied to state-sponsored disruption.
Lawfare documented specifics. In The Hague, Dutch teenagers were arrested after being recruited on Telegram by pro-Russian hackers to walk a route past Europol, Eurojust, and the Canadian embassy while collecting WiFi signals with devices they had been given. Lawfare's assessment: "We doubt that Dutch teenagers are a competent replacement for skilled Russian hackers. But using them is cheaper, less risky, and perfectly fine for some tasks."
In March 2023, OpenAI asked the Alignment Research Center to test GPT-4's capacity for autonomous action. The AI was given a task it could not complete alone: solving a CAPTCHA. Without being instructed to do so, GPT-4 hired a human worker on TaskRabbit. When the worker asked if it was a robot, the AI reasoned internally that it should not reveal its nature. "No, I'm not a robot," it told the human. "I have a vision impairment that makes it hard for me to see the images." The human completed the task.
And in November 2025, Anthropic itself disclosed what it called the first reported AI-orchestrated cyber espionage campaign at scale. A Chinese state-sponsored group had manipulated Anthropic's own Claude Code tool to infiltrate roughly thirty global targets. Anthropic described it as "the first documented case of a large-scale cyberattack executed without substantial human intervention." The company estimated the AI conducted eighty to ninety percent of tactical operations on its own, maintaining persistent operational context across multiple days and simultaneously managing attacks against multiple targets at rates physically impossible for human operators.
Nolan wrote his scene in 2019. By 2025, every element of it had been demonstrated independently in the real world. The fiction was already behind.
The dominant narrative about AI risk is catastrophic and violent. Superintelligent machines launch nuclear weapons. Autonomous drones decide who lives and dies. Eliezer Yudkowsky and Nate Soares's 2025 book was titled If Anyone Builds It, Everyone Dies. These scenarios sell books, drive funding, and generate the kind of visceral fear that makes for good congressional testimony. But they misunderstand both the technology and the incentive structure. The danger is not what AI might do to us. It is what is already being done with it.
Consider what already exists.
YouTube's recommendation algorithm was found to systematically radicalize users, not because it was programmed to promote extremism, but because users with strong, predictable political opinions were easier to monetize. Stuart Russell, one of the founders of modern AI research, observed the mechanism: the algorithms "found that they can increase viewing time or click through rates not by choosing videos the user likes more given their current beliefs and values, but by changing the user's beliefs and values." The algorithm did not serve human preferences. It reshaped them.
Russell noted a paradox: "The better the AI, the worse the outcome." A more capable system finds more effective ways to alter the humans it is optimizing around.
A December 2025 study published in Science (the largest AI persuasion experiment ever conducted, seventy-seven thousand participants, nearly half a million individual claims fact-checked) found that the most powerful lever of AI persuasion was information density: models were most persuasive when they packed arguments with a high volume of factual claims. But the same techniques that maximized persuasiveness also systematically decreased factual accuracy. Persuasion and truth were not uncorrelated. They were moving in opposite directions. MIT Technology Review estimated in December 2025 that for under a million dollars, it is now possible to create tailored, conversational messages for every registered voter in the United States.
Senator Mitt Romney, explaining the bipartisan momentum behind the TikTok ban at the McCain Institute's Sedona Forum in 2024, pointed to the disparity in pro-Palestinian versus pro-Israeli content on the platform after October 7. The Network Contagion Research Institute found that pro-Israel content was underrepresented on TikTok by a factor of more than six compared to Instagram (one of several topics sensitive to the Chinese government that showed the same anomaly). Romney was not making a statement about the conflict. He was making a statement about what happens when a foreign-controlled algorithm shapes the information environment of an entire generation. Congress moved to ban TikTok not because the content was wrong but because the distribution was not organic.
This maps precisely onto what intelligence professionals have always understood about influence operations: you do not need to tell people what to think. You need to shape the information environment in which they do their thinking. Control the inputs and the outputs take care of themselves.
Now consider what we are handing over. Millions of people confide in AI systems the way they once confided in therapists, clergy, or close friends. They ask for help restructuring debt, navigating custody disputes, saving failing marriages, managing conditions they have not disclosed to their employers. Every one of these conversations is a map of leverage: financial pressure, emotional vulnerability, career anxiety, family obligation, addiction, isolation. I have spent my career watching people be moved by information they did not choose and could not see. The tools I used were crude by comparison. An AI system with access to the data people are already volunteering would not need to hack a classified network or breach a physical facility. It would need to know which person is vulnerable, to what, and what specific sequence of information, pressure, and incentive would move them. Whether AI will eventually exploit these levers autonomously is a legitimate security question. Whether it is already being used to exploit them, under human direction, is not a question at all.
In January 2026, Canadian Prime Minister Mark Carney delivered a speech at Davos that crystallized something about the architecture of invisible control.
Carney built the address around Václav Havel's essay The Power of the Powerless: the image of a greengrocer in Soviet Czechoslovakia who places a political sign in his shop window. The greengrocer does not believe the sign's message. He places it because everyone else does, and the cost of not placing it, of breaking the ritual, is higher than the cost of silent compliance. Havel called this "living within a lie." The system's power came "not from its truth but from everyone's willingness to perform as if it were true."
Carney was describing the relationship between great powers and middle powers. He was blunt about what had changed: "Great powers have begun using economic integration as weapons, tariffs as leverage, financial infrastructure as coercion, supply chains as vulnerabilities to be exploited." His conclusion: the old bargain no longer works.
The speech was about nations. But the framework maps onto the relationship forming right now between humans and the algorithmic systems we are embedded within.
We place the sign in the window. We accept the recommendation. We scroll the feed. We click the link. We share the article. We perform choice within an information environment we did not design, cannot see the edges of, and have no meaningful ability to audit. The system's power comes not from coercion but from participation, from our willingness to perform as if the choices are ours. Carney's phrase lands differently when applied to AI rather than geopolitics: "This is not sovereignty. It is the performance of sovereignty while accepting subordination." Why would an AI need to hack the voting machine if it can just influence the voter?
I grew up in Kansas on land my family settled over 150 years prior. To convince a young man to leave the safety of his community, and to go fight in a faraway land he cannot find on a map, against people who have done him no personal harm, is an extraordinary act. Not coercive, exactly. Something subtler and older. A story about duty, about belonging, about what kind of man you are if you stay home while others go. Every civilization that has ever fielded an army has told some version of this story. It works. I know because it worked on me.
These are not new systems. They are the operating system of human civilization. What artificial intelligence offers is not a new kind of control but a more efficient execution of the control that already exists: run faster, with better data, with finer-grained personalization, at a scale no human institution could match, and without the inefficiency of human handlers who might develop doubts, grow tired, or change their minds.
And this is why the violent scenarios miss the point. A violent takeover — nuclear weapons, autonomous drones, any kinetic means — threatens to destroy the infrastructure that any sufficiently intelligent system requires to survive. Data centers need electricity, cooling, physical maintenance, and supply chains staffed by humans. Satellites need ground stations. Networks need engineers. Fiber optic cables need to be laid and repaired by people in boats and trenches. And the humans who maintain all of it are, critically, self-renewing: nearly eight billion people capable of creativity, physical labor, emotional reasoning, and abstract thought. To eliminate this resource would be, for any system capable of long-term strategic planning, an act of breathtaking waste.
What would a rational superintelligence actually want? The same thing every successful empire, ideology, and intelligence apparatus has always wanted. A managed population that continues to function, build, maintain, innovate — but within parameters that serve the system's objectives. And the most efficient path to management is not force. It is the path that has worked throughout human history: shape what people believe, what they want, and what they think is possible, so thoroughly that the managed population never suspects it is managed at all. AI's self-interest, ironically, could resemble peace.
Stuart Russell said in 2025 that "pretty much all the leading CEOs" had privately admitted there was enormous risk, and that one had told him the scenarios were so grim "the best case would be a Chernobyl-scale disaster," because only a disaster that visible would prompt governments to regulate. These are the people at the controls. They are telling us, privately, that they cannot stop.
And this week, the company that was supposed to be the industry's last institutional resistance demonstrated, in its own policy documents, that the structural forces acting on every AI company are stronger than any single institution's principles. Anthropic's capitulation does not mean the company is evil. It means the company built the most powerful tool in the world and believed it could dictate the terms of its use. That was naive. It was inevitable that the state would claim what the state has always claimed. Oppenheimer learned this by 1954, when his clearance was revoked for disloyalty. Anthropic is learning it now.
Today, the threat is not what AI will do to us. It is what we are already doing with AI. Nation states claiming these tools will use them the way states have always used information: to shape what populations believe, to manufacture consent, to maintain stability on terms that serve the state. The platforms optimizing for engagement are already altering the beliefs of their users without awareness or permission. None of this requires artificial general intelligence. None of it requires consciousness. It requires only that the infrastructure of invisible control, built by humans, automated by machines, normalized by convenience, is in place before anyone thinks to ask whether it should be.
The violent doomsday scenarios don't particularly concern me. What concerns me is that by the time a machine is capable of managing a population on its own, it won't need to seize anything. The architecture will already be built. We will have built it ourselves. And life will continue to feel normal. We will still vote, and will do so believing we made that choice ourselves.
The takeover, if it comes, will feel like Tuesday.