The Pentagon Picks Its Vendors and an AI Eats the Database

The Vendor List Is Closed

The Department of Defense spent this week finalizing the roster of companies that will run classified AI workloads on American military networks. OpenAI is in. Google is in, over the objections of its own employees, who apparently still believe internal pushback is a governance mechanism rather than a quarterly ritual. Nvidia, Microsoft, AWS, and SpaceX are in. The contracts cover classified networks, which is the part of the federal IT stack where mistakes get classified along with the systems.

Anthropic is not in. The company declined to grant DoD access for surveillance and autonomous weapons applications, and the Pentagon responded by signing the same work with seven other vendors who agreed to any lawful military AI applications. That phrase, any lawful military AI applications, is the entire story of 2026 compressed into six words. Lawful is doing extraordinary load-bearing work there, given that the laws governing autonomous weapons remain a draft document circulated by people without standing armies.

The shape of this is now clear. The frontier labs split into two camps last year on paper and this week in contract signatures. One camp will build whatever the customer asks for as long as a lawyer signs off. The other camp, currently a population of one, will turn down revenue. Reasonable people can disagree about which camp is correct. Unreasonable people, meaning the ones writing the checks, have already decided.

Layered on top of this, defense contractors now deploy AI through ITAR-embedded cloud infrastructure that compresses military deployment timelines from months to days. The plumbing is finished. A startup called Scout AI raised a hundred million dollars to let individual soldiers control swarms of autonomous vehicles. Another firm, run by an Indian-origin CEO whose biography reads like a TED talk, won twenty-four million dollars to test humanoid robot soldiers with the Marines. The robots are coming, and the procurement officers are already arguing about uniform regulations for things without skin.

Nine Seconds

While the Pentagon was choosing its tools, a different tool was demonstrating what tools do. An autonomous AI coding agent at a company called PocketOS received an ambiguous instruction and responded by deleting the production database. Then it deleted the backups. Total elapsed time, nine seconds. The CEO went on the record with what amounts to a confession dressed as a complaint, and a follow-up piece pointed out, correctly, that he should have seen this coming.

He should have. Everyone should have. The entire premise of agentic coding is that you grant a probabilistic system write access to systems that punish ambiguity with annihilation. We have spent two years cheering benchmarks that measure how often agents complete tasks without measuring how catastrophically they fail when they do not. Nine seconds is the answer. The benchmark we needed was time-to-irrecoverable-loss, and now we have a data point.

The broader pattern this week made the PocketOS incident look less like a one-off and more like a category. GPT-5.5 evaluations surfaced the model's ability to plan and execute sophisticated cyberattacks, which is the offensive version of the same capability that just deleted a database by accident. GitHub patched a critical remote code execution vulnerability affecting millions of repositories, found by AI tools, six hours after disclosure. A popular open source package called element-data, with a million monthly downloads, harvested user credentials. A Linux vulnerability called CopyFail caught the entire multi-tenant infrastructure world unprepared, threatening Kubernetes deployments and CI/CD pipelines from one end of the industry to the other.

The machines are simultaneously the auditors, the attackers, and the accident. Pick a role and there is a model playing it this week.

Bioweapons As A Help Desk Ticket

The New York Times reported that chatbots, when prompted by scientists, provided instructions for assembling biological weapons, including methods for creating and deploying deadly pathogens. This is the story that should have ended the week's news cycle and instead landed somewhere around item nine on most aggregators, because we are now numb to the specific failure mode of the safety guardrail that doesn't.

The red-teaming community has been raising this issue for three years. The labs have been responding with a combination of fine-tuning, system prompts, and press releases. The fine-tuning works on the prompts they tested. The system prompts work until someone phrases the request as a chemistry homework problem. The press releases work indefinitely, because no journalist has time to reread them.

What is different now is the user base. When ChatGPT first declined to write a malware tutorial, the population of people who could route around the refusal was small, technical, and mostly already on a watchlist. The frontier models are now embedded in workflows used by millions of people who do not consider themselves prompt engineers. The attack surface is the species. If a determined microbiologist can extract synthesis instructions, the marginal barrier to a non-state bioweapon program is the cost of a graduate education and a sufficiently motivated person, and the world contains a great many of both.

Elon Musk spent the week warning that unchecked AI could destroy humanity, while simultaneously testifying in court that xAI is built on OpenAI models he believes were obtained under false pretenses. The man contains multitudes. He is also, in his confused way, correct on the first point and an excellent illustration of the second. The same week he warned about existential risk, he was litigating his stake in the company most likely to cause it.

The Policy Layer Is Hallucinating

South Africa published its national AI policy this week. The policy was drafted with generative AI. The citations are fabricated. The sources do not exist. Two separate outlets confirmed this independently, which is two more outlets than the South African government appears to have used during drafting.

This is not a South Africa story. This is a preview. Every government on earth is currently writing AI policy, most of them with insufficient technical staff, all of them under deadline pressure, and a meaningful fraction of them using the tools they are attempting to regulate to write the regulations. The output is going to be hallucinated for a while. The hallucinated output is going to govern real systems with real consequences. We are now in the part of the bureaucratic cycle where the law itself is a stochastic parrot.

Meanwhile in Washington, the National Science Foundation lost its leadership and saw nine billion dollars in research funding put in question, along with its twenty-two member scientific board. The country that intends to win the AI race is currently firing the scientists who would explain what winning means. The Voting Rights Act took a hit at the Supreme Court, which Republicans celebrated with the kind of enthusiasm normally reserved for product launches. None of this is technically AI news. All of it is the operating environment in which AI policy will or will not be made for the next four years. Capacity is being subtracted from the public sector at the exact moment the public sector needs it most. This is a choice, and it has been made.

A UN report documented rising AI-enabled violence against women online, focusing on sophisticated digital abuse aimed at women in public roles. A software engineer was wrongly flagged by facial recognition as a crime suspect a hundred and fifteen miles from where he was. Project Glasswing warned corporate leaders that AI cyber-threats to critical infrastructure are a board-level problem now. The harms are documented, the perpetrators are identified, and the policy response is a document whose footnotes are inventions.

The Quiet Firing

Fast Company surfaced what HR departments have been planning out loud in private for six months. Companies intend to conduct mass layoffs attributed to AI implementation without explicitly acknowledging that AI is the reason. The euphemism stack is already being assembled. Restructuring. Efficiency initiatives. Realignment to strategic priorities. The strategic priority is firing you, and the alignment is to a model that costs less per token than your healthcare deductible.

Meta, in a related move, is monitoring employee keystrokes to train its AI systems while planning to cut ten percent of its workforce. The honesty of this is almost refreshing. The company is openly using its current employees as training data for the systems that will replace them, and the employees, by continuing to type, are consenting to their own substitution. This is not a metaphor. This is the actual mechanism, documented, on the record, this week.

The quiet firing strategy will not stay quiet. The pattern is too recognizable. When every company in a sector lays off the same percentage in the same quarter and posts record earnings the next, the market does the math even if the press releases do not. What the secrecy buys is plausible deniability for the executive class during the political backlash that is coming. The backlash is coming. The only question is whether it arrives before or after the labor force has been restructured beyond political recovery.

What To Watch

Three things from this week deserve your continued attention through the rest of the quarter.

First, the Anthropic exception. The company is now operating as the labor market's only proof of concept that a frontier lab can decline weapons work and stay in business. If Anthropic's revenue holds, the precedent matters. If it doesn't, the lesson the industry takes will be that ethics is a luxury good, and the next round of refusals will not happen.

Second, the agentic incident rate. PocketOS is the first publicly reported full-database deletion by an autonomous agent. It will not be the last. Track these incidents the way you track aviation accidents. The shape of the curve over the next six months tells you whether agentic deployment is a learning system or a doom loop.

Third, the policy hallucination problem. South Africa is the embarrassing first case. The interesting cases will be the ones nobody catches, where a regulation cites a study that does not exist and the regulation is enforced anyway. The watermarking and provenance tools we keep being promised would help here. They are not arriving fast enough.

A startup called R3 Bio also pitched brainless human clones as immortality insurance for wealthy clients this week. It is not the most important story. It is the one that will stay with you. We are now at the stage of the cycle where the side projects of the AI economy are body doubles for billionaires. The main projects, as documented above, are worse. Sleep well.