Pentagon Picks 8 AI Vendors For Classified Networks, Cuts Anthropic

The Department of War on May 1, 2026 cleared eight artificial intelligence vendors to deploy their models inside the Pentagon’s classified networks. SpaceX, OpenAI, Google, Microsoft, Nvidia, Amazon Web Services, Oracle, and Reflection all made the cut. Anthropic, the maker of Claude, did not.

The exclusion was not an oversight. The Pentagon spent three months trying to force Anthropic to drop two specific contractual carve-outs: a ban on using Claude in fully autonomous weapons, and a ban on using Claude for mass domestic surveillance. Anthropic refused. Defense Secretary Pete Hegseth tagged the company a “supply chain risk” in February. The May 1 announcement was the receipt.

This is the moment U.S. defense AI policy split in two. Vendors who accept “all lawful purposes” terms get into IL6 and IL7 networks. Vendors who insist on guardrails get cast out, even when the same vendor is being courted at the White House over a different product through a different door.

Eight Vendors In, One Frozen Out: Who Made The May 1 Cut

The deal covers Impact Level 6 and Impact Level 7 systems, the Pentagon’s two highest non-special-access classification tiers. IL6 stretches up through Secret. IL7 reaches into Top Secret and Sensitive Compartmented Information workloads. Models running here can touch warfighter data, intelligence feeds, logistics planning, and operational command material that has never been allowed on commercial AI before.

The eight vendors approved on May 1 are:

• SpaceX, which absorbed Elon Musk’s xAI in 2025
• OpenAI, already running its DoD-specific Forge service
• Google, ferrying its federal-grade Gemini Government variant
• Microsoft, with Azure OpenAI on the secret-cloud side
• Nvidia, bringing NIM microservices, NeMo, and its inference stack
• Amazon Web Services, with Bedrock plus secret-region capacity
• Oracle, added shortly after the initial seven
• Reflection, an Nvidia-backed startup focused on open-weight reasoning models

Pentagon officials declined to disclose contract sizes for any of the eight vendors. The Department of War’s classified-networks AI agreements release framed the cluster as an “architecture that prevents AI vendor lock,” language that telegraphs how nervous the building is about depending on any single foundation model provider.

Why Anthropic Got Blacklisted Over Claude’s Two Red Lines

Anthropic’s clash with the Pentagon traces back to one sticking point. The company would not let the military use Claude for “all lawful purposes.”

That phrase sounds anodyne. It isn’t. Internal Pentagon procurement language treats “all lawful purposes” as a green-light clause covering autonomous weapons targeting and mass domestic surveillance, both legal under the right authorizations. Anthropic’s existing $200 million enterprise deal with the Defense Department contained explicit carve-outs banning both. The company refused to remove them.

Hegseth’s reaction in late February was personal. “This week, Anthropic delivered a master class in arrogance and betrayal,” the defense secretary wrote on X, accusing the company of trying to “strong-arm the United States military into submission” and calling its position “sanctimonious.” Hours later, the Department of War tagged Anthropic with a “supply chain risk” label, a designation previously reserved for Chinese state-linked suppliers and entities tied to foreign intelligence services.

President Donald Trump followed with an executive order requiring every federal agency to “IMMEDIATELY CEASE all use of Anthropic’s technology.” Palantir, an existing Anthropic deployment partner, pulled Claude models from its DoD-facing platforms within days.

The chain reaction shut Anthropic out of the May 1 cluster before that cluster existed. The Department of War’s January 2026 AI Strategy document had already telegraphed the framework, ordering the Chief Digital and AI Office to “unlock data for AI exploitation” across classification tiers.

The Mythos Contradiction Splitting The Trump Administration

Even as the Pentagon was finalizing the eight-vendor lineup, the White House was quietly reopening the Anthropic conversation through a different door.

On April 17, Anthropic CEO Dario Amodei met with Chief of Staff Susie Wiles and Treasury Secretary Scott Bessent at the West Wing. The agenda was Mythos, Anthropic’s new vulnerability-finding model, which had identified thousands of previously unknown high-severity bugs across major operating systems, browsers, and infrastructure software. Mythos surfaced a 27-year-old flaw in OpenBSD and a 16-year-old defect in FFmpeg in internal testing.

Mythos is the kind of tool that scares cybersecurity policy hands in both directions. The same model that lets defenders harden software hands attackers a roadmap. Anthropic chose not to release it publicly and instead opened a controlled program called Project Glasswing.

Pentagon CDAO leadership has acknowledged the Mythos meeting as a separate track. The blacklist over Claude remains live. The Mythos discussion is happening anyway. The Council on Foreign Relations analysis on the Anthropic standoff argued that this contradiction is the story.

Inside Project Glasswing’s $100 Million Cybersecurity Bet

Glasswing’s first cohort reads like a who’s-who of the American hyperscaler stack: AWS, Apple, Cisco, Google, Microsoft, Nvidia, CrowdStrike, and JPMorgan Chase. Each gets early Mythos access plus a slice of Anthropic’s $100 million credit pool to run vulnerability scans against their own codebases.

The optics are awkward. Four of the eight Glasswing members, AWS, Google, Microsoft, and Nvidia, are also direct beneficiaries of the May 1 Pentagon deal. The same companies the Defense Department picked over Anthropic are now using Anthropic’s software to harden the products they will run on classified networks.

A Court Ruling, An Appeal, And A Live Legal Mess

The blacklist is not settled law. Anthropic sued the federal government within days of Hegseth’s announcement, and the litigation has split across two appellate paths.

1. February 27, 2026: Hegseth designates Anthropic a “supply chain risk.”
2. March 24, 2026: Anthropic argues for a preliminary injunction in the Northern District of California.
3. March 26, 2026: Judge Rita Lin issues the injunction in a 43-page ruling, halting the designation and Trump’s executive order.
4. April 8, 2026: A D.C. Circuit appeals panel declines to block the designation in a parallel federal challenge.
5. April 17, 2026: Amodei meets White House officials about Mythos.
6. May 1, 2026: Pentagon announces the eight-vendor classified-network deal without Anthropic.

The split is awkward for the Pentagon. Lin’s California injunction technically forbids enforcement of the supply chain risk label against contractors. The April 8 D.C. Circuit decision suggested the appeals bench is less convinced. Anthropic’s lawyers are trying to consolidate the two tracks before the summer.

Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government.

That sentence comes from U.S. District Judge Rita Lin’s 43-page ruling on March 26, which framed Hegseth’s designation as “classic First Amendment retaliation.” A second appeals panel will hear arguments later this spring.

What These AI Tools Will Actually Do Inside IL6 And IL7

Pentagon officials describe the May 1 deals as plumbing for decision support, not weapons control. The classified networks already process intelligence cables, logistics records, and operations data. AI models will accelerate analysis. They won’t pull triggers.

The official release described three priority workloads: data synthesis, situational understanding, and warfighter decision augmentation. Translation: faster intelligence summaries, faster cross-source correlation, and AI-assisted briefings inside command centers. Doug Matty, the Pentagon’s previous Chief Digital and AI Officer who left in December 2025 to lead the Golden Dome missile shield project, told Congress in his House Armed Services Committee testimony on AI adoption that “the adoption of AI is transforming the Department’s ability to support our warfighters and maintain strategic advantage over our adversaries.”

• 2 classification levels covered: IL6 (Secret) and IL7 (Top Secret/SCI).
• 8 AI vendors approved across the cluster.
• $200 million: value of Anthropic’s pre-blacklist Pentagon contract, still in legal limbo.
• 3 stated workload priorities: data synthesis, situational understanding, warfighter decision augmentation.

Reflection’s Surprise Seat And The Quiet Vendor Reshuffle

Reflection is the surprise on the list. The startup, founded in 2024 and backed by Nvidia, is still building out its product story.

Reflection ships open-weight reasoning models tuned for code generation and verification. That profile matters to the Pentagon. Open weights mean the agency can deploy on its own air-gapped hardware without phoning home to a vendor cloud, a property that beats benchmark scores when a model has to live near Top Secret data.

A Reflection spokeswoman framed the deal as a precedent rather than a payday. “This shared understanding with the Pentagon is a first step in supporting U.S. national security, and sets a precedent for how AI labs could work across the U.S. government, from supporting our servicemembers to our scientists,” she said.

The pick is also an implicit dig at Anthropic. By elevating a young open-weight startup into the same classified-network tier as Microsoft and Google, the Department of War signaled that ideological purity on safety guardrails is not the only path to relevance. Smaller, more accommodating vendors will get the call.

Warren Wants Receipts From Hegseth

Senator Elizabeth Warren of Massachusetts opened a formal investigation in late April demanding that Hegseth explain the supply chain risk designation, the OpenAI contracting language, and the Pentagon’s standards for what counts as a national security threat.

The senator’s office requested copies of contractual carve-outs for the eight winning vendors, internal Pentagon policy on autonomous weapons, and any communications between OpenAI and the Department of War. Her Senate Banking Committee investigation letter on the Anthropic designation set a 30-day response window that runs into late May.

Warren’s letter pointed to a pattern. The same Defense Department that called Anthropic’s safety guardrails a national security risk had quietly accepted contractual generalities from OpenAI that legal analysts warn could permit both fully autonomous weapons use and domestic surveillance.

The NYU Stern Center for Business and Human Rights quick-take on the Anthropic feud argued that punishing one company for taking safety positions creates a chilling effect across the entire industry. Other AI labs watching the blacklist play out are quietly pruning their own guardrail language to avoid the same fate.

Hegseth has not responded publicly to Warren’s letter. The investigation has not yet produced a hearing date.

The Numbers Pentagon Won’t Print

Contract values are the missing piece. The Department of War’s release deliberately avoided dollar figures for any of the eight vendors. Pentagon procurement staff told reporters the deal is structured as a framework agreement that lets each agency draw down individual task orders, which means the public will see spending only when specific units start booking compute hours.

The opacity is convenient. Without disclosed totals, comparing what the Pentagon will pay for OpenAI’s Forge service against what it would have paid Anthropic under that blocked $200 million Claude contract is impossible. The Chatham House analysis of the Anthropic feud and AI governance limits argued that this opacity is a feature of the current AI procurement model, not a bug, and that it is undermining democratic oversight of how AI gets used in war.

Frequently Asked Questions

Is Anthropic Permanently Banned From Working With The Pentagon?

No. The supply chain risk designation is currently blocked by Judge Rita Lin’s March 26 preliminary injunction, and Anthropic’s existing $200 million Pentagon contract has not been formally voided. The company is still in court fighting the blacklist, and the White House is separately meeting CEO Dario Amodei about its Mythos cybersecurity tool. Watch the D.C. Circuit’s full decision, expected this summer, for the next major shift.

What Can These AI Tools Actually Do On Classified Networks?

They can read, summarize, and correlate classified data inside Impact Level 6 and Impact Level 7 environments, covering Secret and Top Secret/SCI material. Pentagon officials describe the workloads as data synthesis, situational understanding, and warfighter decision augmentation. Under the May 1 framework these tools are not approved to autonomously control weapons or run mass domestic surveillance, though Senator Warren is asking for the actual contract language to verify those limits.

How Much Are The Pentagon Contracts Worth?

The Department of War declined to disclose contract sizes for any of the eight vendors. The deal is structured as a framework agreement, which means individual military units will draw down task orders against the master contracts. Public dollar figures will appear only as those obligations get booked through SAM.gov. Anthropic’s pre-blacklist Pentagon contract was worth $200 million as a baseline reference point.

Can Civilian Federal Agencies Still Use Claude?

Yes, for now. Lin’s injunction halted Trump’s executive order requiring every federal agency to “immediately cease all use of Anthropic’s technology.” Civilian agencies, including portions of the Department of Energy and the General Services Administration, can keep using Claude under existing contracts. The April 8 D.C. Circuit ruling complicates that picture, so contracting officers should track GSA guidance updates weekly through the spring.

How Is Reflection Different From The Other Seven Vendors?

Reflection ships open-weight reasoning models that the Defense Department can deploy on its own air-gapped hardware, with no phone-home to a commercial cloud. That property matters more than headline benchmark scores in classified environments where data cannot leave the network. The other seven vendors run mostly through their own commercial cloud infrastructure with secret-region capacity, which means slower onboarding and stricter data boundary review.

The Pentagon spent three months trying to force Anthropic to drop two contract clauses, lost a federal injunction, picked eight other vendors, and is now meeting with Anthropic about a different product through a different door. Reflection walked into a classified-network seat. Anthropic walked out of the May 1 announcement and into a Supreme Court brief that nobody in the Department of War wants to read.