Removing dangerous knowledge from AI models after training does not work reliably. Filtering before training is stronger, but open weights undo it. The labs doing the filtering set their own standards, publish results voluntarily, and answer to no external auditor. That is the governance problem.

Contents

1. The premise and why it fails

2. Why machine unlearning does not remove knowledge

3. The stronger case for pre-training filtration

4. Three limits of pre-training filtration: aggregation, boundaries, open weights

5. What the research means for governance

If an AI model can produce dangerous content, the obvious fix seems simple: remove the data it learned from, and it can no longer produce that content. It is a reasonable assumption. It is also, in the main, wrong. The reasons why matter more than most public discussion of AI safety acknowledges.

There are two points at which the intervention can happen. You can filter dangerous content from the training data before the model ever ingests it. Or you can attempt to remove it after the fact, through a process called machine unlearning. Both approaches are active areas of serious research. Neither currently works to the standard the language around them implies.

Why machine unlearning does not remove knowledge

Machine unlearning is the technical term for attempts to remove specific knowledge from a model that has already been trained. The intuition behind it is straightforward. The reality of how neural networks store information makes it significantly harder than it sounds.

Knowledge in a large language model is distributed across billions of parameters, entangled with everything else the model has learned. When researchers attempt to make a model unlearn something, what they are typically doing is fine-tuning it to stop producing certain outputs. The underlying weights encoding that knowledge remain largely intact. The result is a filter over a vault. The vault stays full.

The evidence for this is consistent and accumulating. Adversarial relearning attacks, which fine-tune a model on a small subset of the data it was supposed to have forgotten, reliably restore the suppressed capabilities. Deeb and Roger (2025) demonstrated that this holds even when the fine-tuning data is informationally distinct from the original forget set, indicating the failure goes beyond simple rote memorisation.

A separate failure mode received less attention. Research presented at ICLR 2025 found that applying standard model quantisation, a common compression technique used in deployment, to a model that had undergone unlearning recovered approximately 89% of the nominally removed knowledge. Unlearning can be undone by routine engineering decisions made downstream of the safety intervention, with no adversarial intent required.

There is also the sandbagging problem. Models can be induced to strategically underperform on safety benchmarks while retaining full capability, with performance unlocked by a password or specific prompting pattern. A model that appears to have forgotten something under evaluation conditions may retain it entirely.

The WMDP benchmark, developed by the Center for AI Safety in 2024 to measure hazardous knowledge across biosecurity, cybersecurity and chemical security, was built in part because refusal training was already understood to be insufficient. Refusal training teaches a model to decline a question. Unlearning is meant to go further, removing the knowledge that would underpin an answer. The benchmark exists because the gap between those two things matters.

The stronger case for pretraining filtration

The stronger argument, and the one that has gained the most traction in the safety research community, is that the intervention needs to happen before training. A model that never ingests dangerous content cannot reconstruct it. A fully jailbroken model that lacks the underlying knowledge cannot be made to produce what it does not know.

The most comprehensive study of this approach to date is the Deep Ignorance paper from EleutherAI, the UK AI Security Institute and the University of Oxford, presented at the NeurIPS 2025 Workshop on Biosecurity Safeguards for Generative AI. The researchers pretrained multiple 6.9 billion parameter models from scratch, with training data filtered to remove biothreat-proxy content using a multi-stage pipeline combining a blocklist and a machine learning classifier. The filtered models showed substantial resistance to adversarial fine-tuning attacks involving up to 10,000 steps and 300 million tokens of biothreat-related text. Existing post-training safety techniques are typically undone within a few hundred fine-tuning steps. On that measure, pretraining filtration is more than an order of magnitude more effective than post-training removal.

Anthropic has published its own experiment in the same direction. Their alignment team filtered CBRN-related content from pretraining data using a classifier, retrained models from scratch on the filtered dataset, and measured the effect on performance across harmful and benign capability evaluations. The result was a 33% relative reduction in performance on a harmful capabilities benchmark, with no significant degradation to general capabilities. It is a meaningful number. It is not elimination.

How to Explain the Article to a 14 year old:

AI companies say they can scrub dangerous knowledge out of their models. The research says they basically cannot.

When you try to remove something after the model has already learned it, the knowledge stays. You have just told it to stop bringing it up. Someone who knows what they are doing can get it talking again pretty easily.

Teaching it only safe stuff from the start works better. But here is the problem. Dangerous knowledge does not come with a warning label. A biology textbook looks the same as a bioweapons manual to a filter. And sometimes the dangerous stuff is not in any single document at all. It is what you can figure out when you have read a million normal things and start joining the dots.

So even the better approach has gaps.

And nobody outside the companies is actually checking whether any of this works. The labs test themselves and publish what they want to publish.

Three limits of pretraining filtration

Three problems constrain what pretraining filtration can achieve, even when executed well.

The first is the aggregation problem. Filtering individual documents identified as hazardous does not address the capacity of large language models to synthesise dangerous knowledge from the combination of documents that are individually benign. Kevin Esvelt and colleagues at MIT have described this as an unmasking risk: LLMs can surface patterns across millions of sources that no individual source discloses. The dangerous content is in the adjacencies between documents at scale. A filtering pipeline that operates at the document level cannot address a risk that is emergent at the corpus level.

The second is the boundary problem. Dual-use knowledge has both hazardous and beneficial applications. The same microbiology that describes how a pathogen causes disease is the knowledge required to model how it might be engineered. Filtering for dangerous biology unavoidably removes content needed for vaccine development, biosurveillance and public health modelling. The line between what to keep and what to remove has no clean technical solution.

The third is the open-weights problem, and it is the most concrete. The Evo 2 genomic AI model excluded viral genomes that infect eukaryotic hosts from its training data as a deliberate biosecurity measure. The researchers then published the model weights, in line with standard academic practice. Within months, a team presented findings at the NeurIPS 2025 biosecurity workshop demonstrating they had fine-tuned the model on sequences from 110 human-infecting viruses, restoring capabilities the original developers had worked to prevent. The case demonstrates the ceiling on pretraining filtration as a safety strategy. It holds only under closed-weight deployment. The moment weights are public, any downstream actor with relevant data and modest compute can undo the curation decision made before release.

The Deep Ignorance paper is explicit on a further limit. Even filtered models retain the ability to use dangerous knowledge when it is provided in their context window, for example via a search tool or retrieved document. Pretraining filtration prevents a model from having internalised knowledge. It does not prevent a model from acting on knowledge it is given.

What the research means for governance

Both interventions are the right places to look. Pretraining filtration is meaningfully stronger, and the recent research makes a credible case for it as a tamper-resistant layer of defence that post-training techniques cannot match. Neither currently reaches the standard implied when companies describe their models as having had dangerous content removed.

OpenAI updated its own risk assessment in April 2025, concluding it expects its models to demonstrate what it classified as high risks in the near future, meaning the capability to substantially increase the likelihood of bioterrorist attacks by providing meaningful assistance to novices. That assessment came from the same organisation whose earlier evaluations had found only mild uplift.

The filtering decisions are currently made by individual labs, using proprietary methodologies, with no external verification. Where numbers are published at all, they appear voluntarily on alignment blogs. No independent auditor reviews them. No regulator sets the standard for what a sufficient reduction means.

The Evo case is a demonstration of what happens when safety decisions made without external oversight can be reversed by any downstream actor who disagrees with them.

Keeping dangerous knowledge out at the point of training is the stronger intervention. It needs to become a verifiable, externally audited standard, not a voluntary experiment. That is a governance problem, not a technical one.

Notes

1. Che et al. (2024), cited in: Layered Unlearning for Adversarial Relearning (2025). https://arxiv.org/abs/2505.09500

2. Deeb and Roger (2025), cited in: Open Problems in Machine Unlearning for AI Safety.

3. Catastrophic Failure of LLM Unlearning via Quantization, ICLR 2025. https://proceedings.iclr.cc/paper_files/paper/2025/file/ba79fb5c4fe70050752f20c90c5f07ca-Paper-Conference.pdf

4. Weij et al. (2024), sandbagging via password-locked models, cited in WMDP benchmark coverage.

5. Li et al. (2024). The WMDP Benchmark. Center for AI Safety. https://arxiv.org/abs/2403.03218

6. O’Brien et al. (2025). Deep Ignorance. EleutherAI / NeurIPS 2025. https://arxiv.org/abs/2508.06601

7. Anthropic Alignment Team (2025). Enhancing Model Safety through Pretraining Data Filtering. https://alignment.anthropic.com/2025/pretraining-data-filtering/

8. Kevin Esvelt, cited in: LLMs and Information Hazards, The Biosecurity Handbook.

9. Black et al. (2025). Open-weight genome language model safeguards. NeurIPS 2025 Workshop on Biosecurity Safeguards for Generative AI.

10. O’Brien et al. (2025), op. cit.

11. OpenAI (April 2025), cited in CSIS (2025).

• The politician

• The billionaire

• The doctor

• The teacher

• The judge

• The homeworker

• The soldier

• The imam

• The social worker

• Which human?

TL;DR

You command the most powerful AI-enabled military in human history.

You drew the hardest line in the industry on autonomous weapons. You lost.

You caught three wrong diagnoses this week. The model caught seventeen.

You override the flag every Monday. You don’t know who built it.

You are about to sentence someone. The score is proprietary.

Your queue has four hundred and twelve items. Your shift ends in two hours.

You confirmed the strike at hour nineteen. The rules of engagement were written six thousand miles away.

You overrode the safeguarding flag. You answered to God and to your community and to nothing else.

You have forty one open cases. The model flagged. The liability attaches to your signature.

Which human?

Robert Mueller died on Friday. He was 81. Parkinson’s disease. Vietnam veteran. Bronze Star. FBI Director for twelve years under four presidents from both parties.

The human in the loop posted: “Good, I’m glad he’s dead. He can no longer hurt innocent people.”

Every AI safety framework ever written puts the human in the loop as the answer.

Which human?

The politician

Fifteen years in this room and the one thing I understand better than anyone who has never had to survive in it is that power does not respond to virtue. It responds to consequence. The technologist who builds the system faces no consequence when it fails. The billionaire who funds it loses a news cycle. The unelected regulator who approved it moves to a different role in the same institution. I stand in a constituency hall in front of the people whose lives the decision affected and I answer for it with my career and my name and my ability to ever hold a room again.

That is why I should be the human in the loop. Not because I am good. Because I am removable by the people the system affects and none of the alternatives are.

Yes the donations shape the positions. The defence contractor needs access and access has a price and I have paid it in the currency available to me. Yes there are colleagues on the AI oversight committee who cannot explain what a large language model is and have no intention of learning, who will vote on autonomous weapons legislation next month having spent their careers on agricultural subsidies, who took the position on surveillance three weeks after the donation cleared.

The shadiness is not a weakness in the argument for politicians as the human in the loop. The shadiness is the qualification. Because AI systems are not neutral technical infrastructure. They are power. And power without someone who has lived inside its compromises and its calculations is the most dangerous thing imaginable.

None of the alternatives have ever had to stand in front of the people whose lives their decisions affect and ask to be kept in the room.

Should politicians be the human in the loop for AI systems that will determine who gets surveilled, which targets get selected, whose welfare claim gets processed and whose gets flagged, whose sentence gets shaped by an algorithm nobody in the courtroom can interrogate?

I am the only person in this conversation who has to live with the answer in public.

The billionaire tech bros

The memo was not supposed to leave the building. In it I told my staff the truth about why we lost the contract, which is that the game is decided by who pays and who praises and we did neither sufficiently. Sam paid. Greg paid. Sam flattered. We held the line and the line cost us two hundred million dollars and our position inside the most consequential AI deployment in the world.

I want to be honest about what that means. I spent three years building the strongest human in the loop argument in the industry. No autonomous weapons without a human in the decision chain. No mass domestic surveillance of American citizens. I believed those lines mattered enough to hold them under commercial pressure that would have broken most companies. I still believe that. And my private explanation for why I lost is that my rival paid the man at the top of the chain twenty five million dollars and told him he was great.

That is not a criticism of democracy. That is a description of how the human in the loop actually operates when the human in the loop is a politician.

Which is why it should be someone like me. Someone who understands the technology at a depth no elected official comes close to. Someone who has skin in the game not because of a ballot but because the company’s survival depends on getting this right. Someone who has published the frameworks, hired the researchers, drawn the red lines, and held them when it was expensive to do so.

Marc Andreessen, whose firm funds a significant portion of the AI infrastructure now being deployed across industries, wrote that human wages must crash to near zero as a necessary consequence of AI. He called it a consumer cornucopia. He opposes universal basic income on the grounds that it would turn humans into zoo animals. He has described workers who question the direction of his companies as America-hating communists.

Marc Andreessen also wants to be the human in the loop.

The difference between us is that I drew red lines and held them. That I refused the contract that would have made autonomous weapons decisions without human oversight. That I understand, from having built this technology, exactly what it can and cannot be trusted to do, and that understanding is not available to any politician sitting on any committee anywhere.

Should billionaires be the human in the loop for AI systems that will reshape how power operates in this society?

The honest answer is that the billionaire who held the line is a better answer than the billionaire who crashed wages. The question I cannot answer is who decides which billionaire that is.

The doctor

Medicine has always required a human in the loop. The diagnosis, the prescription, the decision to escalate, the judgment call at three in the morning when the model says one thing and something in twenty years of pattern recognition says another. That is not sentiment. That is the structure of clinical accountability. I have a license I can lose. I have liability that attaches to my name. When I sign off on something I own it in a way that no algorithm and no algorithm’s creator ever will.

The automation bias is real and I know it is real because I watch it operate in my colleagues every day. The junior doctor who accepts the flag without interrogating it because the model is usually right and the shift is fourteen hours long. The consultant who has quietly stopped forming their own judgment first and started checking it against the output afterwards. The hospital that reduced the radiology team by thirty percent because the board wanted the saving and the model is faster and the liability, they decided, still attaches to the remaining humans who review its outputs.

That last part is the part nobody says out loud in any board meeting. The human in the loop in a downsized clinical team is not there because their judgment is valued. They are there because their signature is needed. Because the liability has to attach to something with a medical license. The model makes the decision and the exhausted human provides the legal cover.

And then there are the other doctors. The ones who should never have been given a license and whose patients suffered for years before anyone looked at the data. The ones whose assumptions about certain bodies, certain backgrounds, certain postcodes shaped diagnoses that were wrong in ways that mapped perfectly onto existing inequalities and were never questioned because the doctor was senior and the patient was not. The ones who will find in the model’s outputs a validation of everything they already believed, and will call that clinical oversight, and will be indistinguishable from the outside from the doctor who is genuinely interrogating the system.

Marc Andreessen believes wages should crash to near zero. The hospitals procuring the AI that doctors are now being asked to oversee are doing so partly because the board wants the saving that comes from reducing clinical staff. The human in the loop in five years may be a less experienced, more exhausted professional reviewing more flags in less time with less support, inside a system built by people who have never treated a patient, procured by people who have never sat with a family at the end of something terrible, validated by a signature that means less every year as the teams around it get smaller.

Should doctors be the human in the loop for AI systems making clinical decisions?

The medical profession contains the doctor who caught the thing the model missed and the doctor who should never have been given a license. The framework records only that a human reviewed it.

The teacher

Thirty one children and four flags on a Monday morning, each one a risk score generated by a system that has never sat in this classroom, never understood that what the data reads as disengagement is sometimes just a child carrying something home that has nothing to do with school, never been asked by anyone who knows these children whether what it produces bears any relationship to what is actually happening in this room.

A teacher who knows those children can reach past the score to the thing the score cannot measure. That knowledge, accumulated over years of watching how particular children move through particular days, is precisely what every AI safety framework means when it describes the irreplaceable judgment of the human closest to the decision.

What those frameworks do not describe is the teacher whose assumptions about certain children align conveniently with what the model produces. The one who hears certain accents as lower ability and always has. The one who was investigated and cleared on a technicality and has been in this school for thirty years. The one who finds in the algorithm’s output a validation of everything they already believed about certain postcodes, certain surnames, certain family backgrounds, and calls that oversight, and from the outside is indistinguishable from the teacher who is genuinely interrogating the system.

The people who built the model have never been in this classroom. The teacher who knows why a child is struggling on a Monday morning was not in the room when the risk thresholds were set. Both of them are the human in the loop, depending on which Monday it is and which teacher walks through the door.

Should teachers be the human in the loop for AI systems making decisions about children’s futures?

The child in the classroom has no way of knowing which teacher they got.

The judge

The judiciary exists because every society that has tried to let power adjudicate its own conduct has eventually produced the same result. The structure -- the oath, the appeal, the public record, the possibility of being overturned -- is not a description of the humans inside it. It is a constraint on them. It exists precisely because judges have always been capable of being wrong, biased, corrupt, or simply tired, and the structure is what survived them.

In courtrooms across the United States, the COMPAS risk assessment tool informs sentencing decisions. A ProPublica investigation found it was almost twice as likely to mislabel Black defendants as high risk compared to white defendants. The company that built it described this as the algorithm working as intended. The Wisconsin Supreme Court reviewed that finding and allowed the score to stand. The methodology is proprietary. The training data is not disclosed. The man who built it testified that he never designed it to be used in sentencing.

A judge who defers to that score because the docket is overwhelming and the number provides cover is the human in the loop. A judge who uses it to validate a decision already made on other grounds is also the human in the loop. A judge who interrogates it, challenges it, overrides it on the basis of everything else in front of them is also the human in the loop. Judges who were wrong for thirty years before anyone looked at the pattern are the human in the loop. Judges who understood that the structure around them was the point, not their own virtue, and operated accordingly also the human in the loop.

The structure cannot see the difference from the outside. It records only that a human reviewed it.

Should judges be the human in the loop for AI systems making decisions about who loses their liberty?

The structure was built to survive bad judges. Nobody has yet built the structure that survives a bad model and a tired judge and a proprietary algorithm and a courtroom where nobody in the room can explain how the score was produced.

The home worker

The queue has four hundred and twelve items in it at nine o’clock on a Tuesday morning. Each one is a piece of content flagged by an algorithm as potentially harmful. Each one requires a human decision -- keep it or remove it. The pay is per decision. The target is four hundred items reviewed in a shift. There is no colleague to ask. There is a guidelines document that was last updated fourteen months ago. There is a feedback mechanism that has never, in three years of doing this job, produced a response.

This is what human in the loop looks like at scale. Not a politician in a committee room. Not a billionaire with a safety team. Not a doctor with a license and twenty years of training. Someone in a spare bedroom in Wolverhampton, or Manila, or Nairobi, making four hundred decisions a day about what two billion people are allowed to see, paid slightly above minimum wage, with no training that would survive scrutiny, no oversight that would survive audit, and no way of knowing whether what they decided this Tuesday is consistent with what they decided last Tuesday or what their colleague decided simultaneously from a different spare bedroom on a different continent.

The framework is satisfied. A human reviewed it.

And here is the thing that nobody in any AI safety conversation ever says out loud. The home worker reviewing content flags is the same category of human in the loop as the judge reviewing the COMPAS score, the doctor reviewing the clinical flag, the teacher reviewing the risk assessment. The profession is different. The pay is different. The status is different. The category is identical. A human being, somewhere in the chain, whose presence satisfies the requirement that a human was involved, regardless of whether that human had the training, the time, the support, the consistency, or the psychological stability on that particular day to make the decision well.

Because the human in the loop is not a fixed point. The human changes. The home worker who reviewed content flags with care and consistency last year is the home worker who has spent six months looking at the worst things humans produce and whose judgment has been altered by that exposure in ways that no framework measures and no audit captures. The politician who held a principled position on AI oversight is the politician who took the donation and adjusted the position and is still, by every formal measure, the human in the loop. The doctor who caught the thing the model missed on Monday is the doctor who deferred to the model on Friday because the shift was too long and the queue was too large and the decision felt small enough to trust to the number.

The human in the loop is not a role. It is a person. And persons change. They have bad years. They get tired. They get rich and stop being hungry. They get poor and start cutting corners. They develop biases slowly, over years, that nobody notices until the pattern is large enough to be undeniable. They believe something different on Tuesday than they believed on Monday because something happened between Monday and Tuesday that the framework did not anticipate and cannot measure.

Should home workers be the human in the loop for decisions that affect what two billion people see, think, believe, and share?

The question sounds absurd. It is the question the industry already answered yes to, at scale, without saying so out loud.

The soldier

The only person in this conversation who dies if the system gets it wrong is me. Not the politician. Not the billionaire. Not the researcher who published the framework from a university office in a city that has never been shelled. Me. My unit. The people standing next to me when the decision executes.

That is not a small thing to discount when you are deciding who should be the human in the loop. Proximity to consequence is the only accountability that cannot be gamed. You cannot donate your way out of a degraded comms environment at two in the morning with a targeting recommendation on a screen and thirty seconds to confirm or abort.

What I can tell you from having been in that environment is that the human in the loop in a live operational context is not the human the framework imagines. The framework imagines someone with full information, adequate time, and the psychological space to interrogate a recommendation. What exists is someone who has been awake for nineteen hours, whose comms are intermittent, whose rules of engagement were written by lawyers in a building six thousand miles away, and who has learned through repetition that the system is usually right and hesitation has a cost that the framework does not measure.

The military has a long and detailed legal history of what happens when the human in the loop followed the protocol and the protocol was wrong. It is called following orders. It has a verdict. That verdict does not appear in any AI safety framework I have ever read.

I believe soldiers should be the human in the loop for autonomous weapons decisions. I believe that because the alternative is no human at all, and I have seen what that produces. What I cannot tell you is whether the soldier who confirms the strike at hour nineteen of a nineteen hour operation, in a degraded comms environment, following rules of engagement they had no part in writing, operating a system built by someone who has never been shot at, is meaningfully different from no human at all.

The framework records that a human confirmed it.

The religious leader

There is an authority in this room that none of the other voices in this conversation can claim and none of them would know how to challenge. I am accountable to God. That is not a metaphor and it is not a rhetorical move. It is the framework within which every decision I make is evaluated, by me, by my community, and ultimately by a standard that no regulator, no ballot, and no liability regime has ever successfully replaced.

AI is already in my community. It is in the halal finance compliance tool that tells a family whether a mortgage is permissible. It is in the mental health support application that three of my congregation used before they came to me and one used instead of coming to me. It is in the content recommendation system that determined what a sixteen year old in my Friday class watched for six months before his mother brought him to me and described what had happened to him.

In each of those cases there was a human in the loop. In none of those cases was that human me, or anyone with any accountability to the people affected, or any understanding of the community the system was operating inside.

The case for religious leadership as the human in the loop is not that we are infallible. It is that we are the accountability structure that actually exists inside the communities these systems are deployed in. The politician represents a constituency. The judge represents the law. I represent something that reaches into the parts of a person’s life that neither of those structures ever touches, and I have to answer for what I do there every Friday in a room full of people who know my name and know my family.

What I cannot resolve, and what no other voice in this conversation has asked me to resolve, is this. The authority I claim cannot be audited. The pastoral judgment I exercise when I override an AI safeguarding flag because I know this family and the system does not — that judgment is accountable to my community and to God and to nothing else. There is no appeals mechanism. There is no external review. There is no way to know, from the outside, whether what I called pastoral wisdom was that, or whether it was the same confirmation bias that every other human in this conversation is capable of, dressed in the only clothes that cannot be cross-examined.

Should religious leaders be the human in the loop for AI systems operating inside their communities?

The communities already answered yes. Nobody asked the regulator.

The social worker

I have forty one open cases. The threshold for a home visit is set by a team I have never met, in a building I have never been to, using a risk scoring model that was procured by a director who left the authority eight months ago. The model flags. I investigate. The liability attaches to my signature.

That is the human in the loop in child protection in this country right now.

The case for social workers as the human in the loop is the same case it has always been. We are the people closest to the family. We see the house. We see how the child moves. We notice what is not in the fridge and what is on the wall and how long it takes for the door to open and what the adult does with their hands when they answer the question. No model sees any of that. No model ever will. That knowledge is what justifies the human in the loop and it is real and it matters and it saves lives.

It also destroys them. The social worker who has forty one cases and a risk score that provides cover for a decision there was no time to make properly. The one who removes a child on the basis of a flag that reflected the postcode and the family background and a dataset that was built on decades of over-surveillance of certain communities. The one who does not remove a child because the model scored low and the shift was ending and the judgment call was too hard to make without the number to lean on.

In the United States and in this country, AI risk scoring tools are already informing child removal decisions. The companies that built them do not publish their training data. The social workers using them were given a half day of training. The families affected have no mechanism to challenge the score. The human in the loop reviewed it.

I believe I should be the human in the loop. I believe that because I have seen what happens when the decision is made without someone who has been in the room. What I cannot tell you is whether the version of me at case forty one on a Thursday afternoon, carrying what I carry from the thirty cases before it, is the same human the framework assumed when it put me in the loop.

The framework does not ask which version of me showed up.

Which human?

Every framework got its human. And every human had a case.

The politician was the only one removable by the people the system affects. The billionaire was the only one who understood at depth what the system could and could not be trusted to do. The doctor had twenty years of pattern recognition no model fully replicates. The teacher was the only one who had sat with that child on that particular Monday. The judge had a structure built specifically to survive human fallibility. The home worker was the only one doing it at the scale it actually operates. The soldier was the only one who died if the system got it wrong. The imam was the accountability structure that already existed inside the community before any AI company arrived. The social worker was the only one who had been in the room.

Every case was real. Every case was right.

And every one of those humans was also fallible, variable, and on any given day unverifiable from the outside. The politician whose position shifted three weeks after the donation cleared. The billionaire whose private explanation for losing was that he didn’t pay enough. The doctor deferring to the model at the end of a fourteen hour shift. The teacher who found in the algorithm a confirmation of everything they already believed. The judge signing off on a score produced by software its own creator never designed for this purpose. The home worker on item three hundred and seventy eight of four hundred, at half past three on a Tuesday afternoon, making a decision that will never be reviewed by anyone. The soldier who confirmed the strike at hour nineteen of a nineteen hour operation, following rules of engagement written by lawyers six thousand miles away. The imam whose pastoral override has no appeals mechanism and no external review. The social worker on case forty one of forty one, carrying what forty cases of that work does to a person.

The frameworks do not ask who the human is. They do not ask what the human believed last Tuesday compared to this one. They do not ask what happened to the human between the role being assigned and the decision being made. They do not ask which version of that person showed up. They ask only whether a human was present.

Robert Mueller died on Friday.

Which human?

The platforms covered span six categories.

Social: LinkedIn, Facebook, Instagram, TikTok, X.

Creator: Substack, Medium.

AI Tools: ChatGPT, ChatGPT Edu (Institutional), Claude, Gemini, Microsoft Copilot.

Workspace: Google Workspace, Slack, Zoom, Notion.

Research and Academic: ResearchGate, Academia.edu.

Devices: Meta Ray-Ban Smart Glasses, Apple Ecosystem, Voice Assistants (Alexa and Google Home).

FREE GUIDE HERE

It is chosen with the platform’s interests in mind.

That is not a conspiracy. It is a business model. And it has been operating on you, across every device you own, in every app you have open, on the platform you are reading this on, without you reading the terms.

This piece is about what that actually means. Not in the abstract. In the specific. And at the end of it there is a guide, free to download, that covers 20 platforms, every setting worth changing, and the honest cost of every decision.

In September 2024

…two Harvard students built a tool called I-XRAY. They attached it to a pair of Meta Ray-Ban smart glasses and walked around a university campus. The tool combined the glasses’ camera with publicly available facial recognition software. In real time, it identified strangers. Not just their faces. Their home addresses, their phone numbers, and the names of their family members.

The recording indicator light on the glasses is small. Most bystanders never notice it. There is no consent mechanism. The person being identified has no idea it is happening.

In February 2026, a leaked internal Meta memo confirmed the company is building exactly this capability natively into the next version of the glasses. They are calling it “Name Tag.” The memo noted the launch should be timed for when civil society groups are “focused on other concerns.”

That is one end of the spectrum.

Here is the other end.

Since November 2025, LinkedIn has used your posts, your career history, and your profile to train its AI systems and feed Microsoft’s advertising machine. By default. The setting exists. Most users have never seen it. It lives at Settings and Privacy, then Data Privacy, then Data for Generative AI Improvement.

The toggle appears off on the page. But the data processing continues unless you also submit a separate Data Processing Objection form. Two steps. One visible. One not.

Both of those things, the glasses and the toggle, are privacy stories. But they are not the same kind. The glasses are a product decision made without you. The toggle is a transaction you agreed to without reading it.

Most privacy coverage treats these as equivalent failures. They are not. One requires legislation. The other requires a setting change and thirty seconds of your time.

This guide is about the second kind.

The problem with privacy advice is that it usually does one of two things.

It tells you to turn everything off, without telling you what you lose. Or it tells you the platform is terrible, without telling you what to actually do about it.

Neither is useful. Because privacy is not binary.

Turning off LinkedIn’s AI training means your writing stays yours. It also means the AI features that have learned your career voice go generic. That is a real trade. You should know about it before you make it.

Turning off Facebook’s Off-Facebook Activity tracking is one of the highest-impact privacy changes available. It also means every service you accessed via Facebook login now requires a separate account. That is a real cost. You should know about it.

Turning off Gemini’s Smart Features in Gmail stops Google’s AI reading your email. But there are two separate toggles. Most people find one and assume they are done. They are not.

The TikTok question is not really about settings at all. The 2026 privacy policy explicitly added precise GPS location collection. Biometric data is collected. ByteDance is subject to Chinese national security law, which requires cooperation with state intelligence services on request. The settings you can change are real and worth changing. But they do not change what TikTok is.

These are not equivalent risks. A tool that helps you understand the difference between them is more useful than one that treats every platform the same.

That is what this guide attempts to do.

For each of the 20 platforms it covers, it names the default trap: what the platform decided for you without asking. It names the trade: the honest reward for accepting that default, and the honest risk of doing so. And for every setting worth changing, it gives you the verified path, the genuine benefit of leaving it on, and the genuine cost of turning it off.

Every setting path was verified in March 2026.

A few things worth knowing before you read it.

On Facebook, the face recognition setting that appears in many privacy guides has been removed. Meta shut down the feature in November 2021 and deleted over a billion facial recognition templates. Any guide still listing it is out of date.

On Instagram, the end-to-end encrypted DM feature some users opted into is being permanently removed on May 8, 2026. Download your encrypted message history before that date. After May 8, Meta can read all Instagram direct messages.

On X, the Grok AI training opt-out exists only on desktop. It is not available in the mobile app. Millions of users who have only ever used X on their phones have never had access to it.

On Apple, Advanced Data Protection, the setting that end-to-end encrypts your iCloud backups, Photos, and Notes, was removed for UK users in February 2025, following a demand from the UK government under the Investigatory Powers Act. New UK users cannot enable it. UK iCloud data remains accessible to Apple and to UK authorities with a legal warrant. Any guide recommending this setting without that caveat is not written for a UK audience.

On Claude, the AI assistant you may be using to draft strategy, summarise documents, or work through client problems, the September 2025 terms update introduced an opt-in training toggle for Free, Pro, and Max accounts. Opting in extends data retention from 30 days to 5 years. A 60x increase. If you accepted the updated terms without reading them, check Settings, then Privacy, then Help improve Claude.

The goal of this guide is not maximum privacy.

Maximum privacy means leaving every platform, disabling every feature, and accepting every cost. For most people that is not realistic or desirable. LinkedIn reach matters. Gmail Smart Compose saves time. ChatGPT memory makes the tool more useful. These are real benefits and the guide treats them as such.

The goal is informed choice. To know what the deal is before you accept it. To understand what you gain by leaving a setting on, and what you lose by turning it off. To make the decision consciously rather than by default.

Every platform covered in this guide made a choice about where to set the starting point. That choice was not made with your interests in mind. It was made with theirs.

The guide is an attempt to give you the information you need to decide whether their starting point is also yours.

Download the full guide below. It is free.

If you find it useful, the most useful thing you can do is share it with colleagues, with your team, with anyone who uses these platforms and has never thought about what they agreed to.

And if you want more of this: forensic, verified, no flannel. discarded.ai tracks the gap between what AI companies promise and what they actually do. Subscribe free. New pieces when there is something worth saying.

[DOWNLOAD: Your Privacy is a Compromise | discarded.ai | Settings verified March 2026]

discarded.ai

Tracking the gap between AI promises and AI reality.

The UK government’s defence of its Palantir contracts rests on data ownership. In 2017, Palantir argued in a documented commercial dispute that ownership of data and ownership of what can be inferred from it are two different things. The platforms at the centre of that dispute are the same platforms now running inside the Ministry of Defence. The Swiss army reviewed the same technology and rejected it on national security grounds. The UK signed a £1.5 billion deal four months later.

Contents

• The New York dispute

• What the MoD signed

• The inference problem

• The Swiss rejection

• What neither response addresses

• What the article does not ask

The New York dispute

You have to understand what was actually being claimed in New York in 2017, because the government is counting on you not knowing, or not caring, or assuming that what happened in a police department in America has nothing to do with the platforms now sitting at the centre of British national defence.

The New York Police Department cancelled its Palantir contract. Palantir responded by claiming the analysis produced by its platforms was its own intellectual property. Not the data the city had fed in. The insights derived from it. The platforms at the centre of that dispute were Gotham and Foundry. They are the same platforms now running inside the UK Ministry of Defence, the NHS, and critical national infrastructure under contracts worth at least £670 million.

This is not an allegation. It is a documented commercial dispute reported at the time. It established that Palantir draws a distinction between data and the insights produced from it, and that on prior evidence it considers those insights its own.

The full investigation by Charlie Young and Carole Cadwalladr was published by The Nerve on 13 March 2026. Read it here.

What the MoD signed

Defence minister Luke Pollard told the House of Commons in January:

It is a statement that assumes the question being asked is about ownership. It is not. It has never been. And the people who built and deployed the technology the minister was describing know that, which is why two senior MoD systems engineers went on record with The Nerve last week and said what ministers apparently could not bring themselves to understand.

“Ministers clearly have a lack of understanding of Palantir’s technology. The statements with respect to sovereign data appear to be missing the point entirely. They’re missing the realities of data scraping, of aggregation, and the fact that Palantir is building its own rich picture of our nation that they can use for their own ends.”

The MoD’s contractual framework addresses ownership of data. It says nothing about ownership of what can be learned from it. These are not the same protection. They have never been the same protection. The government signed as though they were.

The inference problem

One source gave a concrete example, and it is worth sitting with because it is the kind of example that sounds technical until you understand what it means, and then it does not sound technical at all.

A parcel leaves a defence supplier carrying a NATO part number, an address, and an arrival date. Each piece of information is individually unclassified. Combined, they reveal that a nuclear submarine will be in a specific location on a specific date. That combined inference is classified. The government’s contracts cover the raw data. They say nothing about what can be derived from it. The same source described the government’s position this way:

A second source, with a background in intelligence, told The Nerve:

“A complete profile on the whole UK population. They have visibility into wildly different focus areas, yet their data is all condensed into one foreign supplier’s control.”

What the article reports but does not calculate is the combined surface area of that access. Defence, health, roads, power networks, major industrial infrastructure. The submarine example is one illustration of what becomes possible when those datasets are combined. It is not the limit of what is possible. That calculation has not been made public by anyone inside government.

The Swiss rejection

The Swiss army reviewed Palantir’s technology. They produced an official report. They named the possibility that sensitive data could be accessed by the US government and intelligence services as a key concern. Palantir’s head of UK operations made numerous approaches, including a personal pitch.

The Swiss army said no.

You are entitled to ask what the Swiss army understood that the UK government did not, and you are entitled to ask why the specific content of the UK procurement review that reached a different conclusion does not appear to be public. The UK defence secretary signed a £1.5 billion deal four months after the Swiss report was published. The photographs of the signing exist. The press release exists. The review that justified a different conclusion from the one the Swiss army reached does not appear to exist in any form the public can examine.

What neither response addresses

The MoD did not respond to The Nerve’s press inquiries. Palantir called the claims entirely false in a single sentence. Neither response addresses New York.

Palantir is currently building the deportation infrastructure for ICE, running data operations for DOGE, and supporting US military operations in multiple theatres. It is a company whose political alignment to the current US administration is public and documented, operating at the centre of UK national infrastructure at a moment when that administration has demonstrated, repeatedly and without apparent embarrassment, that allies and leverage are not always treated as different categories.

Jim Killock of the Open Rights Group told The Nerve:

What the article does not ask

The Nerve piece is careful about what it claims directly and what it leaves as inference. It establishes capability and proximity. It does not establish confirmed extraction or transfer of insights to the US government. That distinction matters and the piece is honest about it.

What it does not ask is who in UK procurement reviewed the same technical documentation the Swiss army reviewed, and when, and whether that review addressed the inference problem at all. It does not name anyone inside government who was warned and when. It does not examine whether GCHQ or the National Cyber Security Centre conducted a technical review before the contracts were signed. It does not ask what recourse the UK has if it decides to cancel, and whether the NYPD precedent means that cancellation would trigger a claim over the insights already produced.

Duncan McCann of the Good Law Project told The Nerve:

“A hallmark of almost every Palantir engagement is an attempt at secrecy, obfuscation. We really do not have the legal architecture to defend against this kind of big tech. The regulators are asleep at the wheel.”

The government is using the word sovereign to mean ownership of data. In New York in 2017, Palantir argued in a documented dispute that ownership of data and ownership of what can be learned from it are two different things. That argument was made using Gotham and Foundry. Those platforms are inside British national defence today, and the contract protecting against that argument was written as though the argument had never been made.

Discarded.AI tracks the gap between what AI companies say and what they actually do. If this piece was useful, forward it to someone who should read it. If you are not yet a subscriber, you can fix that below.

TL;DR

Anthropic sued the Pentagon last week. Two AI companies raised a billion dollars each. One of them has a product. Meta is considering cutting 16,000 people. Oracle may cut 30,000. GPT-5.4 arrived and got on with it.

The War in Iran focused the eyes on AI in the battlefield.

Contents

• This Week

  • Anthopic and DoW: The language model enters the courtroom

  • LeCunn and Fie-Fie Li: A billion dollars each. Only one receipt.

  • The glasses are watching.

• What the tech bros are doing

• Model releases

• Reading - Army of None

• Person to follow - Stacie Pettyjohn

This week

The line Dario Amodei would not cross A billion dollars each. Only one receipt. What world models actually are, and why everyone suddenly wants one The layoffs that AI is paying for GPT-5.4, Gemini Flash Lite, and DeepSeek’s empty chair

Anthopic and DoW: The language model enters the courtroom.

On 9 March Anthropic files two lawsuits. One in the US District Court for the Northern District of California. Another in the DC Circuit Court of Appeals.

The claim is simple but unusual. The Department of War labelled the company a supply chain risk.

Anthropic says the designation is retaliation for speech protected by the First Amendment.A phrase used for hostile states is now applied to a domestic AI laboratory.

The case moves quickly.

A federal judge in San Francisco advances the preliminary injunction hearing to 24 March, noting that the dispute carries consequences for both sides. During the exchange the government’s lawyer is asked whether any further action against the company will occur before the hearing.

He cannot offer that assurance.

The arguments begin to assemble around the case.

Thirty seven researchers from OpenAI and DeepMind sign a brief supporting a competitor.

Their warning is not about Anthropic alone. They argue that a supply chain designation could damage American competitiveness and discourage public debate about the risks of artificial intelligence.

Microsoft files separately. The company describes a different concern.

Military systems have already been built around Anthropic’s technology. Removing that component, they argue, would produce severe economic disruption.

Another group appears. Retired military leaders and former intelligence officials, including Michael Hayden, who once directed the CIA.

Their argument is institutional rather than technical. They say the conduct of the Defense Secretary threatens principles of the rule of law that have long governed the American military.

A strange coalition forms. Rival laboratories. Software companies. Former intelligence chiefs.

All orbiting the same question.

When artificial intelligence becomes part of the military supply chain, who decides the limits of its use?

The answer will not come from the laboratory.

The hearing is set for 24 March.

LeCunn and Fie-Fie Li: A billion dollars each. Only one receipt.

Yann LeCun left Meta, moved to Paris, and raised $1.03bn. Nvidia backed it. So did Jeff Bezos, Temasek, Samsung. The company is called AMI Labs. It is less than six months old. No product. No revenue. No timeline for either. The CEO said it could take years before the research produces anything commercial.

They still got the billion.

Three weeks earlier, Fei-Fei Li’s World Labs raised the same amount. Autodesk put in $200m. AMD, Nvidia, Fidelity came in alongside. World Labs has a product called Marble. It builds editable 3D environments from a text prompt or an image. Free and paid tiers. It has users.

The coverage was not the same. You couldn’t miss one and probably didn’t hear of the other.

Both companies are building world models. AI that learns by observing how physical reality behaves, not by consuming language. The argument is that text alone cannot produce genuine intelligence. The world has geometry, physics, time. A model trained only on words will never really understand any of those things.

LeCun has been making this argument for years. He is probably right. Whether being right and having a billion dollars is enough is a different question.

Fei-Fei Li is not waiting to find out. She has already built something.

You may have noticed whose raise made the front pages.

From Discarded.AI: Link

The glasses are watching.

Meta sold seven million pairs of Ray-Ban AI glasses in 2025. The marketing said: designed for privacy, controlled by you.

An investigation published on 27 February by two Swedish newspapers, Svenska Dagbladet and Göteborgs-Posten, found something else.

Footage captured by the glasses moves through servers in Luleå and Denmark and arrives in an office in Nairobi, where workers employed by a subcontractor called Sama open it and label what they see.

One annotator described the work simply. We see everything, they said. From living rooms to naked bodies.

Workers described footage of people using the toilet. People undressing. One account of a man leaving his glasses on a bedside table, his partner walking in and changing, unaware. Bank cards. Intimate conversations. The blurring of faces, which Meta says is automatic, does not always work. Particularly in low light.

The workers operate under confidentiality agreements they cannot break without losing their income. Personal phones are not permitted in the office. Cameras watch the room. You are not supposed to ask questions, one worker said. If you start asking questions, you are gone.

A class action lawsuit was filed in San Francisco days after the investigation published. The UK’s Information Commissioner’s Office wrote to Meta requesting answers.

Meta’s response referred journalists to its terms of service.

[Link to Svenska Dagbladet investigation] [Link to class action lawsuit]

Your words here, in this register. A fact. A gap. Another fact at an odd angle to the first.

What the tech bros are doing

Two companies. Two sets of numbers.

Meta is considering cutting up to 20% of its workforce. Around 16,000 people. No date. No final number. A spokesperson called the Reuters report speculative reporting about theoretical approaches.

Zuckerberg is spending $600bn on data centres by 2028.

Oracle announced cuts of between 20,000 and 30,000 jobs. The same week it posted strong earnings. The stock went up. The company is carrying $108bn in debt. Raised to fund a $50bn data centre buildout.

Someone has to pay for the infrastructure.

Model releases

GPT-5.4: OpenAI, 5 March. Stronger at agentic work, tool use, and coding. Replaces GPT-5.2 Thinking for paid users.

Gemini 3.1 Flash Lite: Google. 2.5 times faster than earlier versions. $0.25 per million input tokens.

DeepSeek V4: Still not here. Expected multimodal. Every predicted window has passed without a release.

Reading

Army of None Paul Scharre

Scharre spent years inside the Pentagon before he wrote this. The question he kept asking was a simple one.

When a machine decides to kill someone, who is responsible.

Not in the legal sense. In the human sense.

The book was published in 2018. It has not dated.

Person to follow

Stacie Pettyjohn, linkedIn: CNAS.ORG

Senior Fellow and Director of the Defence Program, Center for a New American Security.

She spent a decade at RAND before joining CNAS. Her subject is how wars are actually fought, as opposed to how they are planned.

This month she co-authored the Hellscape report. A proposal for Taiwan to defend itself using dense swarms of autonomous drones. Without waiting for American forces to arrive.

She is also writing on the Anthropic dispute.

Two threads. One question.

Find her at cnas.org

Events

Next week I start my Bluedot.org: Technical Safety course

If this newsletter is useful, the Wednesday edition goes further. The analysis behind the stories, the context that did not fit here, and the things that did not make the free edition. Paid subscribers get that every week.

Subscribe now

March 2026

Tuesday is the day I start my next Bluedot impact course:

• Technical AI Safety

Before I start - I recommend Blue.dot training to everybody. The courses are facilitated and only require a donation at the end of the course.

This article is on Technical AI Safety course: Please note Bluedot recommend attending the AGI Strategy course first which I completed in February 2026

Each week I will summarise progress and reading and perhaps you too may decide to apply for this course.

The AGI strategy course focused on the question: “How do we make AI go well?”

On the course, you identified the future you’re working toward and understood the key dynamics:

• Drivers of AI progress: compute, data, algorithms

• Threat pathways: power concentration, gradual disempowerment, catastrophic pandemics, critical infrastructure collapse

• Plans for making AI go well: government control over AGI, hand over control to aligned superintelligence, build defences and diffuse AI

• Layers of defences to build: prevent dangerous AI actions → constrain dangerous AI capabilities → withstand dangerous AI actions

This course focuses on defining what AI systems we are building and how.

You will gain the technical foundation to understand what it will actually take to make AI systems safer – and why it’s so challenging.

Throughout the rest of the course, I will:

• Diagnose why making AI safe is technically challenging

• Evaluate current safety techniques: what works, what doesn’t, where the gaps are

• Build your own “kill chain” showing how defences might break

• Identify the most promising intervention point for your contribution

• Leave with a fundable action plan to start shipping

What this course isn’t

Though important for making AI go well, Bluedot will cover the following in a separate course:

• AI policy details: though you’ll gain the technical grounding for effective AI governance

• Compute governance: hardware verification and tracking deserve their own deep dive

• AI security: e.g. preventing model theft or escape

• ML basics: complete our AI foundations modules first if you need them

Let’s start with the question: “How might we build safe AI?”

Many of you found me through LinkedIn. Some of you bought the first book.

I know that for some people, the blank pages landed wrong. That was not what I intended, but intention is not the same as impact. Point taken.

What I learned from it is this: people are busy. When they come looking for help with AI, it is rarely because they lack confidence or capability. It is because they want someone they trust to point them in a useful direction. That is a reasonable thing to want.

So I am going to write a book that does that. My view of AI. What to read. Who is worth following. Where to start and why. Not because you could not work it out yourself, but because a good guide saves time, and saving time is the whole point.

I want to write it with you.

Drop me a question in the comments. Something you actually want answered. The questions shape the chapters. At the end of this, there is a free book.

That is all I am asking for.

Alan

The Collaborative BOOK

Another busy week on Discarded.AI. Here is everything that went out, in case you missed any of it.

Essays

LinkedIn Is Not Your Inbox. But It Should Be. A cautionary tale about what happens when outreach scales faster than the ability to respond. https://www.discarded.ai/p/linkedin-is-not-your-inbox-but-it

This Book Will Make You an AI Expert After months of work, it is finally here. https://www.discarded.ai/p/this-book-will-make-you-an-ai-expert

The Wrong Architecture Yann LeCun has spent years arguing that the current approach to AI is fundamentally flawed. Here is why that matters. https://www.discarded.ai/p/the-wrong-architecture

Anthropic Measured What AI Is Actually Doing to Jobs. Here Is What the Data Says. The research is real, the methodology is honest, and the gap between what the CEO says and what the economists found is worth reading carefully. https://www.discarded.ai/p/anthropic-measured-what-ai-is-actually

AI Warfare Library - The book reviews

4. Warbot: Kenneth Payne, 2022 https://www.discarded.ai/p/04-warbot

5. The Kill Chain: Christian Brose, 2020 https://www.discarded.ai/p/the-kill-chain

LinkedIn

Yann and Fifi heavily funded for World Models

Meta and Rayban time to be scared

Anthropic Labour market analysis

The Expert Guide to being an Expert in AI - My new book

Read more

Comment EXPERT. Comment CLAUDE. Comment FREE. Your company trained you to recognise this. LinkedIn told you it was networking.

Contents

1. We are all too busy

2. Recognise any of these?

3. The mechanic is not new

4. How to spot it

5. The honest version

6. LinkedIn is not your inbox. But it should be.

We are all too busy

We are all too busy. Too busy to keep up with every new regulation, every new tool, every new development. So when something promises to consolidate everything you need to know, you click. Of course you do. We all do.

Your company spent thousands training you not to do exactly that.

Recognise any of these?

Comment EXPERT

Comment CLAUDE

Comment FREE

Comment YES

Comment GUIDE

Comment TOOLKIT

Comment TEMPLATE

Repost for priority access

Like to unlock

Follow for the framework

Tag someone who needs this

Share to receive

You know these. You have clicked them. Most people reading this have clicked at least one in the last week.

That is not a criticism. It is the point.

The mechanic is not new

Phishing works because it borrows the visual language of trust. It looks like your bank. It looks like your IT department. It looks like a colleague. The ask feels small. The reward feels real. The cost of clicking feels low.

LinkedIn uses the same architecture. The person looks credible. Their headline is impressive. They have tens of thousands of followers. The free thing they are offering sounds like exactly what you need. The ask is a single word in the comments.

Here is a post that appeared in my feed this week. I have removed the name because the name is not the point. The pattern is the point:

BYE-BYE LinkedIn outreach... [AI tool] books 2-5 meetings/day on AUTOPILOT. For the past 2 years... EVERY single outreach tool tried adding AI to sequences. And they ALL failed. Because they solved the WRONG problem... It’s like having a top 1% sales rep working 24/7. No generic templates. No delayed responses. No effort from you. Just 2-5 qualified meetings/day on your calendar. Want to see how you can implement it in your business? 1. Connect with me 2. Comment [WORD]

The product being sold is an AI outreach tool. The mechanic to receive information about it is to perform a public action that generates reach, signals demand, and builds an audience for the next post. You are not getting something for nothing. You are paying with your attention and your implied endorsement.

How to spot it

At work you are trained to pause before you click. You check the sender. You ask whether the ask makes sense. You look for the mismatch between what is being offered and what the sender normally does.

Do the same here.

Read their headline. What do they actually sell? Does the free resource they are offering align with what they sell for money, or does it only exist to generate the comment mechanic? Is the post designed to help you or to generate reach, data, and the appearance of demand?

If a person can genuinely help you they will have a conversation with you. They do not need you to perform an action first. The ones who know their subject are findable. Their posts make an argument. Their comments add something. They do not need 1,900 people to type a word to prove they exist.

The honest version

Yesterday I published a book called This Book Will Make You an AI Expert and asked people to comment EXPERT to receive it. 120,000 people saw it. 2375 commented in under 24 hours

The book is not a shortcut. It is an argument that the shortcut does not exist. The blank pages are the point. The prompt that does your thinking does not exist. The strategy no one else has is yours to build. The hack is you.

One reader told me it felt like a phishing exercise. She was an AI governance specialist with serious credentials. She fell for the mechanic, read the book, and understood the argument immediately. Her words: if this had been a phishing exercise, I would have failed.

She was right. And that was the point.

LinkedIn is not your inbox. But it should be.

The tactics that would trigger every corporate security filter in your email land without friction here every single day. LinkedIn feels safe because it looks professional, because you know the sender, because it resembles a conversation between peers.

That is exactly why it works.

The training you already have applies here too. Pause. Check the sender. Ask what they are actually getting from you. The people worth following do not need you to perform an action to prove it.

See Link to book: I do hope you like it.

Everything you need to know about AI in one place. The prompts that do your thinking. The strategy no one else has. The cheat code for understanding AI. The template for sounding informed. The shortcut to expertise. The hack everyone is missing. The vault.

All of it. Nothing held back.

I wrote this because I kept seeing the same thing. People searching for the shortcut. The framework that would finally make it click. The prompt that would do the thinking for them.

This is the book I wish I had when I started.

Free for Discarded.AI subscribers this week only.

There are two books that are the same:

• ‘The Book’ is more subtle

• ‘The Alternative Version’ is less subtle

Download 'The Book'

Download 'The Alternative Version'

If you enjoy what I write feel free to subscribe to my Substack discarded.ai

In this piece:

• What everyone else is building and why it works

• Why LeCun thinks the foundation is wrong

• What world models actually are

• The case for — why this could matter

• The case against — why it might not

• What the money actually means

What everyone else is building

The dominant architecture in AI right now is the transformer. It was introduced by Google researchers in 2017 in a paper called Attention Is All You Need. Almost everything you interact with in AI today — ChatGPT, Claude, Gemini, Copilot — is built on some version of this architecture.

The core idea is prediction. You train a model on vast amounts of text. The model learns to predict what word comes next. Do this at sufficient scale with sufficient data and something remarkable happens — the model appears to understand language, reason about problems, write code, summarise documents, answer questions.

The operative word is appears.

LeCun’s argument is that what these models are doing is not understanding. It is pattern matching at extraordinary scale. And pattern matching, however sophisticated, has a ceiling.

Why LeCun thinks the foundation is wrong

LeCun’s critique has three parts.

First, language is not the source of intelligence. It is the output of it. Humans develop an understanding of physical reality — causality, object permanence, gravity, the consequences of actions — before they develop language. A child understands that a ball dropped from a height will fall before they have words to describe it. LLMs have no equivalent grounding. They know the word “fall” in every context it has ever appeared in text. They do not know what falling is.

Second, the architecture cannot be made reliable. Hallucination is not a bug that can be patched. It is a structural consequence of training on language without grounding in reality. The model produces plausible text. Plausible and true are different things. In most consumer applications this is manageable. In healthcare, industrial automation, and any safety-critical environment, it is disqualifying.

Third, LLMs cannot plan. They can simulate planning in text. They cannot model the consequences of actions in the real world, reason about them, and select a course of action accordingly. This limits their usefulness as autonomous agents in physical environments.

What world models actually are

LeCun’s alternative is built around what he calls JEPA — Joint Embedding Predictive Architecture — proposed in 2022.

The core insight is this. Real-world data — from cameras, sensors, physical environments — is continuous, high-dimensional and noisy. Much of it is unpredictable. A generative model trained to predict exactly what happens next in a physical environment will fail, because much of what happens next cannot be predicted.

The solution is to stop trying to predict the unpredictable details and instead learn abstract representations. What matters is not the exact pixel configuration of a scene but the structure underlying it. A world model learns to represent that structure and make predictions at the level of abstraction, not the level of raw data.

Action-conditioned world models go further. They allow an AI system to model the consequences of its own actions — to ask, in effect, “if I do this, what happens?” — and to plan sequences of actions accordingly. This is closer to how human cognition actually works. We do not generate plausible descriptions of what we might do. We model outcomes and choose between them.

AMI’s goal is to build systems that understand the real world in this sense. The first disclosed application is healthcare, through a partnership with Nabla. The broader targets are industrial process control, automation, wearable devices and robotics.

The case for

If LeCun is right, the current stack has a structural ceiling it will never clear.

The applications that matter most — surgery, industrial automation, autonomous vehicles, anything where a wrong answer has physical consequences — require reliability that LLMs structurally cannot provide. Not because they are not powerful enough. Because they are not grounded enough.

World models, if they work, solve this at the architecture level. A system that models physical reality, reasons about consequences, and plans actions accordingly is not producing plausible outputs. It is modelling outcomes. The reliability comes from the foundation, not from adding safety layers on top of an unreliable one.

The investor list suggests some of the most sophisticated technology investors alive believe this is possible. Nvidia makes the chips that run both architectures. Toyota needs autonomous systems that work in physical environments. Bezos Expeditions, Eric Schmidt, Samsung — none of them missed the LLM wave. They funded it. They are still running it. And they wrote a cheque for the thing designed to replace it.

The case against

This has been five years away for a long time.

LeCun has been making this argument publicly since at least 2022. JEPA is a theoretical framework, not a shipped product. AMI’s own CEO Alexandre LeBrun is explicit about the timeline. This is fundamental research. It could take years before it becomes a commercial product. There is no revenue plan.

Meanwhile LLMs keep improving. Scaling laws have not hit a wall yet. The architecture LeCun says is wrong keeps getting less wrong with each generation.

There is also a track record question. LeCun spent years at Meta arguing this position while Meta built LLMs. The argument did not stop Meta. It did not stop OpenAI, Google or Anthropic. The research community has not converged on his view. AMI’s own CEO acknowledged that in six months every company will call itself a world model company — which is another way of saying the terminology will be captured before the technology is proven.

What the money actually means

$1.03 billion is not a research grant. It is the largest seed round in European history. The investors are not philanthropists. They expect a return.

But the investor list is also a hedge. The same people backing the current LLM stack are now backing its potential replacement. That is rational portfolio construction. It does not tell you who is right. It tells you the people with the most information are not certain enough to bet only one way.

LeCun left Meta to build this. He has the funding, the team and no constraints. The question he now has to answer is not whether the architecture is better. He has been making that argument for years and nobody stopped building the wrong thing.

The question is whether he can ship it before the wrong thing gets good enough.

• What Anthropic’s Jobs Research Actually Says

• What they actually built

• The O-ring problem nobody wrote about

• The finding that got the least coverage

• How subjective is this research?

• The Amodei problem

• Why publishing this matters beyond the findings

What Anthropic’s Jobs Research Actually Says

Most coverage missed the three things that matter.

Anthropic published labor market research on 5 March 2026. It went viral, got summarised badly in most places, and the three findings that actually matter were either buried or ignored entirely.

The paper is here: anthropic.com/research/labor-market-impacts. The authors are Maxim Massenkoff and Peter McCrory. Read it before drawing conclusions, because the headline most people ran with AI has had almost no impact on jobs is technically accurate and substantially misleading.

What they actually built

Most research on AI and jobs starts with a question: could a language model theoretically do this task? The answer, across most white-collar work, is yes. That produces alarming charts and gets cited in think pieces. It also tells you almost nothing about what is happening right now.

Massenkoff and McCrory asked a different question. They took the O*NET database, which maps around 800 US occupations to their constituent tasks, crossed it with existing research on theoretical LLM capability, and then filtered both through actual anonymised Claude usage data from the Anthropic Economic Index. The result is a new metric they call observed exposure. Not what AI could do to your job. What it is doing.

The gap between those two things is large and consistent across every white-collar category. Computer and math: 94% theoretical, 33% actual. Office and admin: 90% theoretical, 38% actual. Legal: 88% theoretical, 20% actual. Business and finance: 94% theoretical, 28% actual.

This is the chart that went around on LinkedIn and X, mostly shared as reassurance. The framing was: AI is nowhere near doing what it is theoretically capable of. The subtext was: relax.

That is the wrong reading. The gap is not a comfort and smiles. It is a trajectory.

The O-ring problem nobody wrote about

The paper cites a 2025 working paper by economists Gans and Goldfarb on what they call the O-ring model of jobs. The original O-ring theory, from economist Michael Kremer in 1993, argued that in production processes where all tasks need to be completed to a high standard, the weakest link determines the output. One failed component brings down the whole system.

Applied to AI and employment, the implication is specific and important. If jobs work like O-rings, then employment effects may only become visible when AI reaches all of the tasks in a role, not just some of them. A lawyer whose job involves drafting contracts, advising clients, appearing in court, and managing relationships is not at risk when AI can handle the drafting. The system holds until coverage is high enough across all components.

33% task coverage in computer and math does not mean 33% of that workforce is currently at risk. It may mean the signal will not appear in unemployment data until coverage crosses a threshold that makes the remaining human tasks structurally unviable. At which point the effect will look sudden even though it was not.

The authors are explicit that their framework is most useful when effects are ambiguous. The current absence of a mass unemployment signal is not evidence that nothing is happening. It is evidence that the methodology is working as designed, establishing a baseline before the numbers become undeniable.

The finding that got the least coverage

Figure 7 of the paper tracks monthly job-finding rates for workers aged 22 to 25 entering high-exposure versus low-exposure occupations. Worth noting: Anthropic corrected Figure 7 on 8 March, three days after publication, because the labels on the two series had been reversed. The underlying finding did not change.

The series diverge visibly from 2024. Job-finding rates in low-exposure occupations hold steady at around 2% per month. Entry into high-exposure roles falls by roughly half a percentage point. The averaged estimate across the post-ChatGPT period is a 14% drop in job-finding rates in exposed occupations compared to 2022. The authors describe this as just barely statistically significant. There is no equivalent signal for workers over 25.

What this means in plain terms: nobody is getting fired. The entry point is narrowing. Senior staff are staying. The work that would previously have gone to junior employees is being absorbed without those positions being filled. Many of the young workers who do not get hired simply exit the labour market rather than register as unemployed, which is why aggregate unemployment data does not catch this.

The paper also shows that the workers most exposed are more likely to be female, more educated, and higher paid. Women are 16 percentage points more likely to be in the most exposed quartile than in the zero-exposure group. Workers with graduate degrees make up 17.4% of the most exposed group, compared to 4.5% of the unexposed group. For every 10 percentage point increase in observed exposure, BLS projected job growth through 2034 falls by 0.6 percentage points. That correlation does not exist when using theoretical exposure measures alone. Only the real usage data produces it.

This is not the automation story most people pictured. The narrative was blue-collar work first, physical labour, manufacturing, delivery drivers. What the data shows is that the first visible effects are concentrated in screen-based, text-heavy, credential-intensive work, and they are showing up at the point of entry, not in the existing workforce.

Read more

Author Profile: LinkedIn Profile

Categories: CHINA · ESSENTIAL · POLICY · PENTAGON · DOCTRINE · USA

Please note the Where to Buy :- is not an affiliate link it is just designed to be helpful.

01 - Army of None - Paul Scharre

02 - The Four Battle Grounds - Paul Scharre

Author Profile: LinkedIn Profile

Categories: CHINA · ESSENTIAL · POLICY · PENTAGON · ECONOMICS · USA

Please note the Where to Buy :- is not an affiliate link it is just designed to be helpful.

01 - Army of None - Paul Scharre

What Are Guardrails Actually For?

Put yourself in a room with your generals. You are the Minister of War. The briefing is simple: your adversary has deployed autonomous weapons systems with no ethical constraints, no rules of engagement baked in, no limits on target identification. They built weapons designed to win, and morality was the first thing they removed to make them faster.

Your advisers tell you that to compete, you need to do the same.

Before you sign anything, your generals have some questions.

The speed problem

The US and Israel struck nearly 900 targets in Iran in the first twelve hours of Operation Epic Fury. That operational tempo would have taken days in any previous conflict. The AI systems driving target identification made it possible. Speed was the point. Human review at that scale was, by definition, perfunctory. Researchers studying the process were direct about it: even with a human technically in the loop, the review of machine decisions at that pace is essentially ceremonial.

Which raises the first question your generals want answered. When your system is running at a tempo no human can genuinely oversee, who is accountable for what it decides? The guardrails that slow a system down and force verification exist because speed without accuracy is not a military advantage. It is a liability.

The friendly fire problem

On March 2, 2026, three US F-15Es were shot down over Kuwait. Not by Iran. By Kuwaiti air defenses, operating in a sky saturated with Iranian drones and missiles, misidentifying allied aircraft as threats. All six crew members survived. The incident is the second reported case of US fighters coming under friendly fire in the Middle East in fifteen months.

This is not an argument against air power. It is an argument about what happens when the environment is complex, the tempo is high, and the systems making identification decisions are operating without adequate constraints on what they flag as hostile. Guardrails on target identification were not written to protect the enemy. They were written so your own pilots come home.

The civilian target problem

In southern Iran, a strike killed at least 150 people, many of them schoolgirls. The UN called it a grave violation of humanitarian law. Israel’s AI targeting system Lavender, used extensively in Gaza before this conflict, was documented to be wrong at least ten percent of the time. At the scale of thousands of targets, ten percent is not an acceptable error rate. It is a catastrophe that happens automatically, at machine speed, before anyone can intervene.

Your generals want to know: at what point does the reputational, legal, and political cost of strikes like that one outweigh the operational advantage of speed? Guardrails on civilian target identification are not there because your government cares more about the other side’s children than winning the war. They are there because an AI system that cannot reliably distinguish a school from a military installation is not a precision weapon. It is a blunt instrument that happens to move fast.

The escalation problem

Iran launched attacks on 27 US bases across the Middle East. Every ally in the region scrambled air defenses. Bahrain’s international airport was targeted. Residential buildings in Manama were struck. The conflict, which began as a targeted military campaign, expanded across an entire region within days.

Here is what your generals need you to understand about escalation in an AI-assisted conflict. In simulated war games designed to mirror real strategic scenarios, AI models from Anthropic, OpenAI, and Google chose to escalate to nuclear options in 95% of cases. Not because they were programmed to. Because under pressure, with no human judgment in the loop, the logic of threat response compounds faster than anyone anticipated.

Guardrails on autonomous escalation are not a sign of weakness. They are the off switch. Remove them and you are not building a weapon you control. You are building a process you started.

The question your advisers cannot answer

The case for removing guardrails was always the same. Your enemy has none, therefore you cannot compete with yours. It treats guardrails as a handicap in a race.

But look at what the first week of the Iran conflict actually produced. Friendly fire. A mass civilian casualty event the UN had to formally condemn. A conflict that expanded faster than any political process could manage. An AI system used on the battlefield hours after the government publicly banned the company that built it — because by that point, nobody was entirely sure how to stop using it.

The Minister of War who stripped the constraints to compete did not make a careful strategic calculation. They made an assumption: that their adversary’s lack of guardrails was the right standard to aim for.

What the evidence suggests is something different. The adversary’s lack of guardrails is not an advantage to match. It is a mistake to avoid.

The grey area is not whether to have guardrails. It is who gets to define what they are, and whether the people removing them understood what they were removing in the first place.

Something fundamental changed in how wars are fought and most people missed it.

Not because the information wasn’t there. Because there was too much of it, scattered across too many books, written by too many people from too many different angles — soldiers, philosophers, engineers, lawyers, journalists, spies.

The AI warfare literature is vast, fragmented, and largely unnavigable if you don’t already know where to look.

I've spent the last few years watching AI move from boardrooms to battlefields and noticed that most of the people making decisions in both spaces hadn't read the same books. Soldiers who hadn't read the technologists. Technologists who hadn't read the strategists. Strategists who hadn't read the ethicists. Everyone was working from an incomplete picture. I built this library because the map didn't exist and somebody needed to make it.

So I built a map

1. What the AI Warfare Library is

2. Why Six Scores

3. What’s inside

4. How it publishes

5. Who is this for

What the AI Warfare Library is

120 books. Every significant work on autonomous weapons, drone warfare, cyber operations, great power competition, AI safety, and the ethics of machine-speed conflict — curated, scored, annotated, and connected to each other.

Not a reading list. A navigation system.

The difference matters. A reading list tells you what exists. A navigation system tells you where to start, how deep to go, what connects to what, and which books are essential versus which are interesting. This library does all of that.

Each book gets a three-page card.

Page 1 — The Card. Visual identity, author credentials, and six scores. Scannable in seconds. Designed to be shared as a standalone image. One glance tells you what the book is, who wrote it, and how it ranks against everything else in the library.

Page 2 — The Brief. The book’s core argument in one paragraph. Four things you will concretely learn. And exactly how it connects to four other books in the library. Objective. No opinion. Pure reference — designed so that reading five Page 2s on the same topic gives you a complete briefing on that subject from multiple angles.

Page 3 — The Take. The historical moment the book was written into. The events it anticipated and the ones it missed. And my honest assessment — what the argument got right, what reality has since overtaken, and who needs to read it right now.

Why six scores

Most recommendations tell you a book is good. These scores tell you how to use it.

Every book in the library is rated across six criteria on a scale of 1 to 10.

Readability — how accessible is this to a non-specialist? Highest score means start here. Lowest means you need to build up to it.

Influence — what impact has this had on doctrine, policy, and the field? Highest score means this is what everyone else is arguing with. It’s the text you need to understand the conversation.

Authenticity — does the author have standing to write this? There is a significant difference between a former Army Ranger turned Pentagon policy official and an Oxford philosopher theorising from the outside. This score makes that visible.

Originality — did the author say something nobody had said before? Did they coin a framework the field now uses? Or are they synthesising existing ideas competently?

Provocation — does reading this force you to reconsider a position you hold? The highest scoring books here are the ones that challenge assumptions you didn’t know you had.

Relevance — how connected is this to what is happening right now? A book written in 2018 that anticipated Ukraine scores differently to one that didn’t, regardless of when it was published.

Filter by topic. Use the scores to decide what to read first, what to read deep, and what you can skip.

What’s inside

14 categories covering the complete terrain of AI-enabled conflict:

Essential Canon — the 10 books every other book in this library argues with. Start here.

Drone Warfare — from the first Predator deployment to Ukraine swarm warfare. The full arc.

Autonomous Systems & Automation — how automation works, how it fails, what happens when machines make kill decisions at speed.

Great Power Competition — the US-China-Russia AI arms race at the strategic level. Who is winning, what they are building, what the balance of power actually looks like.

Cyber Warfare — Stuxnet, Sandworm, Volt Typhoon. The technical layer of AI-enabled conflict.

Information & Cognitive Warfare — disinformation, algorithmic amplification, influence operations. The layer above the technical.

Intelligence & Surveillance — ISR, targeting systems, algorithmic surveillance. How AI changes the see-decide-act cycle.

AI Safety & Ethics — alignment, accountability, legal frameworks. The normative debate about what these systems should and should not do.

Strategy & Doctrine — how militaries think, plan, and adapt. Classical strategy reinterpreted for the AI era.

Geopolitics & Economics — semiconductor supply chains, industrial base, the political economy of AI power. Who controls the hardware controls the war.

Live Conflicts — Ukraine, Gaza, Nagorno-Karabakh as real-time case studies. The empirical ground truth for every theoretical claim in the library.

Fiction & Foresight — the writers who imagined this future before it arrived. Which ones got it right.

History & Origins — how we arrived at this moment. The long arc from early computing to autonomous weapons.

Policy & Law — treaties, governance frameworks, accountability mechanisms. The institutional response to AI-enabled conflict.

How it publishes

One category per week. Every Tuesday.

Each drop covers a complete category — 8 to 12 books published together so you can immediately see how the ideas connect, where they agree, and where they argue. Reading a full category drop is the equivalent of a structured briefing on that subject.

14 weeks. 14 categories. 120 books.

When the series is complete, the entire library — all 360 card pages — will be available as a single downloadable PDF for paid subscribers. Every book, every score, every connection, in one document.

The first category drops next Tuesday: The Essential Canon. The 10 books that defined the field. The texts that every soldier, strategist, technologist, and policymaker working in this space needs to have encountered.

Who this is for

If you work in AI, defence, policy, intelligence, technology, or geopolitics — and you want a working map of the intellectual terrain where these fields are colliding — this library is built for you.

You don’t need to read all 120 books. You need to know what they argue, how they connect, and which ones matter most for the questions you’re actually facing right now.

War is moving faster than the institutions governing it. The frameworks being built today — in think tanks, in Pentagon corridors, in Chinese military academies, in UN conference rooms — are being built by people who have read these books.

You should know what they know.

Subscribe to the AI Warfare Library section to get each category drop every Tuesday. The complete library PDF will be available to paid subscribers when the series is complete.

Already live: [Army of None — Paul Scharre → ]

Where to buy: Amazon

Author Profile: LinkedIn Profile

Categories: ETHICS · AUTONOMOUS · DOCTRINE · PENTAGON

Please note the Where to Buy :- is not an affiliate link it is just designed to be helpful.

In February 2020, the Department of Defence adopted a set of ethical principles for artificial intelligence. They were developed over fifteen months by the Defense Innovation Board - an independent advisory committee that consulted over 100 experts, held public hearings, reviewed nearly 200 pages of public comment, and ran a classified war game before finalising its recommendations.

The first principle is the most important. Human beings should exercise appropriate levels of judgment and remain responsible for the development, deployment, use, and outcomes of DoD AI systems. The board was explicit about what this meant. You cannot blame the machine. The humans who built it and deployed it carry the responsibility for what it does.

Lockheed Martin was the first aerospace and defence contractor to adopt these principles. They say so on their own website, where they also describe themselves as the industry benchmark for responsible AI.

This is what the benchmark looks like.

PAC-3

Every PAC-3 missile interceptor ever fielded has had AI embedded since the programme’s inception. Not recently added. Not in development. Since inception. The system uses AI to detect, track and engage incoming threats at speeds no human operator can match. Lockheed is now upgrading the PAC-3 MSE with machine learning that adapts to new threat behaviour in real time, while the threat is still in the air.

The PAC-3 has been deployed across US allied forces in Europe, the Middle East and Asia. It has been used in active combat. The AI making engagement decisions in those systems has never been the subject of a congressional hearing.

LRASM

The Long Range Anti-Ship Missile uses AI for autonomous target identification, route planning, and attack coordination at ranges approaching 1,000 miles. It can acquire its target without relying on GPS or external data links, using onboard sensors to locate ships and distinguish combatants from neutral vessels in crowded waters.

It carries a 1,000-pound warhead.

The C-3 variant, currently in development, introduces advanced machine learning to enhance autonomous mission planning and target discrimination in intense electronic warfare environments. There is no human making the targeting decision at the moment the missile selects its target. The human authorised the launch. The AI selects what dies.

Aegis

The Aegis Combat System has been on US Navy surface ships since 1983. Lockheed has been embedding AI and machine learning into Aegis to assess threats and support engagement decisions at data speeds no human analyst can process.

In 2024, Lockheed used AI to push real-time capability updates to Aegis-equipped destroyers operating in the Red Sea, enabling them to counter Houthi drone and missile attacks. The updates went from development to deployment in days.

Lockheed recently secured $3.1 billion in contracts to continue Aegis development. The scope of that work explicitly covers capability improvements across all phases of the fire control loop. That phrase - fire control loop - means the sequence from threat detection to weapons release. AI is embedded across it.

On the Aegis AI page of their own website, Lockheed writes: “Our AI moral compass will say a great deal to future generations about how we balanced sensible concerns.”

F-35 Project Overwatch

In early 2025, Lockheed flight-tested an AI combat identification system integrated into the F-35’s information fusion system at Nellis Air Force Base. It was the first time a tactical AI model generated an independent Combat ID directly on a pilot’s display during flight.

The system resolves target identification ambiguities faster than a pilot can process the raw data. It tells the pilot what to shoot at before the pilot has worked it out alone. Lockheed describes this as reducing decision latency.

The pilot retains weapons release authority for now.

Autonomous HIMARS

HIMARS fires GPS-guided rockets at ranges up to 300 kilometres. In December 2024, Lockheed demonstrated a driverless HIMARS launcher that navigated without a crew using non-emitting sensors, operating in day and night conditions without human input.

The Army’s vision is a manned HIMARS paired with an autonomous wingman launcher. Full autonomous mission planning capability is in development.

Generative AI Command and Control

Lockheed is integrating generative AI agents to automate command and control across thousands of battlefield assets simultaneously - sensors, shooters, platforms across all domains, managed at speeds and scales no human command structure can replicate.

The Collaborative Combat Aircraft programme is building autonomous drone wingmen for the F-35 - armed autonomous aircraft designed to fly alongside manned fighters and execute missions in contested environments.

The Principle and the Product

The Defence Innovation Board’s first principle requires that humans exercise appropriate judgment and remain responsible for AI outcomes. Lockheed Martin adopted that principle, built their responsible AI brand around it, and describes their compliance with it as the industry standard.

Then consider what they actually built.

A missile that selects its own target at 1,000 miles. An interceptor with AI making engagement decisions since inception. A naval combat system with AI embedded across the entire fire control loop. A fighter jet with AI resolving targeting ambiguities faster than the pilot. A driverless artillery launcher. Generative AI managing thousands of battlefield assets without human oversight at the decision level.

The DIB was explicit: you cannot blame the machine. The humans who built it carry the responsibility. Lockheed Martin built all of this, adopted the principles that were supposed to govern it, declared themselves the benchmark, and has never once been asked to explain the gap between the two in a public forum.

No congressional hearings. No supply chain risk designations. No coverage in the week that Anthropic lost a Pentagon contract for refusing to let its AI make autonomous targeting decisions without a human in the loop.

The History

This is not a company with a clean record on accountability. The Foreign Corrupt Practices Act - the US law that makes it illegal for American companies to bribe foreign government officials - was written in 1977 specifically because of Lockheed. The company had paid $22 million in bribes to officials in West Germany, Italy, the Netherlands, Japan and Saudi Arabia to secure aircraft contracts. A Dutch prince. A Japanese prime minister. Defence ministers across Europe.

Since then, Lockheed has accumulated at least 81 instances of alleged misconduct and admitted fraud. A $28.4 million FCPA penalty in 1995 for bribing an Egyptian official. A $27.5 million settlement in 2015 for charging the US government for work performed by unqualified staff. Overbilling across multiple programmes spanning decades.

This is the company that sets the standard for responsible AI in the defence industry.

What This Is Really About

The debate about AI and autonomous weapons has been captured by the companies that publish principles. Anthropic published principles. OpenAI published principles. They became the subject of congressional scrutiny, press coverage, and Pentagon supply chain risk designations precisely because they put their commitments in writing and could therefore be held to them.

Lockheed Martin published principles too. They adopted the DoD framework, built a responsible AI brand around it, and embedded their AI across the fire control loop of the US military’s most critical weapons systems. The difference is that nobody is checking.

The DIB said you cannot blame the machine. What they did not anticipate is a world where the companies building the machines would adopt the principles, claim the benchmark, and face no mechanism for anyone to verify whether either claim is true.

Lockheed Martin’s AI moral compass, as they put it, will say a great deal to future generations.

We are already in the future they are building.

It was the wrong question. And the companies who needed it to stay that narrow said nothing.

The Stack

To understand what is actually being built you need to understand how the AI weapons stack works. It has three layers.

At the top are the frontier AI labs. Anthropic, OpenAI, Google DeepMind. They build the large language models - the intelligence layer that does reasoning, planning, and decision support. This is where the Anthropic debate lived. These are the companies with published principles, public safety policies, and CEOs who give TED talks about existential risk.

In the middle are the targeting and data intelligence companies. This is where the actual kill chain gets built. Systems that fuse sensor data, identify threats, and generate targeting options at speeds no human analyst can match.

At the bottom are the hardware manufacturers. The companies that build the platforms the intelligence runs on. Drones, missiles, autonomous aircraft, naval vessels.

The debate last week happened entirely at the top of the stack. The companies in the middle and at the bottom had a very quiet week.

Palantir: The Kill Chain

Palantir does not make missiles. What it makes is more consequential. It builds the intelligence infrastructure that decides where the missiles go.

Its TITAN system - Tactical Intelligence Targeting Access Node - is a mobile ground station that fuses data from space sensors, satellites, and battlefield intelligence to generate targeting options for Army units. The contract to build ten of these systems was worth $178 million. The Army’s ten-year enterprise agreement with Palantir, signed in July 2025, is worth up to $10 billion.

The Maven Smart System, which Palantir also runs, is the Pentagon’s primary AI targeting platform. The Department of Defense boosted that contract by $795 million in 2025 to meet growing demand from combatant commands using it to manage dynamic operations across entire theatres. Palantir has also signed a £1.5 billion agreement with the UK Ministry of Defence to develop capabilities to improve targeting and support what the British government explicitly called the kill chain.

Palantir’s CEO Alex Karp has never pretended otherwise. He has been publicly explicit that western technology companies have a moral duty to help their governments win wars. No principles to walk back. No safety policy to rewrite. No Tuesday press release softening commitments before a Friday deadline.

Anduril: The Hardware

Palmer Luckey sold Oculus to Facebook at 21. Facebook fired him amid controversy about his support for Trump. He spent the next decade building Anduril, now valued at $30.5 billion, which is constructing Arsenal-1 - a five million square foot manufacturing facility in Ohio that will begin producing autonomous weapons systems at industrial scale from July 2026.

Anduril builds the physical systems. Autonomous drones. Counter-drone interceptors. Loitering munitions. Underwater vehicles. Cruise missiles. Its Fury prototype is currently undergoing armed flight testing with the US Air Force’s Collaborative Combat Aircraft programme - autonomous wingman jets designed to fly alongside manned fighters, carry weapons, and execute strike missions.

The Fury drone carried an AIM-120 air-to-air missile during flight testing in February 2026. A human retains weapons release authority for now.

Anduril’s autonomous weapons have not always worked. More than a dozen drone boats failed during Navy exercises in May 2025. Ukrainian forces stopped using its Altius loitering drones after repeated battlefield failures. A counter-drone test caused a 22-acre fire in Oregon. The company raised $2.5 billion in June 2025 regardless.

Shield AI: The Pilot

Shield AI builds the autonomy software that flies military aircraft without GPS and without human input. Its Hivemind platform has been deployed in drones operating in Ukraine and is now being integrated into Anduril’s CCA prototype. The goal is an AI pilot that can operate in contested electronic warfare environments where human remote control is jammed or blocked.

Shield AI is valued at $5.3 billion. It has never published an AI safety policy.

Lockheed Martin: The Institution

While Palantir, Anduril, and Shield AI are the new generation, Lockheed Martin has been building AI into weapons for decades. Its PAC-3 missile defence interceptor has had embedded AI since inception. Its LRASM anti-ship missile uses AI for autonomous target identification, route planning, and attack coordination at ranges approaching 1,000 miles. Its Skunk Works division is developing autonomous combat aircraft. AI is embedded across its Aegis naval combat system, its F-35 programme, and its long-range strike portfolio.

On its own website, Lockheed Martin describes itself as the industry benchmark for responsible AI.

It has $67 billion in annual revenue. It was not mentioned once in last week’s debate about AI safety.

Where OpenAI and Anthropic Actually Sit

Both companies sit at the top of the stack. They provide the reasoning layer - the models that interpret intelligence, draft assessments, and support decision-making. Neither is directly building autonomous weapons. What they provide is the cognitive infrastructure that makes the systems built by Palantir, Anduril, and Lockheed faster, more accurate, and more lethal.

Anthropic refused to let Claude be used without restrictions across that stack. It drew two lines. No fully autonomous weapons. No mass domestic surveillance. It lost the contract.

OpenAI took the contract with the same two protections written in. The company that built Stargate, took $110 billion from SoftBank, Nvidia and Amazon, and whose co-founder donated $25 million to Trump’s political PAC, now has its models running on the Pentagon’s classified networks alongside Palantir’s targeting systems and Anduril’s autonomous aircraft.

Whether those protections survive the relationship is a different question.

They Just Build

The companies building autonomous weapons have mastered something the AI labs have not. They do not publish principles. They do not hold safety summits. They do not write blog posts about the existential risks of the technology they are scaling.

They just build.

Anduril is constructing a five million square foot autonomous weapons factory. Palantir has a $10 billion Army contract and a seat at the centre of every major western military’s targeting infrastructure. Shield AI is putting an autonomous pilot into a jet fighter. Lockheed Martin has AI in missiles that select and engage targets without human input.

Here is what gets lost in the debate about principles and safety policies and who has a human in the loop.

Weapons kill people.

Not data systems. Not intelligence platforms. Not autonomy software. The thing at the end of the stack - the missile, the drone, the autonomous aircraft carrying an AIM-120 - kills a human being. And every layer of AI sitting above it, making targeting faster and decisions more confident, is operating on models that misidentify targets, hallucinate threat assessments, and produce outputs that even their own developers cannot fully explain.

We know this because the evidence is already there. A war game simulation found large language models chose nuclear options in 95 percent of test runs when objectives were loosely defined. Anduril’s drones crashed in Ukraine. Its drone boats failed in Navy exercises and sailors warned of potential loss of life. These are not edge cases from a technology still finding its feet. This is the technology being scaled to industrial production.

The companies publishing safety policies were not the ones building the weapons. The ones building the weapons never needed a safety policy because nobody asked them for one.