OpenAI's Agreement With the U.S. Defense Department: Terms, Usage Limits and the Debate Over Military AI

Bottom line: In late February 2026, hours after the U.S. government moved to stop using Anthropic’s products over a dispute about usage restrictions, OpenAI announced an agreement to provide its AI technology on the Defense Department’s classified networks. OpenAI says the contract includes limits, among them no use for autonomous weapons and no deliberate domestic surveillance of U.S. persons, and it later added clarifying language on surveillance. The episode shows that the question is no longer whether AI labs work with defense agencies, but on what terms and how those terms are enforced.

This article is based on OpenAI’s published description of the agreement and reporting by NPR, Reuters and AP. Note: the Defense Department has used the name “Department of War” in some official communications; this article uses “Defense Department.”

Background: the Anthropic dispute

Anthropic had a defense contract worth up to $200 million and sought to keep two restrictions on Claude: no use for mass surveillance of Americans and no use to power fully autonomous weapons. The Pentagon wanted suppliers to accept use for any lawful purpose. On February 27, according to NPR, the president directed federal agencies to stop using Anthropic’s technology with a six-month phase-out, and the defense secretary moved to designate Anthropic a supply-chain risk. Anthropic said the designation was legally unsound and challenged it in court.

What OpenAI says its agreement contains

According to OpenAI and Reuters:

• The agreement covers deploying OpenAI technology on the Defense Department’s classified network.
• OpenAI describes “layered” protections and three red lines, including a prohibition on use for autonomous weapons systems, according to Reuters.
• In a March 2 update, OpenAI published added contract language stating that the AI system “shall not be intentionally used for domestic surveillance of U.S. persons and nationals,” including through commercially acquired personal data, and that services will not be used by Defense Department intelligence agencies such as the NSA without a new agreement.
• The Defense Department plans a working group with frontier AI labs and cloud providers, which OpenAI says it will join.

Reuters also reported that OpenAI said it opposed labelling Anthropic a supply-chain risk.

How the two approaches differ

Both companies have said they do not want their models used for autonomous weapons or mass domestic surveillance. The difference reported so far is about mechanism: Anthropic sought to keep its own usage restrictions in force, while OpenAI agreed to contract terms negotiated with the department and backed by its own safeguards. Whether contractual limits are as robust as company-imposed model restrictions is a central question in the debate.

The existing policy framework

Debates over “autonomous weapons” often assume there are no rules. In fact, the U.S. Defense Department has had a policy on autonomy in weapon systems since 2012. DoD Directive 3000.09, last updated on January 25, 2023, requires autonomous and semi-autonomous weapon systems to be designed so that commanders and operators can exercise “appropriate levels of human judgment over the use of force” (DoD Directive 3000.09). According to a Congressional Research Service primer, this does not require manual control of every action; it requires human involvement in decisions about how, when, where and why force is used, and senior review before certain systems are developed or fielded.

This framework matters for reading AI-company agreements. Contract terms such as “no fully autonomous weapons” sit on top of an existing departmental policy, and the practical questions are how each layer is interpreted, who verifies compliance, and what happens if the policy changes.

Later developments

Anthropic’s legal challenge produced split results. A federal judge in San Francisco ruled that one of the government’s designations was unlawful (AP). On September 25, the U.S. Court of Appeals for the D.C. Circuit upheld the other designation in a 2–1 decision (AP). Anthropic has sought a rehearing.

The open questions

• Verification. How will compliance with usage limits on classified networks be monitored, and by whom?
• Definitions. Terms such as “autonomous weapons” and “surveillance” can be interpreted narrowly or broadly.
• Precedent. The government’s response to Anthropic may influence how other suppliers negotiate restrictions.
• Employees and users. AI companies’ defense work has prompted internal and public debate, which can affect hiring and trust.

What it means for businesses using these models

For most commercial users, nothing changes in how they access ChatGPT or Claude. The practical lessons are for procurement teams: read the acceptable-use policies of AI vendors, understand how they apply to your sector, and consider vendor and regulatory risk when choosing a single AI supplier for critical work.