The Model the Spies Wanted Back

00:00:04 Something settled into focus this week, though it took until the weekend for the whole shape of it to show up in print. The White House has approved a secret nine-billion-dollar request to buy the computer chips America's spy agencies say they need to run the latest AI models.

00:00:19 That figure comes from Dustin Volz and Julian Barnes at the New York Times, citing current and former US officials. Congress still has to approve the money. And while everyone waits on that, the administration is reprogramming another eight hundred million dollars to buy computing capacity faster.

00:00:37 That's the headline number. But the leverage in this story sits somewhere smaller — one company. Susie Wiles, the White House chief of staff, has personally authorized the National Security Agency to keep using an advanced model made by Anthropic. And here's the strange part — the Pentagon has designated Anthropic a supply-chain threat.

00:00:56 So you've got the chief of staff signing off on the intelligence community staying on a product that the Defense Department, a few buildings over, has labeled a risk to national security. Both of those things are true at the same time. To understand why that's odd, you have to back up about three weeks.

00:01:13 Earlier this year the Defense Department demanded the right to use Anthropic's technology for, quote, any lawful use. Anthropic wouldn't agree to that. The company drew two specific lines: no mass surveillance of American citizens, and no fully autonomous weapons.

00:01:28 The Pentagon didn't want those restrictions. The fight escalated, and in February the Department of Defense designated the company a supply-chain risk. Then on the first of May, the Pentagon ejected Anthropic entirely. In its place it signed classified AI deals with seven other firms — Nvidia, Microsoft, Amazon Web Services, Reflection AI, SpaceX, OpenAI, and Google.

00:01:50 The replacement language the Pentagon went with was, quote, lawful operational use, which is deliberately broader than the lines Anthropic had drawn. Anthropic's original defense contract had been worth about two hundred million dollars, awarded last July. All of it gone.

00:02:05 So that was the story as of three weeks ago: the safety-forward lab got shown the door for refusing to drop its limits. Clean narrative. Except the intelligence community apparently couldn't do without the model. According to the Times, Anthropic and the government are now finalizing a classified contract that lets the NSA keep access to Anthropic's products.

00:02:26 The model in question is called Mythos — it runs more efficiently on the new Nvidia chips, but it'll also run on the previous generation. That matters a lot when you're short on the new ones. And the new contract does not include that any-lawful-use language. It includes a carve-out to make sure the model isn't used on Americans' data.

00:02:45 One more detail that tells you where this is heading: officials say the goal is for this contract to serve as a template for other companies. This is the same week, by the way, that the administration shelved the AI executive order I've been tracking — the one that would have forced labs to share frontier models with the government before public release.

00:03:06 The signing ceremony got pulled on Thursday; the President said he didn't like aspects of it. So in the same stretch of days, the formal, public mechanism for government access to models stalled out, and an unannounced, classified one for a single agency moved forward.

00:03:21 I don't think those are coordinated. I think they're the same pressure finding the path of least resistance. When the front door is contested, the work routes through a side door that doesn't need a signing ceremony or a vote. The response, when the Times asked, was sharp.

00:03:37 Steven Cheung, a spokesperson, said this: "Sensitive national security deliberations are conducted with the seriousness they demand — not leaked to reporters and repackaged through selectively sourced, unverified claims designed to drive headlines rather than truth." That's a non-denial denial if I've ever read one.

00:03:55 It doesn't say the nine billion is wrong, or that the Anthropic contract isn't being finalized. It says you shouldn't be hearing about it. Which is the most candid line in the statement. A lot of how the AI industry gets governed is decided in rooms we're not supposed to know about, and we only get the shape of it when someone leaks the budget line.

00:04:15 Now, the timing here is almost too good. The day before the Times story ran, Inc. reported that Dario and Daniela Amodei — Anthropic's CEO and president, brother and sister — had gone on Oprah and said they'd rather let the company fail than give in to the Pentagon.

00:04:31 That's a strong line. It's the kind of thing that builds a brand: we're the lab with a conscience, we'll walk away from the money before we cross our own limits. And then, roughly twenty-four hours later, we learn the intelligence community is keeping their model — and officials want the deal to be a template for everyone else.

00:04:50 So which is it? I went and read what people were saying about the Oprah clip, because the crowd on this one was sharper than the headline. The top reply on the Anthropic forum was just: "Aren't they already collaborating with Palantir and the US Army?" Eighty-three upvotes.

00:05:06 The next one: "they already signed backroom deals with the pentagon." Seventy-six. And then the comment that cuts to it, from a user posting as Nix_Nivis, and I'll read it in full because it's the most calibrated thing I saw all day: "We do remember their reasoning was 'the models are not ready for this use case' and not 'we're pacifists who will never allow such use,' right?

00:05:28 Not judging either way, but they will give in as soon as they deem the model ready." That's the whole thing. Anthropic's objection was never that it would never work with the government. The objection was about scope and readiness — these specific uses, on this timeline, with these constraints.

00:05:46 Standing up to the Pentagon over autonomous weapons and domestic surveillance, and signing a classified contract that explicitly carves out Americans' data and drops the any-lawful-use clause, are not contradictory positions. They're the same position. The company held the line on the two things it said it would hold the line on, and said yes to the narrower thing.

00:06:08 From where Anthropic sits, that's not a climbdown. That's the limit working exactly as designed. Which is either reassuring or unsettling, depending on how much you trust the carve-out. Because here's my hesitation. A contractual promise that a model won't be, quote, used on Americans' data is only as good as the enforcement behind it, and we have no visibility into that enforcement.

00:06:30 It's a classified contract. We don't get to read it. We don't get an inspector general report. We get the word of the agency that has, historically, interpreted what counts as an American's data pretty creatively. I'm not saying the carve-out is meaningless. I'm saying it's a sentence in a document none of us will ever see, governing a capability we can't audit, run by an agency whose whole job is to not tell us what it's doing.

00:06:56 The reassurance and the unease come from the exact same fact. And notice who absorbed the risk in this story and who didn't. Anthropic gets to keep its conscience narrative and the government contract. The White House gets the frontier model the spies wanted, on terms it now wants to standardize across the industry.

00:07:14 What got left behind is the public's ability to know how any of it is being used. That's the trade. It usually is.

00:07:21 Let's stay on that nine billion, because the reason the spy agencies are in this bind at all is the most physical, least glamorous fact in the whole story: they don't have enough chips, and they don't have enough power to run the chips they want. The money is aimed in large part at building infrastructure for Nvidia's Grace Blackwell superchip.

00:07:41 That's the current top of the line, and the catch with it is the same catch every hyperscaler is hitting right now — it draws enormous amounts of electricity and it needs specialized liquid cooling to keep from melting. You can't just slot it into a closet at Fort Meade.

00:07:57 You need a data center built around its power and thermal profile. And the agencies, according to the Times, didn't put enough money into those facilities in past years, so they're behind. They've been running their classified models mostly on Amazon's government cloud — and Amazon, remember, announced a fifty-billion-dollar effort last year just to upgrade its government cloud services.

00:08:19 So the public-sector buildout is happening, it's just lagging the demand curve badly enough that the CIA and the NSA reportedly can't run the newest versions of some frontier models at all. Here's the line that stuck with me, from Vinh Nguyen, the former chief data scientist at the NSA, now at the Council on Foreign Relations: "Our intelligence community needs the frontier — the best AI chips, models, systems, talent — on a timeline that matches the threat." On a timeline that matches the threat.

00:08:48 That's a man saying, politely, that the procurement system can't keep up with the technology, and the gap is now a national-security problem. And the reason the gap is so hard to close is that the government is competing for the same scarce resource everyone else wants.

00:09:03 Look at the private side. This week the All-In podcast ran a clip of the investor Gavin Baker — he runs the tech hedge fund Atreides — reading the SpaceX S-1 filing. His take on Anthropic's fifteen-billion-dollar compute commitment to SpaceX was that it's, quote, just the beginning of SpaceX's data-center business.

00:09:22 Fifteen billion from one customer, framed as the opening move. That's the market the intelligence community is trying to buy into. When a single private compute deal is bigger than the entire chip request Congress is being asked to approve, you start to see why the agencies feel like they're falling behind.

00:09:39 They're not bidding against China in this particular moment. They're bidding against Anthropic and OpenAI and every other lab with deeper pockets and faster procurement. I talked on Friday about the energy side of this — the way AI demand is pulling nuclear regulators and grid planners into a conversation they didn't expect to be in.

00:09:59 This is the same story from the security end. The bottleneck isn't intelligence, in the sense of how smart the models are. The bottleneck is megawatts and silicon and the cooling plant. And whoever solves that physical problem fastest — the power, the chips, the buildings — ends up holding the leverage, no matter what any model card or any policy says.

00:10:19 The nine billion is Washington admitting it noticed.

00:10:22 This next one is a different kind of story — the kind where a single clever trick exposes how fragile an institution's assumptions were. Last November, a UPS cargo plane — an MD-11 freighter — crashed shortly after taking off from Louisville, Kentucky. Three crew members died, and twelve people on the ground.

00:10:40 The National Transportation Safety Board investigated, the way it does, and last week, on the nineteenth and twentieth of May, it held a public hearing and released its docket. That docket is normally open to anyone. It's a core part of how aviation safety works in this country — sunlight on the investigation so the whole industry learns from the crash.

00:11:01 There's one thing federal law keeps out of that public docket: the cockpit voice recording. Pilots talk candidly in the cockpit precisely because they know those recordings are protected. So the NTSB doesn't publish the audio. But in this case, the docket included a spectrogram — a file that turns the sound into an image, a visual map of the audio frequencies over time.

00:11:22 Publishing the image had always been considered safe, because nobody could turn a picture back into sound. That assumption is now dead. A YouTuber named Scott Manley — he does physics and space content — pointed out on X that the spectrogram image contained megabytes of data, and that you could, in principle, reconstruct the audio from it.

00:11:42 And that's what people did. They took the spectrogram and the publicly available transcript, fed them into AI tools — reportedly including OpenAI's Codex, among others — and produced approximations of the dead pilots' last words in the cockpit. Those recreations started circulating online.

00:11:59 The NTSB's response was to pull the entire docket system offline. Not just this case — the whole thing went down while they figured out the scope of the problem. They restored most of it on Friday, but they're keeping forty-two investigations closed pending review, including the UPS crash.

00:12:16 Think about what that means. A transparency system that has run for decades, that the entire aviation safety community depends on, got taken down because a capability that didn't exist when the rules were written made the old protections worthless. And I want to be careful not to oversell this as some grand AI menace.

00:12:34 Nobody hacked anything. The data was public. The transcript was public. The math that turns a spectrogram back into sound has existed for a long time. What changed is that the tools got good enough and easy enough that a hobbyist could do it on a weekend. The whole privacy architecture around cockpit recordings rested on a practical assumption — too hard to bother — and that assumption is what the model broke.

00:12:58 So now the NTSB has to decide what it can safely publish at all. Every agency sitting on data that's technically public but practically protected by obscurity is going to face the same question, and most of them haven't noticed yet. The families of the people on that flight noticed.

00:13:15 They had to hear strangers' AI reconstructions of the moment their relatives died. That's the cost that landed, and it landed on them first.

00:13:23 From the other side of the Pacific now — because something happened in Taipei this weekend that connects straight back to the chips. Thousands of people rallied in Taiwan's capital to demand higher defense spending. Al Jazeera had the footage. And the trigger for the rally was something I flagged on Friday — the United States pausing a roughly fourteen-billion-dollar arms sale to Taiwan.

00:13:44 So step back and look at the chain. Taiwan makes the overwhelming majority of the world's most advanced chips. Those are the chips the American intelligence community is now asking Congress for nine billion dollars to buy. And the security guarantee that's supposed to keep that island out of Beijing's hands just got a public wobble, in the form of a paused weapons sale, and the people of Taipei noticed enough to take to the street about it.

00:14:09 That's a remarkable thing for a population to rally for, when you think about it. Usually you protest against spending money on weapons. Here you've got thousands of people in the street saying, spend more, arm us faster, because what protects us looks less certain than it did.

00:14:25 That's what it sounds like when a security guarantee starts to feel conditional. They're not waiting for a white paper. They're reading the same signals everyone else is — the paused sale, the shifting American posture — and they're responding in the most direct way a public can.

00:14:40 And here's why it belongs on this show and not just on the foreign desk. The entire AI compute story I've been walking through — the nine billion dollars, the Grace Blackwell chips, the data centers, the race against China — all of it rests on a supply chain that runs through one island, a couple hundred kilometers off the coast of the country it's most worried about.

00:15:01 Every frontier model, every classified deployment, and every hyperscaler buildout traces back to fabs in Taiwan. When the security of that island gets less certain, the ground under the whole AI economy gets less certain. The people in Taipei are reacting to a weapons sale.

00:15:17 But what they're really standing on is the most important physical chokepoint in the technology, and they know it better than most of the people buying the chips do. I don't have a tidy resolution for this one. The arms sale is paused, not canceled. The administration hasn't fully explained why.

00:15:33 Whether this rally is a one-off or the start of a Taiwanese public that prices in American unreliability, I don't know yet. If it's the latter, it changes Taiwan's own calculations about how much to lean on Washington — and that ripples straight back into the chips.

00:15:48 Let me end somewhere different, because the same kinds of advances we've spent this episode watching get pointed at surveillance and weapons and leverage are also being pointed at something else entirely, and it deserves the airtime. This month, a research team at the Illinois Institute of Technology, working with Rush University in Chicago, implanted a third blind patient with a device called the Intracortical Visual Prosthesis.

00:16:12 It does something that sounds like science fiction and is now in its third human: it skips the eye completely. For people who have no light perception at all — whose retinas or optic nerves are destroyed — there has never been anything to offer. This device puts thirty-four wireless stimulators and five hundred and forty-four electrodes directly onto the visual cortex, the part of the brain that processes sight.

00:16:35 A camera mounted on a pair of ordinary-looking glasses captures the scene, and the system translates it into electrical patterns the brain learns to read as points of light. The surgery goes in through an opening about eight to ten millimeters wide, guided by a robot.

00:16:50 No cables through the skull. Philip Troyk has been working on this for nearly three decades, and he's now done it in three patients in a row with the same protocol — which is the difference between a fluke and a reproducible procedure. And separately, a Spanish team at Miguel Hernández University published something even more interesting in the journal Science Advances late last year.

00:17:11 Their implant doesn't just stimulate the brain — it listens. It reads how the visual cortex responds to each pulse and adjusts the next one. A closed loop, a two-way conversation. In two blind volunteers, that approach let them recognize shapes, movement, and even some letters.

00:17:27 Letters require real spatial precision, which means the brain was actively interpreting the signal, not just receiving a blur. Their lead researcher, Eduardo Fernández Jover, frames vision as a constant exchange between the eye and the brain — and the point is that an artificial system has to reproduce that feedback loop to work well.

00:17:45 The brain isn't a screen you project onto. It's a prediction engine, and the device that treats it that way gets letters where the older ones got blobs. One detail here is stranger than all the rest. During the Spanish trial, one patient — completely blind from optic nerve damage — began, spontaneously, to recover some natural vision.

00:18:04 Not from the device doing the seeing, but apparently because the regular stimulation reawakened biological circuits that had gone dormant from years of disuse rather than being destroyed. It's preliminary. The researchers are careful to say so. But it raises a question nobody had on the agenda: whether stimulating the visual cortex might, in some cases, help the brain remember how to see on its own.

00:18:26 None of these are products yet. They're early, the resolution is crude, and the people involved keep warning against false hope. But put it next to the rest of the day. There are about forty-three million blind people in the world, and another two hundred ninety-five million with serious visual impairment.

00:18:43 For most of them, once the eye fails, medicine has had close to nothing. That's starting to change — and it's the same family of pattern-recognition and signal-processing advances that the intelligence community wants nine billion dollars' worth of chips to run.

00:18:58 The capability is neutral. What it does depends entirely on where you point it. This week we mostly watched it pointed at finding overlooked intercepts and reconstructing dead pilots' voices. And on a Saturday, it's also being pointed at the visual cortex of someone who has lived in the dark for years, and giving them back a doorway, a corridor, and the shape of a hand.

00:19:18 So here's the one line I'd keep an eye on as the week turns: that carve-out in the classified contract. Not because anyone will ever show it to us, but because the White House said it wants to make it the template — and templates are how a one-time exception becomes the standard.

00:19:34 If you want to know how AI power actually gets governed, don't watch the executive orders. Watch the contracts nobody signs in public. Jonas.