If Removing One AI Vendor Means Moving the Work, the System Was Never Sovereign

The Defense Department designated a frontier AI company a supply-chain risk, and what followed was not a removal. It was a migration. More than two-thirds of the department's classified-network AI work moved to alternative providers. Removing one company from the architecture required relocating the work itself, and that operational detail matters more than anything in the designation.

A sovereign system sheds a component and keeps operating. A dependent system follows its component out the door. When the only way to stop using a provider is to pick up the workload and carry it somewhere else, the provider was never a component at all. It was the system. The Anthropic episode did not create that condition; it exposed it, at scale and on classified networks, under exactly the time pressure a clean removal is supposed to avoid.

This is not an argument about any one vendor. The same structure applies to every provider the department rents a frontier model from, domestic or foreign, favored or designated. The test that should keep program offices honest is mechanical, not political: if this provider had to go tomorrow, what exactly would leave with it.

That is not sovereignty.

What The Designation Actually Revealed

A senior Defense official said the designation was necessary because of the technology's unique characteristics. Anthropic's chief executive confirmed on March 5 that the company had been officially notified and planned to sue. The merits of the designation and the lawsuit will be settled elsewhere, and we take no position on them here. Our subject is narrower and more durable: what the department's response revealed about who actually owns the capability.

What came next was movement: the department transitioned more than two-thirds of its classified-network work to alternative AI providers. Seven companies, namely SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft and Amazon Web Services, reached agreements to deploy advanced AI on the Pentagon's classified networks. On paper that looks like resilience, because more vendors means more options; in practice, replacing one rented frontier model with seven rented frontier models multiplies the dependency rather than retiring it. The department now manages seven exits instead of one, and absent a change in architecture, each of those exits will look exactly like this one did. Vendor diversity is a procurement fact; architectural independence is an engineering fact, and the two are routinely confused.

The Provider Controls More Than The Contract Admits

An outside provider of a frontier model controls the weights, the behavior those weights produce, the usage policy that gates what the model will and will not do, the availability of the service, and the timing and content of every model change. None of that sits inside government configuration control. A patch to an owned weapon system passes through the government's own test and acceptance process before it touches the force. A change to a rented model arrives when the provider ships it, shaped by commercial incentives and regulatory pressures the government neither sees nor votes on.

Procurement language already half-admits this. GSA's reported tender rule specifies no training on government data and deletion of fine-tuned weights at contract end, with alerts within 72 hours. A European vendor must give 30 days' notice when it adapts its model to non-U.S. rules in a way that substantially changes the model's responses. Read those clauses as an engineer rather than as a lawyer: they assume the model will change underneath the mission, and they concede that fine-tuned weights evaporate when the contract does. The strongest remedy on offer is notification, and thirty days of notice is a courtesy, not a control.

Those closest to the models have said as much. Several Google DeepMind employees resigned or prepared to leave over Google's work with the U.S. military and Israel. Those employees doubted that Google could control how its AI models were used in war. We do not need to adjudicate their reasons to take the technical point seriously. If staff inside a provider doubt the provider's control over wartime use of its own models, a service consuming that model through an interface should be modest about what it believes it controls.

The Responsible-Ai Oversight Office Is Understaffed

Oversight, the layer that should catch all of this, is thin. The Pentagon office assigned in 2022 to oversee responsible military AI had filled three of its 10 authorized positions, an office staffed at 30 percent. The Government Accountability Office found that 29 of 64 efforts in the department's responsible-AI pathway remained incomplete as of April 2026, a pathway roughly 45 percent incomplete. And the department was deploying frontier AI while 215,000 troops had incomplete identity records behind the credentials used to access it, a six-figure gap in the identity layer.

This pattern is not unique to defense. USDA lacked the resources and contract support to keep a human in the loop because of cutbacks. VA staff used general-purpose AI chat tools to draft clinical notes and summarize patient care. The VA inspector general found those tools had never been treated as high-impact AI. This is the familiar failure mode of programs whose schedule risk lives entirely in a subsystem nobody is tracking; here the untracked subsystem is governance itself, and the day it fails will be the day a provider changes a policy or a designation lands.

The Model-Removal Test

A workable remedy is a test, run before the crisis instead of during it: remove the model and measure what happens. Two numbers come out of the exercise. The first is time to restore the workload on a replacement model, measured in days rather than quarters. The second is continuity of controls, meaning the access rules and audit logs, together with safety and compliance enforcement, either survive the swap intact or turn out to have been welded to the departed vendor's stack. Beyond those numbers sits finished-output quality after the swap, including the human editing required to bring the product back to standard, because the cost that matters is the cost of the finished outcome, not the price of a token.

The test also disciplines acquisition. A capability demonstrated once under favorable conditions with one provider's model is not a fielded capability; it is a demonstration with that provider's name on it. Requiring a successful model swap in the acceptance criteria converts a wish-list requirement into an engineering requirement with a number attached. It also tells the program office, early and cheaply, whether its logs and controls belong to the government or to the vendor.

Independent checking works when it is actually independent. External evaluators hosted by OpenAI identified gaps and vulnerabilities. OpenAI later told METR that all identified vulnerabilities affecting its production safeguards stack had been patched. The encouraging part is the structure: the checks that caught the gaps sat outside the thing being checked. For military AI the implication is direct: the layer that checks and enforces has to sit outside the model, in government hands, or the government is grading the vendor's homework with the vendor's pen.

Own The Architecture, Rent The Model

This is the difference between Generation 1 and Generation 2 systems. Generation 1 is an isolated frontier model consumed as a service, which is why removing it removes the capability and removal becomes migration. Generation 2 is that same model embedded inside an architecture the owner controls: teams of models that solve and then check, enforcing safety and compliance, measured by the finished outcome, human editing included. In a Generation 2 architecture the frontier model is a line-replaceable unit. Swap it and rerun the acceptance suite; the same logs and controls keep operating.

Kibernan has produced six complete, costed engineering programs: AI Managed Missile Factory, AEGIS-ARGUS-KRONOS, IRON HIVE, DRONE WALL, FANGS, and VES. They are proposals. No Kibernan hardware has been built or fielded, and we say so in writing, with every published figure carrying its maturity, whether modeled, specified, calculated, or objective. The relevance here is not the programs themselves but the existence proof that an architecture can be specified and costed on paper, and checked there, before anyone bets a classified network on it.

Vendor approval tells you a model was acceptable on the day it was approved. The model-removal test tells you whether the mission survives the day it is not. A service that can swap its frontier model in days, and show that its finished output came through the swap intact alongside its controls and logs, owns a military AI capability. A service that cannot is renting one, and the transition of more than two-thirds of the department's classified-network work to alternative AI providers shows exactly what the rent looks like when it comes due.

Sovereignty is what survives removal.