The Pentagon is planning for AI companies to train on classified data, defense official says

The generative AI models used in classified environments can answer questions but don't currently learn from the data they see. That could soon change.
The Pentagon is discussing plans to set up secure environments for generative AI companies to train military-specific versions of their models on classified data, MIT Technology Review has learned.
AI models like Anthropic’s Claude are already used to answer questions in classified settings; applications include analyzing targets in Iran. But allowing models to train on and learn from classified data would be a new development that presents unique security risks. It would mean sensitive intelligence like surveillance reports or battlefield assessments could become embedded into the models themselves, and it would bring AI firms into closer contact with classified data than before.
Training versions of AI models on classified data is expected to make them more accurate and effective in certain tasks, according to a US defense official who spoke on background with MIT Technology Review. The news comes as demand for more powerful models is high: The Pentagon has reached agreements with OpenAI and Elon Musk’s xAI to operate their models in classified settings and is implementing a new agenda to become an “an ‘AI-first’ warfighting force” as the conflict with Iran escalates. (The Pentagon did not comment on its AI training plans as of publication time.)
Training would be done in a secure data center that’s accredited to host classified government projects, and where a copy of an AI model is paired with classified data, according to two people familiar with how such operations work. Though the Department of Defense would remain the owner of the data, personnel from AI companies might in rare cases access the data if they have appropriate security clearance, the official said.
Before allowing this new training, though, the official said, the Pentagon intends to evaluate how accurate and effective models are when trained on nonclassified data, like commercially available satellite imagery.
The military has long used computer vision models, an older form of AI, to identify objects in images and footage it collects from drones and airplanes, and federal agencies have awarded contracts to companies to train AI models on such content. And AI companies building large language models (LLMs) and chatbots have created versions of their models fine-tuned for government work, like Anthropic’s Claude Gov, which are designed to operate across more languages and in secure environments. But the official’s comments are the first indication that AI companies building LLMs, like OpenAI and xAI, could train government-specific versions of their models directly on classified data.
Aalok Mehta, who directs the Wadhwani AI Center at the Center for Strategic and International Studies and previously led AI policy efforts at Google and OpenAI, says training on classified data, as opposed to just answering questions about it, would present new risks.
The biggest of these, he says, is that classified information these models train on could be resurfaced to anyone using the model. That would be a problem if lots of different military departments, all with different classification levels and needs for information, were to share the same AI.
“You can imagine, for example, a model that has access to some sort of sensitive human intelligence—like the name of an operative—leaking that information to a part of the Defense Department that isn’t supposed to have access to that information,” Mehta says. That could create a security risk for the operative, one that’s difficult to perfectly mitigate if a particular model is used by more than one group within the military.
However, Mehta says, it’s not as hard to keep information contained from the broader world: “If you set this up right, you will have very little risk of that data being surfaced on the general internet or back to OpenAI.” The government has some of the infrastructure for this already; the security giant Palantir has won sizable contracts for building a secure environment through which officials can ask AI models about classified topics without sending the information back to AI companies. But using these systems for training is still a new challenge.
The Pentagon, spurred by a memo from Defense Secretary Pete Hegseth in January, has been racing to incorporate more AI. It has been used in combat, where generative AI has ranked lists of targets and recommended which to strike first, and in more administrative roles, like drafting contracts and reports.
There are lots of tasks currently handled by human analysts that the military might want to train leading AI models to perform and would require access to classified data, Mehta says. That could include learning to identify subtle clues in an image the way an analyst does, or connecting new information with historical context. The classified data could be pulled from the unfathomable amounts of text, audio, images, and video, in many languages, that intelligence services collect.
It’s really hard to say which specific military tasks would require AI models to train on such data, Mehta cautions, “because obviously the Defense Department has lots of incentives to keep that information confidential, and they don't want other countries to know what kind of capabilities we have exactly in that space.”
If you have information about the military’s use of AI, you can share it securely via Signal (username jamesodonnell.22).
Deep Dive
Artificial intelligence
A “QuitGPT” campaign is urging people to cancel their ChatGPT subscriptions
Backlash against ICE is fueling a broader movement against AI companies’ ties to President Trump.
Moltbook was peak AI theater
The viral social network for bots reveals more about our own current mania for AI as it does about the future of agents.
Yann LeCun’s new venture is a contrarian bet against large language models
In an exclusive interview, the AI pioneer shares his plans for his new Paris-based company, AMI Labs.
How Pokémon Go is giving delivery robots an inch-perfect view of the world
Exclusive: Niantic's AI spinout is training a new world model using 30 billion images of urban landmarks crowdsourced from players.
Stay connected
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.

Facts Only

* The Pentagon is considering allowing generative AI companies to train on classified data.
* AI models like Claude are currently used to answer questions in classified settings.
* Allowing models to train on classified data would be a new development with security risks.
* Sensitive intelligence could be embedded in the models.
* Training on classified data is expected to improve model accuracy and effectiveness.
* The Department of Defense does not comment on its AI training plans.
* A secure data center accredited to host classified government projects would be used.
* Personnel from AI companies may have rare access to the data with security clearance.
* The Pentagon intends to evaluate models trained on nonclassified data before allowing training on classified data.
* Computer vision models have long been used to identify objects in images.
* AI companies have created LLMs fine-tuned for government work.
* Aalok Mehta, of the Wadhwani AI Center, raises concerns about the risk of leaked classified information.
* The Pentagon is racing to incorporate more AI due to a January memo from Defense Secretary Pete Hegseth.
* AI is being used in combat and administrative roles.

Executive Summary

The Pentagon is exploring the possibility of partnering with generative AI companies to train specialized models on classified data. Currently, AI systems like Anthropic’s Claude are utilized for question answering within classified environments, but this would represent a significant shift. The defense department is considering allowing companies such as OpenAI and xAI to train models directly on sensitive information, including surveillance reports and battlefield assessments, to improve their accuracy and effectiveness in specific tasks. This initiative aligns with the Pentagon’s broader strategy to become an “AI-first” warfighting force. However, this approach carries substantial security risks, as it could embed classified intelligence into the models, potentially leading to leaks. Aalok Mehta highlights the danger of information surfacing from these models, especially if shared across various military departments. The Pentagon’s plan involves using a secure data center with strict access controls and evaluating models trained on nonclassified data, like satellite imagery, before proceeding. The department’s increased focus on AI stems from a recent memo from Defense Secretary Pete Hegseth. The potential applications of these trained models extend to analyzing complex data sets, identifying subtle clues, and automating administrative tasks. The situation reflects a broader trend in the military’s adoption of AI technologies to bolster operational capabilities.

Full Take

The article presents a critical juncture in the intersection of AI and national security, framed as a calculated risk – a potential enhancement of military capabilities offset by a dramatically increased vulnerability to information leaks. The core narrative hinges on a tension between pragmatic military needs and fundamental security principles. The “AI-first” warfighting agenda, fueled by the recent Hegseth memo, suggests a recognition that traditional human analysts are demonstrably overwhelmed by the sheer volume and complexity of intelligence data. Training models directly on classified sources – surveillance reports, battlefield assessments – represents an attempt to amplify analytical capacity, mirroring the Pentagon’s embrace of generative AI in combat roles. However, Mehta’s concerns regarding the potential for “sensitive human intelligence—like the name of an operative—leaking” immediately introduces a classic Motte-and-Bailey tactic. The framing of the risk – a leak to a “part of the Defense Department that isn’t supposed to have access” – subtly mitigates the immediate danger, creating a false sense of security. The pattern here is a deliberate obfuscation of scale: while the risk of a single, catastrophic leak is acknowledged, it’s presented as manageable, diverting attention from the systemic dangers of creating a distributed, semi-private intelligence network reliant on proprietary AI models. The Wadhwani AI Center’s position—emphasizing the potential for models to learn nuanced, context-dependent cues – reveals a deep-seated concern about the degradation of human expertise. The exploration of nonclassified data training represents a desperate attempt to bridge this gap, but potentially embeds biases and over-reliance on the algorithms. This entire scenario echoes historical attempts to leverage emerging technologies – from early computers to drone warfare – promising transformative outcomes while simultaneously amplifying vulnerability. The PALANTIR contract – creating a secure environment for AI interaction – exemplifies the state’s preference for centralized control, arguably a defensive strategy against the inherent risks of decentralized intelligence. The urgency driving this initiative – the “race to incorporate more AI” – is itself a symptom of a systemic problem: the military's persistent underestimation of the complexities of information security. A key question is whether this pursuit of enhanced analytical power will ultimately lead to greater vulnerability or simply accelerate the pace of strategic miscalculation.

Sentinel — Likely Human

Confidence

The article reports on the Pentagon's considering training AI models on classified data, citing expert opinions and recent trends in AI development. While the writing is relatively coherent, several stylistic and attribution-related indicators suggest a degree of synthetic influence, leaning toward likely human-generated with some assistance.

Signals Detected

Sentence length variance is moderate, exhibiting some rhythmic patterns but lacking consistent uniformity, more typical of human writing.

The text presents a 'both sides' framing that feels somewhat manufactured and lacks the deeply held conviction one typically finds in expert journalism. The discussion of risk is presented rather neutrally, without a strong sense of urgency or concern.

Reliance on vague attributions like 'experts say' and 'studies show' without providing specific sources or methodology raises concerns about a lack of grounding and potential reliance on generic talking points.

The inclusion of a Signal username for contact is a noticeable detail, though not inherently suspicious, it aligns with common techniques of prompting responses and directing users towards specific channels - a strategy often employed in synthetic content creation.

Human Indicators

The article incorporates several recent, tangential news items (QuitGPT, ICE backlash, Moltbook, Yann LeCun's venture) which appear to be included to add breadth to the discussion and increase the perceived depth of the analysis.