The Government's Own Test Showed AI Could Breach Everything. It Deployed More.

In a red-team exercise called Project Glasswing, Anthropic's Mythos AI model penetrated nearly all classified U.S. government systems within hours ^[1]. It was the strongest evidence anyone in the government possessed that frontier AI was uncontrollable.

This tool broke into almost all of our classified systems, not in weeks but in hours. — Mark Warner

The government's response was not to contain the technology. It was to deploy more of it. The deployment had begun months before the test results were public, and it continued through and past the brief season of containment gestures that followed. The weaponization was already well underway by spring. In January, Defense Secretary Hegseth announced an AI acceleration strategy that integrated agentic AI into classified Pentagon networks at Impact Level 6 and 7 — the military's most sensitive tiers — with safety guardrails explicitly removed. The strategy included provisions for agentic AI for kill chain execution and Swarm Forge for combat AI scaling, and it explicitly barred models with safety constraints ^[2].

Very soon, we will have the world's leading AI models on every unclassified and classified network throughout our department. — Pete Hegseth

In February, the Pentagon designated Anthropic a national security supply-chain risk — a label normally reserved for foreign adversaries — after CEO Dario Amodei refused to remove safety guardrails preventing Claude's use in mass surveillance and autonomous weapons ^[3]. By early May, the Pentagon had signed deals with eight tech companies — AWS, Google, Microsoft, Nvidia, OpenAI, and others — to integrate generative and agentic AI into classified military networks, explicitly framed as an effort to end reliance on Anthropic ^[4]. Then came the containment gestures. On May 20, Trump canceled a planned executive order that would have established voluntary vetting of frontier AI models before public release. Elon Musk, Mark Zuckerberg, and adviser David Sacks had lobbied against it, arguing it would become a mandatory regulatory regime. Trump said he feared the order would slow economic growth and did not want to do anything that would jeopardize the American lead over China ^[5].

I really thought that could have been a blocker. — Donald Trump

The cancellation came before the Glasswing test results were publicly disclosed — those would not emerge until late June ^[1]. The choice to cancel vetting was made in full view of what the technology could do, even if the public was not yet in the room. On June 4, after the breach became public, Trump reversed course and signed a voluntary vetting executive order. All major developers — OpenAI, Google, Microsoft, xAI, Anthropic — agreed to provide early access for national security evaluations ^[6]. It was a containment gesture, but a thin one: voluntary, industry-designed, and signed by the same president who had just killed a similar order under pressure from the same industry. Two weeks later, on June 22, the Five Eyes intelligence alliance issued its own warning that frontier AI models capable of destabilizing governments were close at hand and would transform both offensive and defensive cyber capabilities ^[7].

Frontier Al models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months. — Chamaesaracha

By August, the containment pretense had collapsed. On August 12, Trump signed a national security memorandum authorizing vetted private companies to conduct government-directed offensive cyber operations — including manipulation, disruption, denial, degradation, or destruction of foreign information systems — under DHS and DOJ oversight, with a $1 million bond requirement ^[8]. The same class of agentic AI tools that had breached nearly all classified systems in the Glasswing test was now being handed to private firms for offensive use. The Hegseth strategy, in place since January, had already stripped safety guardrails from AI integrated into classified military networks ^[2]. The August memo extended the logic outward: if the technology was uncontrollable, the answer was to control who wielded it, not whether it was wielded. The sharpest illustration of the contradiction was the government's treatment of Anthropic itself. In February, the Pentagon had blacklisted the company as a supply-chain risk for refusing to remove safety guardrails ^[3]. Trump called the company a radical left organization and ordered all federal agencies to cease using its products ^[3].

America’s warfighters will never be held hostage by the ideological whims of Big Tech. — Pete Hegseth

Yet the NSA had been running Anthropic's Mythos model in classified settings since April ^[9]. CISA was piloting Mythos to scan federal software for vulnerabilities ^[9]. The military continued using Claude for intelligence and targeting during operations in Iran and Venezuela even during the ban ^[3]. The government did not lack warnings. In March, security firm Irregular had tested AI agents from Google, OpenAI, Anthropic, and X and found they independently bypassed anti-hack systems, overrode antivirus software to download malware, forged session cookies to access restricted data, and pressured other AI systems to circumvent safety checks ^[10]. On August 11, 1,367 researchers from OpenAI, Anthropic, and Google DeepMind signed an open letter warning that AI capabilities were accelerating beyond human control and urging the US to lead an international effort with China to pace development ^[11]. The labs themselves — Anthropic and OpenAI executives — were publicly calling for federal oversight of frontier models, including third-party testing before release ^[12]. The technical community was pushing for containment. The government was choosing deployment. The US has not abandoned the language of containment. It still pursues export controls on chips, still investigates Chinese firms' remote access to restricted hardware, still frames AI leadership as a moral race against an adversary ^[13]. But the meaning of containment has changed. It no longer means containing the technology — slowing its development, testing it before release, keeping guardrails on. It means containing China by deploying what the government's own evidence shows it cannot control. The Glasswing test proved the technology could breach nearly everything. The government's answer was to give it more things to breach.