Washington Now Treats AI Compute as Military Infrastructure

In March, the U.S.-China Economic and Security Review Commission said out loud what its own strategy had been quietly conceding. The commission has spent years pushing export controls as the main line of defense in the AI race. This spring it admitted those controls cannot reach the part of the race that matters most.

US export controls primarily target the digital loop, restricting access to advanced chips used for frontier model training — but are not well suited to addressing the physical loop of deployment-driven data creation and accumulation across China’s manufacturing base. — U.S.-China Economic and Security Review Commission

The gap is not theoretical. Chinese models improve partly by running in the real world, learning from the data that deployment generates, and no chip ban stops that. ^[1] So Washington has begun building a second layer on top of the first. It treats computing power not as a commercial asset to be licensed and restricted but as military infrastructure to be protected and, if necessary, destroyed. The protection side is now visible on the map. The Pentagon is putting AI data centers on military bases: Fort Hood, Fort Bliss, Dugway Proving Ground. Private companies get the land and build the compute; the Army gets a share of the computing power. ^[2][3] Army Secretary Dan Driscoll made the reclassification plain.

AI is a strategic asset for the Army. — Dan Driscoll

Congress is moving to ban Chinese and Russian components from these facilities, and one lawmaker has proposed building on bases specifically to dodge civilian opposition, speculating that foreign money is funding the protests. ^[4] The logic is consistent: compute is now something you defend with a fence line and a flag. The targeting side is newer and sharper. In a report published this week, Jacob Stokes, deputy director of the Center for a New American Security, a mainstream Washington think tank rather than a fringe outfit, urges the United States to assess the feasibility of missile and bomb strikes on Chinese AI computing facilities, to keep China from reaching artificial general intelligence first. ^[5] He frames the policy problem the way past generations framed a different one.

Bombing would cross a major threshold that heretofore has not been crossed in US-China relations. — Jacob Stokes

He also argues that cyberattacks to sabotage Chinese AGI might not provoke large-scale retaliation, a sentence that treats the question of whether to attack as already settled and only the method as open. ^[5] This is not a Pentagon proposal. But it is the kind of proposal that a year ago would have lived in the margins, and the distance between a think tank and a targeting order is shorter than it used to be. Project Maven, the Pentagon's AI targeting system, is already generating target locations and weapon pairings for active operations in Syria, Iraq, Yemen, and Ukraine. ^[6] Here is what makes this moment strange. The old layer has not gone away. It is still growing. In June the United States and 34 other nations launched Pax Silica, a pact to diversify chip and compute supply chains away from China. ^[7] The Treasury is still investigating model theft, the FCC is still banning foreign robots, and the two governments are still planning bilateral AI talks for this month. ^[8] In late August, American and Chinese officials met in Beijing and agreed to work on mitigating the risks of artificial intelligence. ^[9] So the same government is, in the same season, negotiating AI risk reduction with Beijing and reading a report on how to bomb Beijing's data centers. That is not a contradiction anyone has resolved. It is a stack: a kinetic doctrine built on top of a containment doctrine, both running at once. The institutions meant to settle which one wins are moving slower than the stack is growing. A federal judge in August blocked the Pentagon's designation of Anthropic as a national security supply-chain risk, a label normally reserved for foreign adversaries. ^[10] The designation came after Anthropic's chief executive refused to strip the safety guardrails that keep its models out of mass surveillance and autonomous weapons. ^[11] Defense Secretary Pete Hegseth's answer was not to negotiate.

have to be very careful about how we come to (AI's) employment and its inspiration into the delivery of lethality. — Frank M. Bradley

The Pentagon replaced Anthropic with xAI's Grok and is now requiring every AI vendor to commit to an "all lawful purposes" standard. ^[12] The judge's ruling slowed one designation. It did not slow the doctrine. The clearest measure of how far the ground has moved is the document the State Department published a year ago. "Defense in Depth," written with the safety group Gladstone.AI, treated advanced AI as a threat comparable to nuclear weapons and prescribed training-data limits, safety research, and a consortium of 200 organizations. ^[13] It was a containment document about domestic safeguards. Nothing in it contemplated targeting another country's compute. A year later, the administration's executive order is about accelerating military adoption, and the think tank next door is studying strike options. ^[14] None of this is settled. The courts are pushing back, some AI firms are refusing, and the diplomatic track with Beijing is still open. What has changed is the default. Computing power is now something the United States protects with military force and contemplates destroying with military force, while the older machinery of licenses and negotiations keeps running underneath. The two doctrines are expanding at different speeds, and the faster one is not waiting for the slower one to catch up.