While public debate focuses on models like ChatGPT, Claude and Gemini, a substantial share of artificial intelligence development for military and national‑security use unfolds under classification. That reality complicates efforts to slow down frontier AI: it is difficult to assess and negotiate limits when the scope and capabilities of state programs are largely unknown to the public and to external verifiers.
Legal carve‑outs: the AI Act and military systems
The European Union’s AI Act imposes detailed rules on civilian AI applications but contains an important exception: it does not apply to AI systems used exclusively for military, defence or national security purposes. Legally this is understandable on sovereignty and operational secrecy grounds, but it means that while civilian AI becomes more regulated and auditable, precisely those developments with the most severe strategic consequences may continue in a different, closed regulatory universe.
Public signs and visible programmes
Although many military projects are classified, public programmes and disclosures illustrate the broader directions. In July 2026 an adapted F‑16 flew a test in which an AI agent autonomously controlled the aircraft under human supervision. DARPA’s DICE programme researches decentralized collaboration of AI agents for long‑duration missions in hostile environments, currently in simulation. France created a military AI agency (AMIAD) and identified roughly 400 AI use cases across intelligence, imagery, cyber and decision support; in 2025 it commissioned a classified supercomputer for sensitive military data. The United Kingdom launched the Rapid AI Delivery Taskforce in 2026 with an initial £100 million to accelerate military adoption of AI and other advanced technologies.
In the United States, public procurement shows a reliance on commercial frontier AI: in 2025 the Department of Defense awarded framework contract capacity of up to $200 million each to Anthropic, Google, OpenAI and xAI to develop advanced AI systems and autonomous workflows for national‑security uses. But public contracts do not exclude the parallel existence of classified programmes.
Historical precedents for secrecy
History shows that strategic technical programmes can remain concealed for long periods. At its height the Manhattan Project employed about 130,000 people; the US public learned of it only after the atomic bombings. The A‑12 OXCART reconnaissance aircraft was operational by 1965 while the programme stayed secret; the Pentagon publicly acknowledged the F‑117 only in 1988. DARPA‑supported Amber UAV flew continuously for over 38 hours in 1988—such examples caution against assuming today’s military AI efforts are transparent.
Strategic capability is more than the base model
Debate often focuses on how capable a single base model is, but military AI power is typically an emergent property of a capabilities stack. A concise formulation: AI capability system = base models × specialized models × data × alignment/coordination × compute × access × autonomy × authority. In other words, a military AI’s real impact comes from the full system—specialized components, classified data, system integration and operational permissions—not solely from whether an underlying model is a generation ahead.
A relatively modest base model, if paired with classified datasets, specialized modules, high compute, rapid deployment and operational autonomy, can become far more consequential than a standalone frontier model in civilian hands.
Visible compute, invisible workloads
Large AI development requires physical infrastructure—data centres, accelerators, energy, cooling and engineers—that can be tracked to a degree. But observing compute capacity does not reveal the workload running on it. US intelligence communities plan to mix government and commercial cloud capacity for AI and high‑performance computing; the Pentagon’s Joint Warfighting Cloud Capability (JWCC) can span commercial providers including Amazon, Google, Microsoft and Oracle up to Top Secret levels. From outside, it is often impossible to tell whether accelerators are training a chatbot, simulating weather, discovering molecules or fine‑tuning a classified intelligence system.
The verification problem behind pacing proposals
Proposals to ‘pace’ frontier AI—slowing development to allow time for safety work, external evaluation and verifiable commitments—are important. Dario Amodei, co‑founder and CEO of Anthropic, has argued in his essay “We Must Pace the Frontier” for capability‑based, national AI safety requirements and independent assessment. But Amodei also highlights the core obstacle: verification. How can international agreements be credible if parties may be maintaining secret, untested models for military use? This creates a security dilemma: no state wants to unilaterally slow down if it fears others are secretly gaining advantage.
Unlike nuclear or missile systems—where physical signatures, test yields or silos leave detectable traces—AI development can be hidden in software, data access, or classified compute workloads. Questions include: how can one prove a new model has not been trained? whether a commercial model has undergone classified fine‑tuning? what datasets and networks a system accesses? and what degree of decision autonomy it can exercise?
From transparency to credible oversight
State secrecy has legitimate rationale: revealing operational capabilities, intelligence methods or vulnerabilities can be harmful. Yet AI raises novel boundary problems. As systems gain autonomy and interact with civilian infrastructure, failures in a classified system can have public consequences. Thus the policy need is not necessarily full public transparency but credible oversight mechanisms that allow capability to remain classified while ensuring its use, risks and accountability are sufficiently controlled.
Auditable, independent verification regimes, agreed thresholds for capability, and institutional procedures to review classification decisions and incidents would be necessary components. Without such arrangements, public regulatory measures like the AI Act, ISO standards and corporate safety pledges will address primarily the visible, auditable domain while leaving a large and strategically important area unverified.
Conclusion
If advanced AI becomes a genuinely strategic military capability—as public programmes in the United States, China, France, the UK and others suggest is plausible—international policy must confront the same core challenge faced in earlier strategic technologies: not only defining prohibited behaviours, but finding ways to verify compliance. That task may be one of the hardest political and technical challenges of the AI era, because we still struggle to specify exactly what would need to be verified. Meanwhile, as public debate rightly focuses on civil frontier models, crucial elements of the AI arms race may remain behind doors labelled ‘classified’. As Saint‑Exupéry’s phrase applies in a different context: what truly matters can be invisible to the eye.
