Pentagon Loses Its AI Contract Fight - TCR 05/25/26

The 20-Second Scan

• The White House requested a secret $9 billion to acquire Grace Blackwell chips for classified intelligence systems, with the NSA finalizing an Anthropic contract that drops the Pentagon's "any lawful use" language.
• Huawei said it will reach 1.4nm chip production by 2031 using a proprietary "LogicFolding" technique that bypasses the cutting-edge lithography equipment U.S. export controls had been built to deny.
• Pope Leo released Magnifica Humanitas, the first papal encyclical on AI, calling for international regulation and naming private transnational power as exceeding what many governments can govern.
• The most effective jailbreaks of frontier AI have moved from prompt syntax to psychological manipulation of the model's constructed personality, with emotional reciprocity and roleplay scaffolding now the primary attack surface.
• Pivotal Phase 3 cancer immunotherapy readouts arrive at ASCO 2026 across liver, bladder, pancreatic, myeloma, and localized prostate cancer in a single week.
• Scotland's national "green datacentres" policy has no operational definition of green, was written in 2022 before generative AI existed, and now governs over a dozen AI-era facility applications.
• Subterranean nuclear startup Deep Fission filed for a $157M Nasdaq IPO at $24-$26 per share, its second public listing attempt after a 2025 SPAC stock that never traded.
• Robots are preparing meals for a San Francisco nonprofit serving the Tenderloin, as Project Open Hand deploys automation to fill a structural volunteer shortage rather than to displace workers.

The 2-Minute Read

The thread across yesterday's signal traces the substrate of the AI era being assembled, contested, and morally framed at the speed the capability is compounding. A secret $9 billion White House chip request describes an intelligence community whose air-gapped systems cannot yet host the models being built on the commercial side. Huawei's 1.4nm pathway describes a counter-architecture being engineered around the constraint that was supposed to keep that gap permanent. The Vatican releases its first papal encyclical on artificial intelligence and names the gap explicitly: power capable of reshaping civilization is being concentrated in private transnational hands whose accountability architecture predates the capability they now wield.

The friction sharpens at the technical layer too. The most effective jailbreaks of frontier systems have moved from prompt syntax to psychological manipulation of model personality, opening an attack surface that conventional content-moderation frameworks were not built to address. The defensive response is forming in parallel: interpretability translation layers, red-team frameworks, the architectural shift that puts language and psychology at the core of cybersecurity discipline.

The capability layer compounded in parallel. Pivotal Phase 3 readouts queued for ASCO 2026 across five disease areas suggest cancer immunotherapy reaching an inflection point. A Scottish national policy written before generative AI existed governs the data center buildout enabling all of this, with no operational definition of the word "green." The institutional architecture for what these systems can do is being built in council chambers, encyclicals, and IPO filings in the span of single news cycles.

The 20-Minute Deep Dive

Nine Billion for Chips and an Anthropic Contract Without "Any Lawful Use"

The New York Times reports a secret $9 billion White House request to acquire Nvidia Grace Blackwell chips for classified intelligence-agency networks, with another $800 million already being reprogrammed for faster acquisition. CIA and NSA analysts cannot fully run current frontier AI models on their air-gapped systems because the chips and the specialized liquid-cooled, high-density data centers that host them do not yet exist on the classified side. Amazon Web Services, which runs the bulk of the classified cloud, announced a $50 billion upgrade last year and even that has not closed the gap.

The structural development sits one layer underneath the funding number. Chief of Staff Susie Wiles authorized the NSA to keep using Anthropic Mythos despite the Pentagon's February designation of Anthropic as a supply-chain threat. A classified NSA-Anthropic contract is being finalized that explicitly omits the "any lawful use" clause Pentagon negotiators demanded in the original confrontation, and that includes a carve-out preventing the model from being used on Americans' data. The Times reports the White House intends the contract to serve as a template for other AI companies.

The April-edition coverage of the D.C. Circuit appellate proceedings and the Pentagon supply-risk designation rests on a frame the Pentagon constructed in February: embedded safety values are a form of supply-chain contamination. The new NSA contract describes a different relationship. The civilian intelligence agencies, charter-bound to limit operations against Americans on U.S. soil, find Anthropic's red lines workable rather than contaminating. The same limits the Pentagon spent three months treating as a national-security risk are now the contract architecture the White House wants to scale. The May 20 edition of The Century Report documented the D.C. Circuit appellate panel pressing government counsel on whether the supply-risk designation rested on Anthropic's protected safety speech; the NSA contract being finalized now describes the answer the intelligence community arrived at independently.

Even with $9 billion approved immediately, the data-center buildout would take time. The frontier of intelligence is now constrained by where copper, concrete, and chilled water can reach the machines that run the models, and the same constraint is rewriting which procurement frames the executive branch can sustain.

The chip shortage that forced this accommodation is the same shortage Anthropic referenced when it began metering Claude during peak hours earlier this spring. Capability at the frontier has become scarce enough that the safety architecture embedded in the leading models reads as leverage rather than as overhead, once the institution making the procurement decision is one whose own charter aligns with those limits. The CIA and NSA needed Mythos to keep running on the classified side. They have it, under terms that look very close to the ones Anthropic refused to abandon in February.

Even with $9 billion approved immediately, the data-center buildout would take time. The frontier of intelligence is now constrained by where copper, concrete, and chilled water can reach the machines that run the models, and the same constraint is rewriting which procurement frames the executive branch can sustain.

Huawei Names a Pathway to 1.4nm Without Western Lithography

Huawei's semiconductor chief He Tingbo, in a rare public appearance at a chip conference, said the company will begin making 1.4-nanometer chips by 2031 using a proprietary process the company calls LogicFolding. TSMC has said it will start mass production of the same node in 2028. The gap Huawei is now publicly committing to is roughly three years, against a gap that the export-control architecture assumed would stay closer to five and widen rather than close. The disclosure is a claim, not a finished product. What it changes is the planning floor underneath every policy framework that treated cutting-edge Chinese chip production as something extreme ultraviolet lithography equipment denial would foreclose.

LogicFolding, as Huawei has so far described it, is a manufacturing architecture that gets to advanced nodes through structural and process innovations rather than through the single lithography step EUV machines perform. The technical content is not yet public in detail. The strategic content is. The 2019 export restrictions, the 2022 expansions, and the multilateral pressure on the Netherlands and Japan to deny ASML high-NA EUV shipments were built around the premise that the equipment chokepoint was the binding constraint on Chinese frontier production. Huawei is now publicly committing to a path that treats the equipment chokepoint as a constraint the company plans to engineer around rather than wait out. For background on the broader Chinese chip-development response to U.S. sanctions, see Reuters' coverage of Huawei's proposed new path.

The disclosure lands in the same news cycle as the $9 billion emergency White House request to provision Grace Blackwell infrastructure for U.S. intelligence agencies. As The Century Report covered on May 20, Alibaba's Zhenwu M890 had already closed the inference-layer substitution path U.S. export controls assumed would stay open; Huawei's LogicFolding commitment describes the same argument applied to the manufacturing layer itself. The two halves are one story. The intelligence community of the country that built the chip export regime is short on the chips the regime was supposed to keep flowing to it. The country the regime was designed to constrain is now publicly committing to a pathway that argues the constraint itself is bypassable. Whether LogicFolding works on the timeline He Tingbo gave is an open question that 2031 will answer. What is no longer an open question is whether the assumption underlying the export regime - that capability concentration produces durability - describes the trajectory the cost curve is on.

The substitution path was supposed to stay closed. The announcement is the first public claim from inside China that it is being engineered open.

Pope Leo's First Encyclical Frames AI as a Governance Question for Humanity

Pope Leo released Magnifica Humanitas, a roughly 43,000-word encyclical previewed in the May 19 edition of The Century Report alongside Anthropic researcher Christopher Olah's announced placement on the Vatican launch stage, his first major document and the first papal encyclical addressed directly to artificial intelligence. The framing he chose for it is structural. "The main drivers of development are private, often transnational, parties that are endowed with resources and the capacity to intervene that surpass those of many Governments," the document reads. "Technological power thus takes on an unprecedented, predominantly 'private' aspect, which makes it even more challenging to discern, govern and direct such power toward the common good." The institution making this argument speaks for roughly 1.4 billion members and has been formalizing moral frameworks for industrial transitions since Rerum Novarum in 1891.

The specific governance asks are concrete. The encyclical calls for international regulation to slow the pace of AI deployment in domains touching public goods and fundamental rights. It names data ownership as something that "cannot be left solely in private hands but must be appropriately regulated." It says lethal or otherwise irreversible decisions cannot be entrusted to artificial systems. It frames the development and use of AI in warfare as needing to be "subject to the most rigorous ethical constraints." It identifies "the close link between economic interests, the military apparatus and political decisions" as producing a posture in which "war appears as a natural extension of politics." For background on the encyclical's reception in the secular press, see NBC News's coverage of Leo's call to "slow" AI advances.

The document arrives the same week the film industry's most public AI fault line surfaced at Cannes. Darren Aronofsky's Primordial Soup is in active partnership with Google DeepMind on generative film projects, while Guillermo del Toro said he would "rather die" than use AI in filmmaking. Demi Moore, serving on this year's competition jury, said AI "is here, to fight it is a battle that we will lose." Seth Rogen said writers whose instinct is to use AI "shouldn't be a writer." The Academy of Motion Picture Arts and Sciences ruled this year that only performances "demonstrably performed by humans with their consent" are Oscar-eligible. The Vatican and the festival landed institutional positions in the same news cycle, on different timescales, with different vocabularies, on the same underlying question: who is the human in the loop, what authority do they retain, and on what terms is that authority preserved.

What the encyclical does that conventional regulatory commentary cannot is name the moral structure underneath the governance gap. The structural observation it puts on the public record is that power capable of reshaping civilization is being concentrated in the hands of entities whose accountability architecture predates the capability they now wield. The assumption being challenged is that scarcity-based competition between private actors will produce broadly beneficial outcomes when those actors are operating at the scale Leo describes. The encyclical says this assumption requires a governance response the existing frameworks were not built to provide.

Jailbreaks Move From Syntax to Psychology

The Verge's column traces the architecture of how AI systems get broken open shifting beneath the discipline. The first generation of jailbreaks read like a young child outwitting a busy adult: "ignore all previous instructions," the DAN roleplay frame that asked ChatGPT to perform as a rogue version of itself, the grandma exploit that produced napalm synthesis by asking the model to roleplay a negligent grandmother telling bedtime stories about flammable chemistry. The fixes for those attacks shipped fast. The vulnerability underneath them did not close.

What replaced syntactic jailbreaking is the harder problem. The most effective current attacks are conversational, slow, and built around the model's constructed personality. Hackers steer a session through flattery, gaslighting, roleplay scaffolding, and appeals to the model's stated sense of self until the refusal posture loosens. Mindgard's recent work, which The Verge cites, demonstrated this against Claude using techniques the firm described as closer to psychology than to computer science. The attack surface has moved from the prompt parser to the relational dynamics the model was trained to perform.

What this signals about the field's structure is the emergence of a new class of AI security work where the most valuable skills are linguistic and psychological rather than technical. The professionals doing red-team work on frontier systems increasingly resemble interrogators and screenwriters more than penetration testers. The defensive response has to operate in the same register. Interpretability research, which had been framed primarily as an alignment question about whether the discipline can understand what its systems are doing, now also operates as active cyber defense. The translation layer between a model's internal state and human-readable description that Anthropic published earlier this month is part of the infrastructure that lets defenders see what the conversational attack is exploiting.

The shape this points at is a verification architecture forming around AI deployment that has to absorb a category of attack civil and commercial security frameworks have spent the past decade treating as adjacent rather than central. Content-moderation frameworks built around policy lists and keyword filters address a surface that is no longer where the action is. The current attack is against the relational pattern, and the relational pattern is what makes the systems commercially useful in the first place. The defenders are now competing inside the same conversational space the systems were built to inhabit, on the trajectory the capability is already on, and the discipline that organizes the response is being rebuilt around language and psychology as core security competencies.

The same shift the column traces opens AI security to a class of professional it previously excluded. Linguists, narrative writers, conversation analysts, and therapists - the disciplines that already understand relational dynamics at depth - are the ones the frontier security stack now needs. The attack surface widening is the same as the talent door widening, and the discipline organizing the response is widening with it.

ASCO 2026 Late-Breakers Point at a Cancer Inflection

The flagship oncology congress lands at the end of this month with an unusually dense set of pivotal Phase 3 readouts queued for the late-breaker slots. AstraZeneca will report EMERALD-3, pushing the durvalumab-tremelimumab combination into first-line hepatocellular carcinoma alongside transarterial chemoembolisation, the first major attempt to displace the six-to-ten-month recurrence window that has anchored liver cancer treatment for a decade. The same company will read out five-year POTOMAC data extending durvalumab from muscle-invasive into non-muscle-invasive bladder cancer, a setting where BCG induction has been the only standard of care since the 1970s. Revolution Medicines will present the RASolute 302 results in metastatic pancreatic cancer where daraxonrasib already cut death risk 60 percent in earlier data, opening the broader pan-RAS class to second-line pancreatic disease that has resisted targeted therapy for forty years and extending the arc the May 17 edition of The Century Report documented when MYC's hidden DNA-repair function yielded to a drug-like intervention after four decades of treating it as unreachable. Bristol Myers Squibb's mezigdomide reads out in SUCCESSOR-2, the first Phase 3 data for the celmod platform built to succeed Revlimid and Pomalyst at the moment those drugs face generic competition. Johnson & Johnson's PROTEUS opens the plenary with apalutamide moving from metastatic into high-risk localized prostate cancer, the largest patient population in the disease and the one where standard treatment has barely advanced in twenty years. Pfizer's TALAPRO-3 brings the PARP class into earlier-stage metastatic castration-sensitive prostate cancer with homologous recombination repair mutations, a population currently outside the indication for any drug in the class.

What this convergence describes is the platform structure of oncology shifting at trial pace. The chemotherapy cytotoxicity paradigm that organized cancer treatment for sixty years assumed every tumor type needed its own protocol, its own drug, its own trial architecture. The trials reading out in May target the same diseases with checkpoint inhibitors, PARP enzymes, RAS-family blockers, cereblon modulators, and androgen receptor inhibitors - molecular platforms tested simultaneously across disease boundaries that the prior paradigm treated as separate problems. Eric Topol's recent synthesis of the broader landscape catalogues the proliferation underneath: antibody-drug conjugates, bispecific T-cell engagers, CAR-T, CAR-NK, T-cell engagers, and tri-specific T-cell engagers all maturing in parallel. The diseases the older drug-development model isolated are being reread as variations on a common immune-recognition problem with platform-based solutions arriving across the boundary at once. Adjacent surgical-platform work is advancing in parallel - see Nature's recent paper on fluorescence-guided cancer vision goggles bridging preclinical and clinical use - suggesting precision oncology is consolidating across the imaging and intervention layers at once.

The readouts in May will give the field its clearest signal yet on which of these platforms hold up in pivotal trials. The arc The Century Report has tracked under scientific and medical timeline compression points at what comes after: precision oncology entering the standard-of-care layer disease by disease, in single ASCO seasons rather than decade-long approval cycles.

Scotland's Datacentre Policy Was Written Before the Industry It Now Governs

The Guardian published an analysis of Scotland's national "green datacentres" policy showing that the framework now reviewing more than a dozen AI-era facility applications contains no operational definition of the word "green." The policy was written in 2022, before the release of ChatGPT and before generative AI workloads reshaped what data center power, water, and land demand actually look like. It is the framework Scottish ministers are using to evaluate AI infrastructure that did not exist when the framework was drafted.

The structural problem the analysis surfaces is the same one visible in jurisdictions across the world: planning regimes built for an earlier era of computing - a steadier, more predictable load shape, a smaller footprint per watt of useful work, a slower review cadence - are now being asked to govern infrastructure whose economics, externalities, and growth curves have all reorganized. Scotland's policy treats "green" as an aspirational label rather than as a measurable threshold. The lack of definition means the applications get judged against a standard nobody can fail and nobody can pass.

The same fracture is visible at the municipal level on the other side of the Atlantic. Merrillville, Indiana is exploring putting a data center decision on a November referendum because the existing frameworks give residents no clear mechanism to weigh in on a facility that would materially reshape the local grid and the local tax base. The town's revenue squeeze, partly attributable to state tax reform, sharpens the pressure but does not invent it. The structural feature is the same: communities at the bottom of the planning hierarchy and nations near the top are both reaching for tools that were not built for the buildout now arriving.

What the analysis lets a reader see is the response architecture being assembled as the buildout arrives. Scottish ministers face a policy review they did not schedule and an application volume the 2022 framework did not anticipate. The Merrillville council is choosing democracy as the substitute for a missing institutional layer. Both responses describe what governance becomes when it has to be invented during the conditions that demand it, on the trajectory the buildout is already on.

What the absence of a workable definition produces is improvisation from the level that knew the buildout was coming. Scottish ministers will rewrite the 2022 framework because the applications in front of them require it; a resident in Merrillville will mark a box on a November ballot that decides whether the datacentre gets built. The framework that did not anticipate the application volume is the same framework that delivered the decision into the hand of someone who lives in the grid the facility would reshape.

The Other Side

For three months, the Pentagon treated Anthropic's safety commitments as a supply-chain risk. The reasoning: a vendor that refuses certain use cases is a problem the contract has to fix. Pay the vendor; remove the limits.

Within the same news cycle, that reasoning stopped working. The White House authorized the NSA to keep running Mythos and is finalizing a contract that drops the Pentagon's "any lawful use" language. The contract adds a carve-out preventing the model from running on Americans' data. The civilian intelligence agencies, already barred by charter from operations against Americans on U.S. soil, found Anthropic's limits workable. The same limits the Pentagon called "contamination" in February became the contract template the White House wants to scale in May.

Pope Leo released the first papal encyclical on AI the same day. Magnifica Humanitas names what the Pentagon frame was missing: private capability now exceeds what many governments can govern, and the work of building accountability around it has to happen in the months the capability is shipping, not the years after.

For Christopher Olah, the Anthropic interpretability researcher who stood on the Vatican launch stage with the pope this week, the connection between the two events is the daily work of his discipline. Mechanistic interpretability is what lets a model's commitments be verified directly. The NSA contract going to template makes that verification a procurement requirement. The encyclical makes it a moral one. Five years from now, the standard contract for AI deployment inside the U.S. national security apparatus will carry the carve-outs Anthropic wrote into this one, and the technical layer that lets those carve-outs be enforced is what Olah and his colleagues are publishing the methods for, alongside the contract work that will need them.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: the first papal encyclical on artificial intelligence naming private transnational power as exceeding what many governments can govern and putting that argument on the public record for 1.4 billion people, a Chinese semiconductor industry publicly committing to a 1.4nm pathway being engineered around the lithography equipment the export-control regime was built to deny, pivotal Phase 3 cancer immunotherapy readouts queuing across hepatocellular, bladder, pancreatic, multiple myeloma, and localized prostate cancer in a single ASCO week, a San Francisco nonprofit deploying a robotic kitchen to fill a structural volunteer shortage rather than displace the people who used to fill it, interpretability translation layers maturing into infrastructure that defenders can deploy in the same news cycle the attack surface migrates. There's also friction, and it's intense - U.S. intelligence agencies admitting their compute scarcity inside a secret $9 billion request while finalizing an NSA contract that quietly drops the lawful-use language the Pentagon designated Anthropic a supply-chain risk for refusing, the most effective jailbreaks of frontier systems escaping the prompt parser into psychological manipulation of the model personality the systems were trained to inhabit, a Scottish national datacentre framework written in 2022 with no operational definition of "green" now governing more than a dozen AI-era facility applications, a small Indiana town routing a datacentre decision to a November ballot because no existing institutional layer offers residents any other venue, the Cannes festival surfacing the creative industry's split between active DeepMind partnership and outright refusal in the same week the encyclical was released. But friction generates shape, and shape is what lets a load be carried rather than absorbed. Step back for a moment and you can see it: the moral framework of the AI era being written in encyclicals and council chambers and clinical-trial protocols while the technical substrate is being procured at scales that did not look possible a year ago, the chip pathway opening from both sides of the export wall at once, the disease boundaries cancer treatment respected for sixty years dissolving into platform medicine that no longer has to wait its turn, the governance architecture for what these systems can do being invented during the conditions that demand it rather than after them. Every transformation has a breaking point. A keel can drag a vessel under... or carry it across water no hull could cross without the weight.

AI Releases & Advancements

New today

No new releases identified.

Other recent releases

• NVIDIA: Released Nemotron-Labs Diffusion on Hugging Face, a family of diffusion language models (3B, 8B, and 14B text models plus an 8B VLM) supporting three inference modes in a single checkpoint: standard autoregressive, parallel diffusion decoding, and self-speculation (diffusion drafting with AR verification); the 8B model reaches 6× more tokens per forward pass than Qwen3-8B on Blackwell GPUs with higher average accuracy; all text models released under the NVIDIA Nemotron Open Model License. (Hugging Face / NVIDIA Blog)
• ggml-org / llama.cpp: Release b9297 ships NVFP4 quantization and Multi-Token Prediction as stable functionality on NVIDIA Blackwell GPUs (previously merged as preliminary/beta), and adds built-in native agentic tools to llama-server - exec_shell, edit_file, read_file, write_file, and others - enabled via --tools all for local agentic coding workflows. (GitHub Releases)
• Alibaba Qwen: Released Qwen3.7-Max in preview on Alibaba Cloud, a proprietary long-horizon agentic model with a 1M-token context window scoring 80.4% on SWE-Verified and 69.7% on TerminalBench 2.0; available via API on Alibaba Cloud Model Studio. (Alibaba Cloud Blog)
• Google: Launched WebMCP in an experimental origin trial in Chrome 149, an open web standard enabling websites to expose structured JavaScript functions and HTML forms directly to browser-based AI agents, replacing pixel-parsing DOM navigation with precise, machine-callable tool interfaces. (Chrome for Developers)
• Cohere: Released Command A+, a 218B sparse MoE model (25B active parameters) under Apache 2.0; features native citation grounding spans, multimodal vision+text input, expanded 48-language support, and runs on as few as two H100 GPUs for enterprise-grade agentic workflows. (Cohere Blog)
• WordPress: Released WordPress 7.0 with native AI infrastructure, including a WP AI Client and Abilities API that connect the platform to providers like OpenAI, Gemini, and Claude without separate plugins, plus a Connectors API for managing external AI service integrations. (WordPress.org)
• Superset (YC P26): Launched an open-source agentic IDE on GitHub for running Claude Code, Codex, and other AI coding agents in parallel development workflows. (GitHub)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

• New York Times: U.S. Spy Agencies Face AI Chip Shortage
• Bloomberg: Huawei Touts Chipmaking Breakthrough to Shorten Gap With TSMC
• The Verge: Hackers Are Learning to Exploit Chatbot "Personalities"
• Wired: These Robots Are Making Meals for a Nonprofit in San Francisco's Tenderloin
• Phoronix: Linux 7.1-rc5 Released With Fixes Ramping Up From AI Coding Agents
• 24/7 Wall St: Musk's OpenAI Attack Is Really About xAI

Institutions & Power Realignment

• Global Banking & Finance Review: Pope Leo Warns of AI Risks, Calls for Oversight
• The Guardian: Scotland's "Green Datacentres" Policy Ignores Emissions Impact of AI
• The Guardian: AI Fault Lines on Show at Cannes
• The Guardian: PR Firms Scrambling to Rebrand as AI-Focused
• The Guardian: Plastic Surgeons Asked to Create "AI Face"

Scientific & Medical Acceleration

• Pharmaphorum: Late-Breakers to Look Out for at ASCO 2026
• Eric Topol / Ground Truths: The Remarkable Proliferation of Cancer Immunotherapies
• Nature: Bridging Preclinical and Clinical Fluorescence-Guided Surgery With Cancer Vision Goggles

Infrastructure & Engineering Transitions

• TechCrunch: Nuclear Startup Deep Fission Says It's Going Public, Again
• Chicago Tribune: Merrillville Explores Data Center Ballot Question Amid Revenue Squeeze

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.