On the morning of February 28, 2026, the United States and Israel launched a coordinated military campaign against Iran. Within 24 hours, a commercial AI model that most people use to draft emails, write code, and summarise documents had become the intelligence engine at the centre of one of the most complex military operations in modern history — processing satellite imagery, synthesising signals intelligence, and navigating military planners through a real-time operational environment at a speed and scale no human team could match. That AI was Claude, built by Anthropic. Crucially, Anthropic had been blacklisted as a national security threat by the same government relying on its technology — hours before operations began.

This is not a hypothetical about the future of AI in warfare. It is not a think-tank scenario or a war-game exercise. It happened. The evidence comes from the Wall Street Journal, the Washington Post, CBS News, Wired, and a US Senate Armed Services Committee hearing at which a Pentagon official confirmed the deployment under oath. Understanding exactly what occurred, why it matters, and what it means for enterprise AI governance is now essential for every technology leader — not because it changes what you are building today, but because it defines the world in which you are building it.

How Claude Navigated Iran — The Full Sequence

The Technical Architecture: How Claude Navigated a Live Operational Environment

Understanding what Claude did inside the Maven Smart System is essential context for everything that follows. Critically, Claude was not making autonomous decisions. It was not independently commanding weapons systems. Instead, it functioned as a real-time intelligence engine — processing, synthesising, and navigating vast amounts of data faster than any human team could manage.

That final function — automated legal justifications — is arguably the most consequential. International humanitarian law requires that each military strike be assessed for proportionality, military necessity, and distinction between combatants and civilians. These are complex legal and ethical judgments that traditionally require trained lawyers and senior commanders. In the Maven Smart System, Claude generates them automatically as part of the targeting output. The question of whether machine-generated legal justifications satisfy the requirements of international law — and whether they actually protect civilians or merely provide documentation that a strike occurred — remains entirely unresolved.

What Anthropic Refused — And Why It Was Blacklisted for Refusing

The Pentagon’s specific demand was that Anthropic agree to deploy Claude for “all lawful purposes” — language that the Pentagon argued was merely confirming what existing law already permitted. Anthropic refused, insisting on two explicit contractual restrictions:

Red Line 1: No mass domestic surveillance of Americans. The Pentagon argued this was unnecessary because domestic surveillance of Americans is already illegal. Anthropic responded that if it is already illegal, there is no cost to writing it into the contract — and declined to remove it. The Pentagon rejected this position.

Red Line 2: No use of Claude to power fully autonomous lethal weapons. Specifically, no use of Claude as the decision-making layer in weapons that strike without human approval. Pentagon internal policy already restricts autonomous weapons — but Anthropic wanted this in the contract, not merely in internal guidance that could change. The Pentagon refused.

In response to these refusals, Anthropic received a designation previously used only for Chinese telecommunications companies suspected of being back-doored by the Chinese government. Furthermore, the White House issued a statement from spokeswoman Liz Huston: “Under the Trump Administration, our military will obey the United States Constitution, not any woke AI company’s terms of service.”

What OpenAI Agreed to That Anthropic Would Not

Hours after the Anthropic blacklisting, OpenAI CEO Sam Altman announced an expanded deal to deploy ChatGPT on the Pentagon’s classified networks. The contrast between the two companies’ positions is instructive:

The Electronic Frontier Foundation’s analysis of OpenAI’s Pentagon contract identified what it called “weasel words” — the prohibition on “intentional” domestic surveillance creates a loophole large enough to drive a tank through: bulk data collection that “happens to” sweep up Americans is technically not prohibited. Consequently, the distinction between the two companies’ positions may be narrower in practice than it appears on paper.

The Strike That Congress Cannot Get Answers About

On or around March 5, 2026, a US strike hit the Shajareh Tayyebeh girls’ school in Iran. More than 175 people — predominantly children — lost their lives. More than 120 House Democrats immediately demanded answers about the role of AI-assisted targeting in the strike. Representatives Jacobs, Crow, and Ansari wrote directly to Defense Secretary Hegseth: “Was artificial intelligence, including the use of Maven Smart System, used to identify the Shajareh Tayyebeh school as a target?”

The March 20 deadline passed without a public response. The question of whether Claude’s targeting output contributed to the identification or prioritisation of the school as a strike target remains unanswered. Furthermore, it may never be fully answered publicly — the relevant data exists in classified systems, and the chain of human decisions between Claude’s output and the weapons release is not documented in any public record.

This is precisely the governance gap that matters. Claude did not fire the missile. Human commanders approved each strike. However, if Claude’s target prioritisation included the school, and if human commanders approved it partly on the basis of that AI output — including the automated legal justification Claude generated — then the question of moral and legal responsibility becomes extraordinarily complex. International humanitarian law currently has no framework for attributing liability in AI-assisted targeting chains of this kind.

Five Implications for Every Organisation Deploying AI Today

First, AI deployment decisions are permanent in the short term. Anthropic built Claude into classified military networks in November 2024. By February 2026, the integration was so deep that even a presidential ban could not remove it within a meaningful timeframe. The military told the Washington Post that Claude will remain in the targeting chain until a replacement is ready — a process expected to take at least six months. Every organisation deploying AI into critical infrastructure, compliance processes, or high-stakes decision support should ask: if we needed to remove this tomorrow, could we?

Second, automated legal justifications are a specific and serious risk. The most alarming technical detail in the Maven deployment is not target identification — it is the generation of automated legal justifications for each strike. In enterprise terms, the analogue is AI systems generating automated compliance documentation, regulatory sign-offs, or liability assessments. The risk is that human reviewers develop an over-reliance on machine-generated justifications and fail to apply independent judgment. This is already happening in financial services, healthcare, and legal practice.

Third, guardrails have commercial value but also commercial cost. Anthropic’s blacklisting cost it government contracts worth hundreds of millions of dollars. However, its consumer downloads surged — more than 1 million new signups per day, making it the number-one AI app in 20+ countries. Anthropic CEO Amodei stated: “Disagreeing with the government is the most American thing in the world. We are patriots.” The market appears to have agreed. Consequently, the conventional wisdom that maintaining ethical guardrails is purely a cost to AI companies may need to be revisited.

Fourth, the “human in the loop” is not a sufficient safeguard by itself. Claude’s defenders — including the Pentagon — have repeatedly emphasised that Claude was a decision-support tool, not an autonomous weapons system. Human commanders approved every strike. However, when a human commander reviews a prioritised target list of 1,000 items generated at the speed of thought, with GPS coordinates and a legal justification attached to each, the nature of human oversight changes fundamentally. Speed, volume, and authority combine to make rubber-stamping likely and genuine review difficult. This is a governance failure that “human in the loop” language does not capture.

Fifth, the AI governance framework that does not yet exist is being built in real time through these events. Before Operation Epic Fury, the debate about AI in military targeting was largely theoretical. Now, it has specific facts, documented deployments, named casualties, and live litigation. The outcome of Anthropic’s federal lawsuits will set legal precedents that govern every AI company’s relationship with government customers. Furthermore, the congressional investigation into the girls’ school strike — however limited — will produce documentary evidence about how AI targeting chains actually function. Enterprise AI governance frameworks built in 2026 will be built in the shadow of these facts.