OpenAI Classified Network Deal: What Was Agreed

On February 28, Sam Altman announced that OpenAI had reached an agreement with the Department of War to deploy its models inside the DoW's classified network. The announcement is a few hundred words long, but nearly every sentence encodes a real decision about how frontier models will operate in classified environments. Because this is one of the first agreements of its kind at this scale, those decisions are likely to become the template that other labs sign against. The terms read like an architecture doc because they describe the deployment architecture.

What the agreement actually covers

Stripping out the diplomatic language, Altman's post commits OpenAI to a specific deployment shape and commits the DoW to specific constraints:

The terms define the engineering and policy consequences of the deployment.

What "cloud networks only" means in a classified environment

Classified networks are air-gapped from the public internet by design. Getting commercial software onto them has historically meant one of two paths: deliver the software to government-operated hardware inside the boundary, or deploy into the accredited classified cloud regions that major providers have operated for the government for years. Either way, the software goes through a security authorization process against government controls before anyone on the network can touch it.

For a frontier lab, the difference between those two paths is enormous, and it comes down to weights custody. Delivering a model to government-owned metal means handing over the weights as files, at which point the lab has lost control of the most valuable artifact it owns. It can't push updates on its own schedule, can't observe how the model is behaving, and can't revoke anything. A cloud-only deployment keeps the weights inside provider-operated enclaves where the lab retains an operational relationship with its own model: update paths, telemetry, the ability to intervene.

"Cloud networks only" and "technical safeguards" belong in the same announcement because safeguards that "ensure our models behave as they should" require the lab to be able to see and modify the running system. Weights sitting on hardware you can't touch leave ongoing safety oversight without a mechanism behind it. Cloud-only deployment plus on-site engineers is roughly the minimum architecture under which a lab can claim that it still supervises its model's behavior after handoff.

Cloud-only keeps the models in data centers. Disconnected and tactical environments, the ships and vehicles and forward locations where connectivity to any cloud region is intermittent or absent, are not served by this deployment shape. OpenAI either drew a deliberate line or has reached the current limit of what it is willing to risk with its weights. The announcement doesn't say, and the pressure to push models toward the disconnected edge will not go away. Edge demands will test whether "cloud networks only" holds.

Why forward-deployed engineers are part of the deal

FDEs are the delivery model that defense-software companies built their businesses on: engineers embedded with the customer, adapting the product to workflows the vendor could never have anticipated from the outside. Altman's post gives them a dual mandate, helping with the models and ensuring their safety.

Classified deployments fail at integration far more often than they fail at capability. The systems a model needs to be useful against live inside the boundary, the data formats are idiosyncratic, and the users can't file a support ticket that describes their actual problem without creating a classification issue. Someone with a clearance has to be in the room.

An engineer working inside a classified network needs a clearance, and clearances take time and sustained institutional effort to obtain and maintain. By committing to FDEs, OpenAI is committing to building and keeping a cleared engineering workforce. A company does that when it expects to operate inside these networks for a long time. The safety oversight in this deal ultimately rests on specific cleared humans, because independent external verification inside a classified boundary is impossible by design.

The safety terms in the contract

The two principles Altman names are a prohibition on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems. His post says the DoW "agrees with these principles, reflects them in law and policy," and that OpenAI "put them into our agreement."

Labs have carried restrictions like these in their usage policies for years. The safety commitments moved from policy documents into the deal itself. A usage policy is a unilateral document; the company wrote it, the company can amend it, and enforcement amounts to the company deciding to cut off a customer. A contract term is bilateral. Both parties signed it, and walking it back requires renegotiation rather than a quiet edit to a webpage.

"Human responsibility for the use of force" is an accountability framing, about who answers for a decision, rather than a control-mechanism framing like "human in the loop," which would specify where a person sits in the execution path. Responsibility language is more durable across changing system designs and also weaker as an operational constraint, since it doesn't dictate any particular architecture.

The announcement is silent on enforcement. There is no mention of audit rights, of what happens if the parties disagree about whether a use crosses the line, or of what the technical safeguards concretely are. Inside a classified network, prompts and outputs are themselves classified data, which constrains what the lab's own monitoring can look at and rules out third-party inspection entirely. The arrangement depends on contract language nobody outside has read and on the cleared FDEs operating the safeguards.

Why OpenAI wants the same terms offered to everyone

OpenAI is "asking the DoW to offer these same terms to all AI companies, which in our opinion we think everyone should be willing to accept."

OpenAI is setting a floor. If OpenAI accepts restrictions on surveillance and use of force while a competitor signs a classified deal without them, OpenAI has paid a price in addressable use cases that the competitor hasn't. Safety terms need to become standard in a competitive procurement environment so no lab can win classified business by accepting fewer constraints. Asking the customer to offer identical terms to everyone removes OpenAI's bid disadvantage.

Standardized terms are also administratively attractive to the government. A department negotiating bespoke safety clauses with each lab produces a patchwork; one set of terms produces something closer to a de facto procurement standard for frontier AI in classified environments. If the DoW takes the suggestion, this agreement becomes the industry's default contract shape.

The de-escalation line

OpenAI has "expressed our strong desire to see things de-escalate away from legal and governmental actions and towards reasonable agreements." The post doesn't say which legal or governmental actions, and it would be speculation to fill that in. The agreement was negotiated against a backdrop of friction between the company and the government, and the deal was, at least in part, the off-ramp.

Terms negotiated under pressure tend to become precedents faster than terms negotiated at leisure, because both sides have an incentive to point at the resolved deal as the model for the next one. The rules for frontier AI inside classified networks are being written right now, agreement by agreement, and the first signed deal carries disproportionate weight. Other labs may sign the same terms, edge demands may test "cloud networks only," and technical safeguards may remain limited to verification by the vendor's cleared staff.