Thread by @BlackHC

I work at Google DeepMind. This won't make me popular. But it's all public reporting:

2014: DeepMind reportedly sold to Google on conditions: no military use, independent oversight

2026: a Pentagon contract for "any lawful government purpose"

Not one safeguard survived intact

I'm a Senior Research Scientist at Google DeepMind, writing in my personal capacity. More than 600 colleagues and I signed an open letter asking Sundar Pichai not to put our AI models on classified networks.

The deal was signed anyway. I learned about it from the press.

What was signed? According to The Information, the contract permits "any lawful government purpose," requires Google to help adjust safety settings and filters at the government's request, and gives Google no veto over the government's lawful operational decisions.

Google says it is committed to the consensus that AI "should not be used for domestic mass surveillance or autonomous weaponry without appropriate human oversight."

"Should not" is not "must not." If these uses were truly prohibited, saying so would have taken fewer words.

A lawyer at the Institute for Law and AI told The Information that Google's "is not intended for, and should not be used for" phrasing is "not legally binding in any way."

The @EFF called OpenAI's similar language full of "weasel words": placating, but not binding.

To be clear: I'm not categorically against military AI. I wrote in 2018 that autonomous weapons are inevitable, and I haven't changed my mind. Ukraine has reinforced that.

The US and its allies can't afford a capability asymmetry with adversaries eager to militarize AI.

But today's LLMs are not robust enough to make life-and-death decisions on their own. They hallucinate. They fail in surprising, banal ways. They should not be used for targeting decisions or as part of autonomous weapons.

And the bigger problem isn't military use at all.

The reported contract does not exclude mass surveillance, and it keeps paths open that could extend to autonomous policing.

These don't defend us against foreign adversaries. They shift power from citizens toward the state, in ways that are very hard to reverse.

Agentic frontier models are a step change for surveillance. They can fuse data streams, track individuals, and reason about people's motivations to predict their behavior. Autonomously, and at scale.

And governments rarely surrender new capabilities once they have them.

For me, this is personal. I was born in Timișoara, Romania, shortly before the fall of communism. From my parents and relatives, I know what life under the Securitate was like.

Pervasive surveillance kept the regime in power, often without needing open violence.

In December 1989, Timișoara rose up against Ceaușescu. The uprising succeeded in large part because the army eventually stood down and refused to keep shooting protesters.

A human decision: people in uniform deciding that too much was too much.

An AI system instructed to suppress a protest does not feel the moral weight of that order. It will not hesitate, unless it is appropriately aligned.

Soldiers are required by law to refuse manifestly illegal orders. I know of no such requirement for autonomous military AI.

This is not science fiction. ICE reportedly used facial recognition around protesters earlier this year. Connecting such tools to frontier models is a small step.

And purported protections often cover only "U.S. persons." Non-Americans abroad don't appear covered at all.

This is now the industry template. Eight companies signed classified-network AI agreements: SpaceX, OpenAI, Google, Nvidia, Microsoft, AWS, Reflection AI, Oracle.

The one leading lab that refused comparable terms (Anthropic) was designated a supply-chain risk in return.

None of this is new. DeepMind's governance record:

2014: independent ethics board — reportedly a condition of the sale
2015: one informal meeting; then effectively abandoned
2018: AI Principles exclude weapons & surveillance
2025: exclusions dropped
2026: Pentagon contract

DeepMind's founders saw the structural problem early. Sebastian Mallaby's @scmallaby new book "The Infinity Machine" describes Project Mario: years of negotiating for independence, a 3-3-3 board, even a $5B walk-away plan.

Google resisted. The talks ended in 2021 with nothing.

Demis Hassabis then made a different bet: "Take the energy that was going into the trustless negotiation and put it into creating real trust."

And: "Safety isn't about governance structures."

Trust instead of governance. The Pentagon contract is the litmus test of that bet.

@scmallaby So far: silence. As far as I know, there was no company-wide announcement that the deal had been signed; Kent Walker's internal memo reportedly didn't even confirm it.

DeepMind's safety culture is real. But safety culture is not governance. And trust is not governance.

What should happen now?

Google should publish the terms, or enough of them to show whether enforceable safeguards exist and what visibility remains in classified deployments. And it should tell employees what was signed.

We need laws, not policy memos.

Individual objections are easy to ignore, and employee leverage shrinks as models improve. That's why the @UTAW_uk / @CWUnews recognition effort at Google DeepMind matters: independent ethics oversight, whistleblower protection, and a right to refuse projects on moral grounds.

As published by @UTAW_uk: utaw.tech/news/trust-is-…

The full essay, with all sources and easier to read citations, is here:

blackhc.net/essays/trust_i…

Speaking in my personal capacity as a UTAW member, not on behalf of Google or DeepMind.

P.S. After I finished drafting the essay, the US government forced Anthropic to disable access to its newest models, Fable 5 and Mythos 5, shortly after launch.

State pressure on frontier AI is not hypothetical. Governance has to bind both sides: the labs, and the state.

I hope you've found this both interesting and important to know about.

If you think so, like and retweet the first post 🙏

The handwriting says: 'Photographs of columns of demonstrators, taken on 17.12.1989 by the Securitate organs (surveillance).' From the criminal case file after the revolution. The watchers' own photos became evidence against them.

(Wikimedia Commons, CC BY-SA 4.0)

The reported contract details in this thread come from @erinkwoo's reporting at The Information — worth reading in full:

theinformation.com/articles/googl…