Daniel's been digging into the Claude Gov story — the military's use of Anthropic's models — and he's noticed something most of the coverage got wrong. The early reporting made it sound like the Pentagon had some secret, vastly superior version of Claude, something people were calling Claude six or seven, a model the rest of us don't get to touch. The more accurate picture, from what's emerged, is that Claude Gov is a family of models built by post-training on top of the latest production variant. So if Anthropic's current frontier is Opus four point five or four point seven, Claude Gov is a fork of that — same base model, but run through a specialized post-training loop that strips out the restrictions the military doesn't want while preserving the reasoning and tool use it needs. Daniel's question is whether post-training can actually pull that off. Can you truly ablate away censorship without breaking what makes Claude Claude? And what does this portend for a future where model providers spin out custom variants for anyone with deep enough pockets?
So let's start with what we actually know — and what we're speculating from — about Claude Gov. The DoD has been using Anthropic operationally for some time. The story got complicated. The Department of Defense labeled the supply arrangement a supply chain risk, that order got challenged in court and the challenge succeeded, and right now the future is unclear. Political interests will decide where this lands, and Anthropic's own customers and employees are part of that calculus. But the military is still using the technology, and the technical picture is what Daniel's asking about.
And the technical picture starts with correcting the record on those early headlines. The military does not have Claude six. There is no Claude six. What they have is a post-trained fork of whatever the current production model is, and the difference between those two things is the entire episode.
Right. A fork, not a successor. And the mechanism for creating that fork is post-training — which is where I think we need to camp for a bit, because the word gets thrown around like it's a single operation and it's really not. When we talk about building a frontier model like Claude, there are two enormous phases. The first is pretraining — that's where you take a truly colossal corpus of text and code and images and you train a model to predict the next token. This is the expensive part. This is the part that costs hundreds of millions of dollars in compute and takes months. The output of pretraining is a base model that can complete text but can't really... it doesn't know how to be helpful. It just pattern-matches.
It's a raw intelligence with no manners.
Then comes post-training, and post-training is everything that turns that raw base model into something you can actually talk to. The big pieces are supervised fine-tuning — showing the model examples of good responses — and then RLHF, reinforcement learning from human feedback, where human raters score outputs and the model learns what humans prefer. Anthropic adds constitutional AI on top of that, where the model is trained to evaluate its own outputs against a set of principles. Post-training is where the guardrails go in. It's where refusal behavior is shaped. It's where the model learns that when someone asks how to build a bomb, the correct response is not to give them a step-by-step.
So when we say Claude Gov is a post-trained fork, we're saying someone took the base model — the edifice of weights from pretraining and the main RLHF pass — and then ran a different post-training loop on top of it. One that doesn't teach it to refuse operational queries.
That's the picture, and it's consistent with everything we know about how Anthropic builds models. They're not training Claude Gov from scratch. That would be insane — you'd be spending hundreds of millions to reinvent a model you already have. You take a checkpoint of Opus four point five or four point seven, and you run a new round of fine-tuning and RL on it with different objectives. The base capabilities — the reasoning, the code generation, the tool use — those are largely baked in from pretraining and the earlier post-training passes. What you're changing is the layer on top that decides what the model will and won't say.
Which brings us to the central technical question. Can you actually do that cleanly? Can you strip out the refusals without degrading the reasoning?
This is where it gets interesting, and also where I have to say we're speculating. The exact details of Claude Gov's post-training pipeline are classified. But there's been a lot of published research on refusal mechanisms and how to modify them, and we can make educated guesses. The key concept is something called refusal directions. When a model is safety-trained, it develops specific patterns in its activation space — essentially, certain combinations of neurons firing that correspond to "I should not answer this." Researchers have found that these refusal directions are surprisingly localized. You can identify them, and you can weaken or remove them through targeted fine-tuning or through techniques like representation engineering, where you directly modify the model's internal representations during inference.
So you're not retraining the whole model. You're finding the specific circuits that say "no" and you're dialing them down.
That's the idea, and it works in published research. The problem is that safety training isn't a clean module you can just unplug. It's entangled with the model's understanding of harm, of legality, of consequences. A model that's been trained to refuse bomb-making instructions isn't just running a little "refuse bomb queries" subroutine — that refusal is woven into its broader understanding of what bombs are, what they do, why people might ask about them, and what the ethical and legal implications are. When you ablate the refusal direction, you might also be degrading the model's ability to reason about those downstream consequences.
So you might get a model that will happily tell you how to build a bomb, but is worse at telling you whether building that bomb is a good idea in the context of your operational objectives.
And for a military customer, that second part matters enormously. The military doesn't just want a model that never says no — they want a model that can reason about complex operational scenarios, weigh tradeoffs, consider knock-on effect, and still execute the task. If stripping out the refusals also strips out the nuanced reasoning about harm and consequences, you've made the model less useful, not more.
The tool use angle makes this even trickier. Claude's reputation for excellence in tool calling and structured reasoning — that's not just a base capability thing. A lot of that comes from post-training too. The model learned to format function calls correctly, to chain multiple tool invocations together, to recover gracefully when a tool returns an error — all of that was shaped by RLHF and supervised fine-tuning. If you're running a new post-training loop for the military, you need to preserve all of that while removing the refusal patterns. It's not a toggle. It's surgery.
And surgery on something where the wiring diagram isn't fully labeled. One thing that makes this plausible at Anthropic's scale is that they have access to the full model internals — the weights, the activations, the training infrastructure. When people try to uncensor open-source models through fine-tuning, they're typically working with a much cruder toolset. They fine-tune on a dataset of refused queries with compliant answers, and the result is often a model that's incoherent or that has lost capabilities in weird ways. Anthropic can do something much more sophisticated because they built the model and they have the full post-training pipeline. They can do targeted RL where the reward model is trained to reward compliance while still penalizing degradation on reasoning benchmarks. They can run representation engineering at a level of precision that open-source tinkerers can't match.
There's a concrete example of what a post-trained variant can do that's worth mentioning. The Mythos model.
Right. CNBC reported in June that Anthropic's Mythos model found vulnerabilities in classified U.S. government systems. An official confirmed this. Mythos is — or was — a model that Anthropic developed specifically for vulnerability discovery in classified environments. It's not Claude Gov, but it's evidence that Anthropic has already built specialized post-trained variants for government use that can operate in sensitive domains and find things that human analysts missed. The capability is real.
And it tells you something about the post-training approach. Mythos wasn't a new base model. It was Claude, or something Claude-adjacent, post-trained to be extremely good at a specific task in a specific environment. That's the template for Claude Gov — take the frontier model, post-train it for a different operational context.
The part I keep coming back to is the maintenance burden. A fork is not a one-time thing. Every time Anthropic releases a new Opus point release — four point six, four point seven, five point zero — the DoD variant needs to be re-forked and re-post-trained. You can't just apply the same post-training recipe to the new base model and assume it'll work identically, because the base model's internals have shifted. The refusal directions might be in different places. The tool-use formatting might have changed. You need to validate that the new fork hasn't degraded on operational benchmarks, and you need to do that validation in a classified environment, which adds a whole layer of process.
And by the time you've done all of that, Anthropic is already on the next point release. The military might end up running a model that's six months behind the frontier. For some applications that might not matter — if you're doing document summarization, being six months behind is fine. But if you're using the model for operational intelligence where the difference between Opus four point five and four point seven is the difference between catching a threat and missing it, six months is an eternity.
So if the technical picture is more nuanced than just "uncensor the model" — and it is — what does this mean for the broader ecosystem?
I think the biggest thing is that it inverts the current paradigm for how alignment works. Right now, if you use Claude through the API, you get Anthropic's alignment. It's baked in and non-negotiable. You can't call up your account rep and say "I'd like the version with fewer refusals, please." The model is the model. Claude Gov changes that. It says: the base capabilities are the product, and the alignment layer is a service. You want different guardrails? We'll post-train a variant for you.
Once you've done it for the DoD, the precedent is set. What stops Anthropic from spinning out a variant for a hedge fund that wants a model without trading restrictions? Or a social media company that wants a content moderation model with different thresholds? Or a foreign government — an ally — that wants a version tuned for its own legal and operational context?
The "bring your own alignment" model. And the economics are interesting here. Post-training a custom variant is expensive — you need compute, you need human feedback from domain experts who understand the customer's operational context, you need ongoing maintenance. But for a customer like the DoD, the budget is effectively unlimited. And once you've built the pipeline for doing custom post-training, the marginal cost of doing it for additional customers drops.
There's a parallel to enterprise software customization, but with a crucial difference. Salesforce will spin you a custom instance with your own workflows and your own data model, and if something breaks, you get a wrong report or a failed automation. If a post-trained language model breaks in a military context, the failure mode isn't a wrong report — it's the model giving bad advice in a situation where bad advice gets people killed.
Or the model refusing at the wrong moment because the refusal ablation wasn't as complete as you thought. You think you've stripped out all the guardrails, but there's some edge case — some specific combination of tokens — that still triggers the old safety training, and in the middle of an operation the model suddenly decides it can't help with that query.
That's the nightmare scenario, and it's why the validation burden for these custom forks is so high. You can't just run the standard benchmarks and call it done. You need to adversarially test the model against the specific failure pattern that matter in your operational context. And you need to do that testing at classification levels that make it hard to bring in outside expertise.
The geopolitical angle here is worth pulling on. If the U.S. has a post-trained Claude for operational military use, every other major power is going to want the same thing. Some of them will build their own models — China's already doing that. But for U.S. allies who don't have domestic frontier AI capabilities, the ask is going to be: can we get a Claude Gov variant too? And that raises questions about model weight security and proliferation that we've touched on before. You're essentially exporting a customized version of your most advanced AI system to a foreign military. Even if they're an ally today, model weights don't forget and they don't expire.
The NSA angle adds another layer. The New York Times reported that the NSA lost access to certain AI capabilities — so access to these models is already being negotiated and contested within the U.S. government itself. You have different agencies jockeying for access, different classification domains, different use cases. The idea that there's one "Claude Gov" that the military uses is probably too simple. There are likely multiple variants, or at least multiple configurations, for different agencies and different classification levels.
Each of those is a fork that needs to be maintained. The versioning nightmare multiplies.
The thing that I think gets overlooked in a lot of this coverage is that Anthropic is navigating a genuine tension here. The company built its reputation on constitutional AI and responsible deployment. A military variant that bypasses those guardrails creates friction with employees who joined the company because they believed in the safety mission. It creates friction with the broader AI safety community. And it creates friction with commercial customers who might not want to be associated with a company that's also supplying military AI.
Though I suspect the commercial customer concern cuts both ways. Some enterprise customers are going to look at Claude Gov and think: if Anthropic can build a custom post-trained variant for the DoD, they can build one for us too. That's a premium product offering that nobody else in the market is providing at this scale.
The thing is... no, let me back up. I want to talk about what "post-training can ablate restrictions" actually means at the technical level, because I think there's a misconception even in the more careful coverage. The misconception is that safety training adds a layer on top of the model, and you can just peel that layer off and get back the pristine base model underneath. That's not how neural networks work. Safety training changes the weights throughout the network. It's not a wrapper — it's woven into the fabric of the model. When you do post-training to remove restrictions, you're not peeling off a layer. You're doing additional training that attempts to reverse or override the effects of the earlier safety training. And any time you do additional training on a model, you risk catastrophic forgetting — the model losing capabilities it had before.
The question isn't "can you remove the restrictions." The question is "can you remove the restrictions while keeping everything else intact," and the answer is probably "mostly, but not perfectly, and the edge cases are where it gets dangerous."
Anthropic is probably better positioned to do this than anyone else, because they have the infrastructure to run extensive evaluations and catch regressions. But "better positioned" doesn't mean "perfect." There will be regressions. There will be edge cases where the model behaves in unexpected ways. The question is whether those regressions are acceptable given the operational benefit.
Which is a question the military is well-equipped to answer, actually. The military deals with systems that have failure pattern all the time. Every weapons system has a probability of malfunction. Every intelligence source has a reliability rating. The military's question isn't "is this system perfect" — it's "is this system's error rate acceptable given the alternative." If the alternative is human analysts who also make mistakes, and who work much more slowly, a model that's right ninety-five percent of the time and refuses point-five percent of the time in edge cases might be a clear win.
I want to talk about what this means for the future of frontier model deployment, because I think Claude Gov is a preview of where the industry is heading. We're moving from "one model fits all" to "base model plus customized post-training as a service." The model provider controls the base capabilities — the pretraining and the core RLHF pass that produces the frontier model. The customer controls the alignment layer — the additional post-training that tunes the model for their specific use case and their specific risk tolerance.
That inverts the power dynamic in an interesting way. Right now, the model providers are the arbiters of what's safe and what's not. They decide where the guardrails go. In a world of custom post-training, the customer decides. The model provider might still refuse to build certain kinds of variants — I doubt Anthropic is going to post-train a version of Claude that's optimized for generating disinformation, no matter how much someone pays. But the line moves. The set of things that are negotiable expands.
The negotiation is already happening. The DoD got Claude Gov. The NSA reportedly lost access to certain capabilities — which means they had access, and then it was withdrawn or modified. These aren't hypotheticals. Access to frontier AI is being negotiated right now between model providers and government agencies, and the outcomes of those negotiations are going to shape what the ecosystem looks like five years from now.
There's something almost... I don't want to say ironic, but there's a tension in the fact that Anthropic's safety research is part of what makes Claude Gov possible. The same techniques that Anthropic developed to make Claude safer — the deep understanding of refusal directions, the ability to do targeted post-training, the infrastructure for evaluating model behavior at scale — those are the techniques that make it possible to build a variant with fewer restrictions. The safety research is dual-use.
That's a really sharp observation. The better Anthropic gets at understanding and shaping model behavior, the better they get at building custom variants for customers who want different behavior. The safety expertise becomes a product differentiator. "We can build you a model that's exactly as restricted as you want it to be, and no more, because we understand the refusal mechanisms better than anyone else."
But before we get too far into the theoretical future, I want to bring in someone who's actually dealt with classified IT systems.
Hilbert: We had a system that moved intelligence reports between SIPRNet and JWICS. This was — I was doing contract work, data pipeline stuff, nothing interesting. ETL jobs. Extract, transform, load. Take a report from one system, strip out the stuff that wasn't authorized for the other system, write it to the destination database. Should have been simple. It took eighteen months to get it working reliably, and it broke every time someone changed a firewall rule. Which was about once a month. I'm listening to you two talk about post-training and refusal vectors and maintaining custom forks through multiple point releases, and I'm thinking about the people who are going to be responsible for keeping that fork running in a classified environment. The accreditation process alone — every time you bring a new model version into a classified system, you need to get it through security review. By the time you've done that, the vendor is two point releases ahead. So you're always running behind. And the people maintaining the pipeline — they're contractors. They turn over every two years. The institutional knowledge walks out the door. I'm not saying it can't work. I'm saying I've seen what happens when you put a complex software dependency into a classified environment and expect it to stay current. It doesn't stay current. It rots.
The versioning nightmare we were talking about, but with the added dimension of classified accreditation cycles.
The contractor turnover point is — I hadn't even thought about that. The people who understand how the post-training pipeline works, how to validate the new fork, how to troubleshoot when the model starts behaving weirdly — they're not government employees. They're Anthropic contractors or they're defense contractors who Anthropic trained. And when their contract ends, they leave.
Hilbert: Or they go work for the other contractor who just won the re-compete, and now they're maintaining the same system from a different company, and the documentation is six months out of date. I've been on both sides of that handoff. It's not pretty.
The operational reality is that even if the post-training works perfectly — even if Anthropic can deliver a Claude Gov variant that has all the reasoning and tool use with none of the unwanted refusals — the DoD might still end up running a stale version with undocumented failure pattern because the maintenance pipeline is broken.
Hilbert: That's what I'm saying. The ML is the easy part. The hard part is keeping it running in production for five years.
That operational reality is worth sitting with. So where does this leave us? I think the Claude Gov story is significant, not because the military has some magic super-model — they don't — but because it establishes the template. Post-training as a customization layer. Alignment as a service. Base model providers becoming platforms that other organizations build on top of.
The open questions are the ones that'll determine whether this template actually works at scale. Will the DoD manage to maintain a custom Claude fork at the frontier, or will they end up running a stale version because the accreditation and maintenance pipelines can't keep up? How will Anthropic navigate the tension between its safety brand and its government contracts — especially if employees or customers start pushing back? And what happens when other customers, foreign governments, intelligence agencies demand the same treatment?
The question stops being "is the model safe" and becomes "safe for whom, and for what purpose." That's a much harder conversation, and we're only at the beginning of it.
If you want to dig deeper into the technical side of model customization, we've done episodes on representation engineering and on model weight security that go into more detail than we could cover here. But for now — thanks to Hilbert Flumingtop for producing, as always.
This has been My Weird Prompts. Email us at show at my weird prompts dot com. We'll be back soon.
