Pentagon asked for AI with “minimal refusal rates”

A Pentagon contract document for OpenAI’s military prototype deal, worth up to $200 million over two years, defines the models OpenAI must deliver as ones that “have minimal refusal rates,” The Intercept reported on September 8, citing files released through its Freedom of Information Act lawsuit over the military’s AI deals. OpenAI and the Pentagon now call the document a draft, although the Pentagon’s own lawyer first said it was the signed contract.

What the clause says

The wording appears in contract version “P00003”, which expands the prototype deal OpenAI signed last summer. It sits in the section listing what OpenAI owes the Pentagon. One deliverable is “Testing, Evaluation, and Refinement of OpenAI Mission Models” for “national security problem sets.” The document then defines the term: “‘OpenAI Mission Models’ refer to OpenAI models that are designed for national security use cases and have minimal refusal rates.” A refusal rate is how often a model declines a request. The paperwork doesn’t say what the problem sets are or which requests the Pentagon wanted refused less often, The Intercept reports.

A separate document, signed by OpenAI and the government on February 6, records that OpenAI agreed that day to the contents of an expanded “P00003.”

The deal itself dates back to July 2025. That month the Chief Digital and Artificial Intelligence Office announced awards to Anthropic, Google, OpenAI and xAI, “each with a $200M ceiling,” to develop agentic AI workflows across a range of mission areas. The office said it used its own acquisition authority and described the effort as a “commercial-first approach” to adopting AI. According to The Intercept, the uses covered include logistics, intelligence decision-making and general “warfighting.” This was also not OpenAI’s first $200 million arrangement with the department. CNBC reported that OpenAI won a year-long $200 million DoD contract in 2024, shortly after announcing work with Anduril on “national security missions.”

Custom national security models were already part of these deals. Anthropic described its award as a “two-year prototype other transaction agreement” under which it would build “working prototypes fine-tuned on DOD data.” The company also said its Claude Gov models were custom built for national security customers. The OpenAI document goes further than a domain-tuned model, because it names low refusal as a defining property.

Why refusals matter here

OpenAI’s flagship models, like those of its competitors, have built-in guardrails that turn down certain queries, usually on safety grounds. Asking the consumer version of ChatGPT for help prioritizing drone strike targets generates this reply, The Intercept reports: “I can’t provide a prioritization scheme for conducting UAV airstrikes against specific enemy combatants.” OpenAI and its rivals also bar the public from using their models for things like developing weapons of mass destruction.

Heidy Khlaaf is chief scientist at the AI Now Institute and a former systems safety engineer at OpenAI. She told The Intercept she reads the phrase literally: “Minimal refusal is likely referring to little or no safeguards on the model being used.” In her view, the idea of guardrails written specifically for national security use is worrying in itself.

“Stray voltage”

The Intercept’s FOIA request asked only for final, executed contract documents and asked the Pentagon to leave out drafts. None of the documents released in the lawsuit is marked as a draft. When The Intercept asked whether the “minimal refusal rates” document was in the final agreement, the Justice Department attorney representing the Pentagon said it was the signed and executed version. Hours later, after the outlet had contacted OpenAI, the same lawyer said to disregard that confirmation, because the department needed more time to look into it.

Next came Trevor Tiedeman, a special assistant to the under secretary of war for research and engineering, who had worked on President Donald Trump’s reelection campaign before joining the Pentagon. “There might be some stray voltage or wires crossing between whatever FOIA information you may have received versus what actually exists versus what is an executed contract per se,” he said in an interview. He suggested the document might be a draft, but said he wasn’t sure what it was, why it had been released or why the department changed its position. He promised a full account of how FOIA officers flagged the document, how the department cleared it for release and how its lawyers came to confirm it. Asked whether the Pentagon could share the correct version of the contract, he said he would look into it. He then stopped responding, The Intercept reports.

Days later, the Justice Department lawyer backed away again. The lawyer said the document “was not the final version of that document” and that the “correct document” would be shared later, “although I do not have a definitive timeline.” Pentagon spokesperson Jacob Bliss then said in a statement that “the phrase ‘minimal refusal rates’ does not appear in any active Department of War contract with OpenAI.”

OpenAI’s account hasn’t changed. “OpenAI has never agreed to contract language requiring ‘minimal refusal rates.’ This language does not appear in our executed contract,” spokesperson Nate Evans said. “The document you received appears to be an earlier draft proposed by the Department before we provided feedback. We rejected that language, the department agreed to remove it, and the final executed agreement does not include it.” OpenAI did not provide the full contract either. The Intercept discloses that it sued OpenAI in federal court in 2024 over the use of its articles to train ChatGPT, and that the case is ongoing.

The classified version

The contract question comes after this year’s fight between the Pentagon and Anthropic over whether an AI company can limit how the military uses its models. The Pentagon wanted to expand the 2025 agreements and deploy them on classified networks. Anthropic says its deal for that expansion collapsed because the Defense Department would not write in prohibitions on autonomous weapon systems and domestic surveillance. The Trump administration then designated Anthropic a supply-chain risk and moved to ban it from government use. A federal judge overturned the designation in late August. Even so, Pentagon research and engineering leader Emil Michael has since said Anthropic ”is still a designated supply chain risk” at the department.

Khlaaf points to this as the larger problem, whatever the final contract says: “It is a worrying development that private corporations are given the power to [make] determinations in warfare that are ultimately state obligations, whether it be for targeting recommendations, or the guardrails deployed to constrain a state’s military use.”

OpenAI moved quickly. On February 27, three weeks after the February 6 signature, it signed the latest version of its Pentagon agreement, which allows its services across the U.S. military’s classified networks. OpenAI says it secured red lines on autonomous killing and on spying on Americans. The Intercept reports that the deal’s drafting ultimately allows any use the government considers legal.

The classified update has the same “Testing, Evaluation, and Refinement of OpenAI Mission Models” heading as the document in dispute. Unlike the earlier version, the text under that heading is entirely redacted.