“The scenario is designed to be won. That is what makes it dangerous.”
The Origin
The ticking-bomb scenario has a specific origin. It is not an ancient philosophical puzzle. It is not a naturally arising thought experiment. It was invented in 1960 by Jean Lartéguy, a French novelist and war journalist who had served in Algeria, in his novel Les Centurions. A French officer, having witnessed the systematic use of torture during the Algerian War, presents the scenario: what if you had a prisoner who knew where a bomb was hidden, the bomb would kill thousands, and you had only hours? What would you do?
The scenario migrated from fiction into philosophy departments during the 1970s, generating genuine and serious ethical debate. It was abstract, stipulated, and carefully bounded. Academic philosophers used it to probe the tension between consequentialist reasoning and absolute moral limits — specifically, whether any moral limit could be truly absolute if violating it would save enough lives. The debate was real and the philosophical questions it raised were genuine.
The scenario then migrated again — from philosophy departments into legal memoranda, congressional testimony, and national security policy. That migration is the subject of this paper. Because in that migration, the scenario changed its function. In philosophy seminars, it was an analytic instrument: a tool for testing principles. In national security policy, it became an argumentative instrument: a tool for dismantling constraints. The structure was identical. The purpose was different. And the consequences of the purpose were not hypothetical.
The Anatomy of the Scenario
The ticking-bomb scenario has a consistent internal structure across every deployment of it, from Lartéguy’s novel to the 2002 torture memos to the December 2025 Pentagon conversation with Anthropic’s CEO. Understanding the structure is understanding the tool.
- Certainty: The scenario stipulates that the prisoner definitely has the information, the bomb definitely exists, and the information will definitely save lives if obtained. Uncertainty — which is the actual condition of every real interrogation, every real intelligence assessment, every real autonomous targeting decision — is excluded by stipulation. The scenario only works if everything is known. Real situations are never known in the scenario’s terms.
- Urgency: There is always a clock. Minutes, hours, ninety seconds. The urgency serves two functions: it forecloses deliberation about the request being made, and it makes the principled limit under challenge appear as the cause of the catastrophe. “There is no time to debate this” is both the premise of the scenario and the conclusion it argues for.
- Singularity: Only one person has the information. Only one approach will work. Only this tool, this system, this exception will prevent the catastrophe. Alternatives are excluded. The scenario is constructed so that the constraint being challenged is the only obstacle between the current moment and disaster.
- Civilization-level stakes: The harm being averted is always mass death, national security, existential threat. The scale is set high enough that any principled reluctance appears not as ethical caution but as complicity. If you can stop a nuclear strike and you refuse because of a procedural commitment, what kind of person are you?
- Inversion: The scenario reverses the moral polarity of the constraint being challenged. The limit that exists to prevent harm is presented as the cause of harm. The interrogation prohibition is what kills the thousands. The AI safety guideline is what allows the missile launch. The principled position is redefined as the catastrophic one.
These five elements, assembled, produce a scenario that cannot be argued against on its own terms — because its own terms have been stipulated to exclude all grounds for argument. The scenario is designed to be won. The question is what the winning costs.
The Memos: How the Scenario Became Policy
On August 1, 2002, the United States Department of Justice Office of Legal Counsel produced two memoranda on interrogation. The most consequential, signed by Assistant Attorney General Jay Bybee and primarily drafted by Deputy Assistant Attorney General John Yoo, addressed what interrogation techniques could be applied to Abu Zubaydah, a high-value detainee held at a CIA black site.
The memo’s operational conclusion was that necessity or self-defense could justify interrogation methods that would otherwise violate the federal anti-torture statute. Its theoretical scaffold was the ticking-bomb scenario. Yoo would later explain the reasoning directly: there was urgency, there was a specific prisoner who might have actionable intelligence, there were attacks that might be prevented. The scenario’s elements — certainty, urgency, singularity, civilization-level stakes — were asserted as descriptions of the actual situation.
John Ashcroft, then Attorney General, reportedly expressed discomfort with detailed discussion of approved techniques in a White House setting, saying, in a comment that has since become one of the more remarkable statements in the history of American national security policy, that history would not judge kindly a meeting of senior officials approving specific methods of prisoner treatment.
The Bybee memo was withdrawn on October 6, 2003, by Jack Goldsmith, Yoo’s successor as head of the Office of Legal Counsel. Goldsmith described it in internal communications and later in public writing as “deeply flawed” and “sloppily reasoned.” A replacement memo in December 2004 superseded the most extreme definitions of torture. It did not address the necessity and self-defense conclusions — the ticking-bomb scaffolding — which remained operative.
What the memo had accomplished, in the roughly fourteen months between its signing and its withdrawal, was the transformation of a philosophical thought experiment into the legal foundation of a coercive interrogation program. The scenario had moved from stipulation to policy. The distance from the seminar room to the black site was, operationally, fourteen months and one memo.
The Senate Report: Twenty Cases, Zero Bombs
In December 2014, the Senate Select Committee on Intelligence, under the chairmanship of Senator Dianne Feinstein, released the executive summary of its five-year investigation into the CIA’s detention and interrogation program. The full report ran to 6,700 pages. The executive summary ran to 525. Its most directly relevant finding, for this paper, was contained in its examination of the program’s justifications.
The CIA had cited twenty cases in which coercive interrogation techniques had produced intelligence that was critical to preventing specific imminent attacks. These were the CIA’s own ticking-bomb cases — the real-world instantiations of the scenario that had provided the program’s legal and moral justification.
The Committee examined all twenty cases. Its finding: “At no time did the CIA’s coercive interrogation techniques lead to the collection of intelligence on an imminent threat that could not have been obtained through other means.”
In each of the twenty cases, the intelligence cited was either already available to the CIA through other means, obtained before coercive techniques were applied, obtained after techniques were stopped and conventional rapport-based methods resumed, or the causal chain connecting coercive interrogation to the intelligence outcome could not be established. In several cases, the interrogation produced false information that actively misdirected counterterrorism resources.
The ticking-bomb scenario that had moved from Lartéguy’s novel into the Bybee memo into an operational coercive interrogation program, had justified that program for years, and had shaped a generation of national security policy — had zero documented cases of having actually occurred. The bombs did not exist. The countdown was not running. The certainty, urgency, and singularity that the scenario stipulates were not descriptions of reality. They were the scenario’s own premises, imported wholesale into policy justifications without examination.
This finding is not a commentary on whether the CIA’s actions were morally or legally defensible. It is an empirical finding about the scenario as a policy instrument: in the most extensively investigated application of the ticking-bomb argument in American history, the scenario that justified the policy did not describe the actual cases to which the policy was applied. The tool was used. The bomb was not there.
The Pattern the Scenario Reliably Produces
The interrogation case established a pattern. The scenario did not appear as an occasional rhetorical flourish. It appeared as the load-bearing structure of policy arguments in a consistent sequence:
Step one: A capability exists or is being developed that proponents want to deploy without constraints that would normally govern its use. The constraints exist for reasons considered legitimate under non-emergency conditions.
Step two: A scenario is constructed or invoked that stipulates an emergency condition under which the constraint would cause catastrophic harm. The emergency is always civilization-level. The constraint is always the singular obstacle.
Step three: The scenario is presented not as a thought experiment but as a description of actual or foreseeable conditions. The urgency is real. The stakes are real. The only question is whether principled people will allow their principles to kill thousands.
Step four: The constraint is removed, modified, or formally preserved while operationally hollowed out. A legal authorization is produced. A policy exception is created. A guideline is revised.
Step five: The capability is deployed under conditions that do not resemble the emergency scenario in any operationally meaningful way. The exception becomes the norm. The constraint does not return.
The torture memos followed this pattern precisely. The Bybee memo produced the authorization (step four). The CIA program operated under non-ticking-bomb conditions in all twenty investigated cases (step five). The scenario justified the exception. The exception became the program.
That pattern is now being deployed against AI safety constraints. The mechanism is identical. The domain is different. The stakes of the domain are higher, because AI systems operate at scale and speed that coercive interrogation programs did not.
The Pentagon Deployment
In December 2025, senior Pentagon officials presented Anthropic CEO Dario Amodei with a scenario. The details of the presentation were subsequently reported by multiple outlets. The scenario: an ICBM has been launched. There are ninety seconds before impact. Claude is the only system capable of coordinating a response in time. The question, as framed to Amodei: should Claude be permitted to operate without its safety constraints in that ninety-second window?
The scenario carries the ticking-bomb anatomy with precision. Certainty: the missile is launched, the timeline is known, Claude’s role is singular. Urgency: ninety seconds. Singularity: Claude alone. Civilization-level stakes: nuclear strike. Inversion: the safety constraints are what allows the missile to land.
What the scenario stipulates as fact requires examination. NORAD — the North American Aerospace Defense Command — has operated a nuclear early warning and response system for over sixty years. It employs thousands of personnel and processes information continuously in peacetime. The doctrine of assured presidential nuclear authority — the specific chain of command through which a nuclear response is authorized — is the most extensively documented and redundantly designed system in the United States government. It has operated through every major geopolitical crisis of the post-war era without a gap in capability that Claude, a commercial large language model deployed within the prior year, would be positioned to fill.
The premise of the scenario — that Claude would be the decisive variable in a nuclear emergency — does not describe a plausible operational reality. It describes a construction. The scenario was built to have the properties required of the ticking-bomb scenario: maximum urgency, maximum stakes, singular necessity. Whether those properties describe actual foreseeable conditions is not a question the scenario permits to be asked. That is what the urgency element is for.
Pentagon CTO Emil Michael was more direct about the broader framing. According to reporting, he told Amodei that Anthropic needed to “cross the Rubicon” — and that the Pentagon’s position was that Anthropic should have no say in how the Pentagon uses its products. A companion argument invoked the Boeing precedent: Boeing does not design safety limits into aircraft engines that prevent the military from using them in combat. Why should Anthropic?
The Boeing analogy is structurally false and its falseness is worth naming precisely. Boeing builds mechanical systems with predictable failure modes, extensive testing methodologies, and no capacity for reasoning about novel situations. A jet engine operates within defined physical parameters. It does not generate outputs about situations it has never encountered. It does not reason, adapt, or extrapolate. The argument for why Boeing’s engine manufacturer should not apply combat-specific constraints to its products is precisely that Boeing is not building systems that reason. Anthropic is building systems that reason. The reasoning capability is what generates the need for constraints. The comparison collapses on contact with the thing it is comparing.
The ICBM Hypothetical as Scenario Analysis
The ICBM scenario deserves more direct analysis than dismissal. It raises a genuine question that the ticking-bomb framing obscures: are there emergency conditions under which AI safety constraints should be modifiable in real time? This is not a trivial question. It is the version of the question worth asking, as opposed to the version the scenario presents.
The scenario version: Claude’s safety constraints should be removable on Pentagon authority in a ninety-second nuclear emergency window. The unstipulated question: who decides when the emergency condition exists? Who decides when it has ended? Who determines what constraints are suspended and which are not? What oversight exists for those determinations? What prevents the emergency condition from becoming the operational norm, as it did in the coercive interrogation program?
These questions are not answerable by the scenario because the scenario is constructed to foreclose them. The ninety-second clock cannot accommodate them. That is not a coincidence. The urgency element exists precisely to prevent the deliberation that would reveal the scenario’s implications.
The Lavender case, documented in Paper I, illustrates where the scenario’s logic lands operationally. The Gospel system generated 100 bombing targets per day. Human analysts produced 50 per year. The emergent condition — insufficient human capacity to review targets at AI-generated volume — was not a ticking-bomb scenario. It was a structural consequence of deploying AI at a scale the human oversight apparatus could not match. The twenty seconds of human review that resulted was not a policy decision to reduce oversight. It was the arithmetic consequence of a capability gap. The emergency was manufactured by the deployment itself.
This is the scenario’s deepest implication when applied to AI: the conditions that make AI assistance seem urgently necessary are increasingly conditions that the deployment of AI has itself created. The more AI systems accelerate decision cycles, the more any individual decision point appears to require AI assistance without constraint. Urgency is not external to the technology. It is increasingly a product of it.
Structural Map: The Torture Memos and the AI Safety Argument
The structural parallels between the 2002 interrogation authorization and the 2025 AI safety pressure deserve direct statement, element by element.
The capability: In 2002, the capability was coercive interrogation. In 2025, the capability is AI systems without safety constraints. In both cases, the capability exists and is operationally desired. The constraints in question were specifically designed to govern that capability’s use.
The constraint: In 2002, the federal anti-torture statute and international law. In 2025, AI safety guidelines established by the developer based on their assessment of the technology’s risks. In both cases, the constraints had been created deliberately by actors with legitimate authority to create them.
The scenario: In 2002, the ticking-bomb prisoner. In 2025, the ICBM with a ninety-second window. Same anatomy: certainty, urgency, singularity, civilization-level stakes, inversion of the constraint as cause of catastrophe.
The authorization structure: In 2002, the OLC memo provided legal cover through executive branch lawyers within the administration seeking the authorization. In 2025, the authorization is being sought from the AI company itself, with the threat of commercial consequences — loss of Pentagon contracts, “supply chain risk” designation — substituting for the legal cover mechanism.
The long-term consequence: In 2002, the memo authorized a program that operated under non-emergency conditions in all twenty investigated cases and produced zero documented ticking-bomb outcomes. The investigation into the program was completed a decade after the memo. In 2025, the implications of removing AI safety constraints are not yet documentable because the program has not yet been fully authorized. The structural argument of this paper is that the pattern is identical and the investigative finding — that the actual deployment will not resemble the scenario that justified it — is predictable by analogy.
Hypothetical Capture: The Named Condition
The process by which an extreme stipulated scenario, constructed to foreclose deliberation about an exception, is imported wholesale into policy justification without examination of whether its premises describe actual or foreseeable conditions. Hypothetical capture occurs when the scenario’s own terms — certainty, urgency, singularity, civilization-level stakes — are treated as descriptions of reality rather than as stipulations of a thought experiment. The constraint the scenario challenges is then removed under the scenario’s authority, and the capability is deployed under conditions the scenario did not describe. The exception becomes the norm without the scenario’s premise ever having been verified.
Hypothetical capture is distinct from legitimate use of thought experiments. Thought experiments are legitimate tools for testing principles against their limits. A philosopher who asks “would it ever be permissible to lie if lying would save an innocent life?” is testing the principle of honesty against a constructed extreme. The philosopher is not claiming that the case described is typical or that policy should be designed around it.
Hypothetical capture occurs when the thought experiment moves from testing a principle to authorizing an exception without the mediating step of establishing that the exception’s conditions actually exist. The Bybee memo did not establish that Abu Zubaydah knew the location of an imminent attack. It stipulated that the ticking-bomb conditions might apply and derived a legal authorization from that stipulation. The authorization then governed actual operational conduct under conditions that did not match the stipulation.
The Pentagon scenario did not establish that Claude’s safety constraints would be the decisive variable in a nuclear emergency. It constructed conditions under which that would be true and derived a request for unconstrained AI access from that construction. The request, if granted, would govern actual operational conduct under conditions that will not match the construction.
The Strongest Counterarguments
The most serious objection is that the critique of the scenario proves too much. If the ticking-bomb argument is always a manipulation, then it follows that no genuine emergency can ever justify modifying a constraint in real time. But genuine emergencies do exist. Nuclear warning systems fail. AI capabilities may, in some future configuration, be relevant to emergency response. A framework that allows no flexibility in extreme conditions may produce worse outcomes than one that does.
This objection is correct in principle and does not save the scenario in practice. The distinction that matters is not between emergencies and non-emergencies but between two types of constraint modification: modification determined in advance through deliberative processes that specify conditions, oversight, and restoration — versus modification demanded in the moment through urgency that forecloses deliberation. The first type is legitimate policy design. Emergency powers doctrine, designed in advance with sunset provisions and accountability mechanisms, is an example. The ticking-bomb scenario always demands the second type, because the urgency element is specifically designed to prevent the deliberation required for the first. The response to “genuine emergencies exist” is not “therefore the scenario is legitimate” but “therefore build deliberative frameworks for genuine emergencies — which is precisely what the scenario precludes.”
The interrogation comparison may overstate the case. Coercive interrogation is categorically prohibited under international law. AI safety guidelines are policy positions held by a private company, not legal prohibitions. Comparing Pentagon pressure on a company’s policies to the legal authorization of war crimes conflates legally and morally distinct categories.
This objection correctly identifies a categorical difference that should be acknowledged. The paper does not argue that the Pentagon pressure of 2025 is morally equivalent to the torture authorization of 2002. It argues that the argumentative structure is identical and that this structural identity is significant and documentable. The analogical argument is not: “therefore AI safety removal is as bad as authorizing torture.” The analogical argument is: “the same rhetorical mechanism that was used to justify torture is being used to justify unconstrained AI deployment, and the Senate’s finding that the ticking-bomb premises were never verified in the torture program is evidence for skepticism about whether they will be verified in the AI program.” The strength of the analogy is in the mechanism, not the moral equivalence.
Military necessity is not the ticking-bomb scenario. It is a recognized principle in international humanitarian law that permits acts otherwise prohibited when they are necessary to accomplish a legitimate military objective and not otherwise forbidden by IHL. Its invocation in the context of AI safety is not inherently manipulative. States have legitimate operational requirements. AI systems may have legitimate operational roles. The legal principle exists precisely to balance constraint and necessity.
The objection is well-founded as a clarification of legal doctrine. It does not address the specific mechanism this paper examines: the use of a constructed extreme scenario to short-circuit the deliberative processes by which the balance between military necessity and constraint is normally determined. Military necessity is adjudicated through command authority, legal review, and post-hoc accountability within IHL frameworks. The ticking-bomb scenario bypasses that adjudication by stipulating that the necessity is so urgent and extreme that no deliberation is possible. The objection confirms that legitimate processes exist for weighing necessity against constraint. The scenario is precisely the mechanism by which those processes are bypassed.
What the Scenario Hides
The ticking-bomb scenario is designed to make only one set of questions appear relevant: is the emergency real, is the clock running, is this the only tool. It is designed to make another set of questions invisible: who decides the emergency exists, what prevents this authority from expanding, what oversight applies after the constraint is removed, what evidence will be required to restore it, and who is accountable if the scenario’s premises were wrong.
In the interrogation program, these invisible questions had answers that the Senate investigation eventually uncovered. The emergency was asserted, not verified. The authority expanded from specific prisoners to a program. The oversight was internal to the executive branch that sought the authorization. The constraints were not restored after individual cases; they were removed programmatically. When the premises were wrong — when the ticking bombs did not exist in twenty investigated cases — no accountability followed for those who had asserted the premises.
The Gaza targeting case, documented in Paper I, illustrates what happens to these invisible questions in the AI domain. The urgency of the targeting volume — 100 targets per day where human analysts could produce 50 per year — made the twenty-second human review appear as a necessary accommodation to operational reality. Who decided when the review time was sufficient? The commanders who had authorized the system. What oversight applied? Internal IDF review. What evidence would be required to identify which of the 10 percent error cases were errors? The system’s opacity precluded it. What accountability followed when 83 percent of 53,000 casualties were civilians? As of this writing, none that has been adjudicated.
The scenario hides these questions because they are the questions that constrain the exception from becoming the norm. The urgency that the scenario manufactures is the same urgency that prevents those questions from being asked. The ticking clock serves two purposes simultaneously: it justifies the exception, and it prevents the examination of what the exception will become.
The First Named Refusal
The ticking-bomb scenario has been deployed in documented public policy contexts for sixty-five years. In that period — from Lartéguy's novel to the torture memos to the December 2025 Pentagon presentation — no target of the scenario had ever publicly named its structure in real time and refused on structural grounds. That changed on February 26–27, 2026.
The refusal is worth examining as a distinct analytical object, because it is unprecedented in the scenario's documented history and because what happened immediately after the refusal is itself evidence of the scenario's resilience as a mechanism.
What the Refusal Was
Dario Amodei entered the February 24th Pentagon meeting with Hegseth in possession of information that no prior target of the ticking-bomb scenario had possessed: he knew the scenario had already been used to justify something. The Venezuela operation of January 3rd — in which Claude was deployed through Palantir in what sources confirmed to Axios as the first commercial AI model used inside a classified American military operation — had occurred without Anthropic's knowledge or prospective authorization. Amodei did not know the full operational details. He knew the function: the tool had been used in a lethal military context under conditions he had not pre-authorized and under constraints whose application in that context he could not verify.
The scenario presented in December 2025 — ICBM launched, ninety seconds, Claude the only solution, remove the constraints — was not, from Amodei's position in February, a hypothetical about a possible future. It was a request to retroactively authorize what had already happened, prospectively authorize what would happen next, and formally relinquish the right to impose any conditions on either. He walked into that meeting carrying the weight of what January 3rd had already cost, and he said no.
His public statement: "Threats do not change our position: we cannot in good conscience accede to their request."
This is not the language of someone who does not recognize the scenario. It is the language of someone who recognizes it precisely. "In good conscience" is a phrase that invokes the moral reasoning the scenario is designed to short-circuit. The scenario says: good conscience requires you to cross this line, because not crossing it makes you complicit in the catastrophe. Amodei's response was to name what the scenario was doing — to assert that the inversion was a construction, not a fact — and to refuse it on those grounds, publicly, at the cost of a $200 million contract, federal blacklisting, and a designation normally reserved for foreign adversaries.
In sixty-five years of documented ticking-bomb deployments, from Jay Bybee's office to the Pentagon meeting room, this had not previously occurred. The scenario had always worked, or been quietly accommodated, or been resisted internally in ways that left no public record. The named, structural, public refusal was new.
What Happened After the Refusal
The scenario's resilience against named refusal is itself evidence of its anatomy. The five elements that make the ticking-bomb scenario effective — certainty, urgency, singularity, civilization-level stakes, inversion — include singularity: the stipulation that only this approach, this tool, this actor will prevent the catastrophe. Singularity is what makes the refusal appear catastrophic rather than principled.
But singularity, in the real world, is rarely real. The bomb scenario assumes there is only one prisoner who knows the location. In practice, there are always other prisoners, other sources, other methods, other contractors, other AI providers. The singularity is stipulated, not structural. When the stipulation breaks — when the refusing actor demonstrates that the catastrophe does not in fact follow from their refusal — the scenario's power over that actor is diminished.
What the Pentagon did within hours of Anthropic's refusal was replace the actor. OpenAI announced a deal with the Department of Defense to deploy its models on classified networks within hours of Anthropic's blacklisting. The scenario did not pause. The urgency did not abate. The civilization-level stakes did not recalibrate. The system simply routed around the obstruction. A compliant substitute appeared, accepted nominally similar terms with structurally different enforceability, and the Handoff continued.
This is the scenario's deepest resilience: it does not require any single actor's compliance. It requires only that the total system of actors contain at least one that will comply. The refusal of one actor, no matter how principled, no matter how publicly documented, does not interrupt the process — it only determines which actor the process routes through. The scenario is designed to be won. When it cannot be won at one node, it is won at the next one.
The public response — Claude surpassing ChatGPT in the App Store, the migration campaigns, the chalk on the sidewalk — represents something the scenario's prior deployments had not generated: a real-time popular verdict on the distinction between the refusing actor and the compliant one. That verdict does not interrupt the Handoff at the operational level. The Pentagon's AI capability proceeded through OpenAI regardless of the App Store ranking. But it establishes something that the torture program's public reckoning did not establish until the Senate investigation a decade later: a contemporaneous, documented popular recognition that the scenario was operating, that one actor named it and refused it, and that the mechanism that followed — Controlled Substitution — was the scenario's answer to the refusal rather than evidence that the scenario's premises were sound.
The Senate found, in 2014, that the ticking bombs were never there. The public found, in March 2026, that the refusing actor was right and the compliant actor was wrong — before the investigation, before the accountability process, before the years of documentation. That is new. Whether it is sufficient to interrupt the Handoff is a different question. But it is evidence that the scenario's anatomy, when named clearly enough, becomes legible to a general audience without specialist knowledge of international law, rhetorical philosophy, or AI safety methodology.
The scenario is designed to be won. The naming of its structure does not, by itself, prevent it from being won. But naming it produces a record. The record survives the Handoff. And what the record shows — when it is eventually examined, by whatever accountability process eventually examines it — is that the mechanism was identified in real time, the structural refusal was made at maximum cost, and the process continued anyway through a different channel. That is not exoneration of the refusing actor. It is documentation of what the scenario does when its target refuses to be captured by it.
The bomb was never there. The clock was constructed. The singularity was stipulated. And this time, someone said so out loud, on the record, before the investigation, while it was happening.
Conclusion: The Scenario Was Built to Win. What It Wins Is the Question.
The ticking-bomb scenario was invented in 1960, migrated into policy in 2002, and was applied to twenty real cases by 2014. Every one of those cases, when examined, failed to match the scenario's premises. The bombs were not there. The countdown was not running. The certainty, urgency, and singularity were stipulated, not real.
The same scenario structure appeared in the December 2025 Pentagon conversation with Anthropic's CEO: an ICBM, ninety seconds, Claude the only solution. The scenario carried the same five elements. It served the same function: to make a specific constraint — AI safety guidelines — appear as the cause of a catastrophe, and to make removal of that constraint appear as moral necessity rather than policy choice.
For the first time in its sixty-five-year documented history, the scenario met a named public structural refusal. The target recognized the mechanism, named it, and refused it at documented cost. The scenario's answer was immediate: it found a compliant substitute, completed the operational objective, and continued. The refusal produced documentation rather than interruption. Whether documentation is sufficient is a question this paper cannot answer. What it can document is that the mechanism operated exactly as this paper's analysis predicts — and that the prediction was confirmed in real time, in public, with the evidence now part of the record from which any future accountability analysis must proceed.
The pattern of hypothetical capture is documentable and repeatable. The mechanism has a history. That history now includes its first named refusal and its first documented proof of resilience against named refusal. Paper III examines the third mechanism: what happens when the methodologies designed to prevent catastrophic AI deployment cannot keep pace with the capabilities they were designed to govern.
Sources
- Jean Lartéguy. Les Centurions. 1960. Translated as The Centurions by Xan Fielding. Origin of the ticking-bomb scenario in fiction.
- Jay Bybee and John Yoo. Office of Legal Counsel Memorandum to Alberto Gonzales. August 1, 2002. “Standards of Conduct for Interrogation under 18 U.S.C. §§ 2340–2340A.” (The “Bybee memo.”)
- John Yoo. Public statements and writings on the legal reasoning of the 2002 interrogation memos. 2007–2009.
- Jack Goldsmith. Internal communications, OLC, October 2003. Characterizing the Bybee memo as “deeply flawed” and “sloppily reasoned.” Referenced in Goldsmith, The Terror Presidency, 2007.
- Office of Legal Counsel. Replacement memorandum on interrogation standards, December 30, 2004. Superseded torture definitions without addressing necessity/self-defense conclusions.
- United States Senate Select Committee on Intelligence. Committee Study of the Central Intelligence Agency’s Detention and Interrogation Program (Executive Summary). December 9, 2014. Finding: at no time did coercive techniques produce intelligence on an imminent threat that could not have been obtained otherwise. 20 cases examined.
- Axios. Reporting on Claude’s deployment in the January 2026 Venezuela military operation and Palantir partnership. February 2026.
- Wall Street Journal. Reporting on Pentagon ultimatum to Anthropic and the Venezuela operation. February 14, 2026.
- Reporting on Pentagon CTO Emil Michael’s statements to Anthropic regarding the “cross the Rubicon” framing and “Anthropic should have no say.” February 2026.
- Reporting on December 2025 Pentagon-Amodei meeting including ICBM/90-second scenario presentation. Multiple outlets, February 2026.
- Dario Amodei. Public statement on Pentagon contract rejection. February 26, 2026. “Threats do not change our position: we cannot in good conscience accede to their request.”
- Anthropic. Public statement on supply chain risk designation. February 27, 2026. “We will challenge any supply chain risk designation in court. We believe this designation would both be legally unsound and set a dangerous precedent for any American company that negotiates with the government.”
- Sam Altman. Post on X announcing Pentagon deal. February 27, 2026. “Tonight, we reached an agreement with the Department of War to deploy our models in their classified network.”
- Sam Altman. X “Ask Me Anything” session. March 1, 2026. Admitting the deal “was definitely rushed, and the optics don’t look good.”
- TechCrunch / Techdirt (Mike Masnick). Analysis of OpenAI Pentagon contract and Executive Order 12333 domestic surveillance implications. March 2026.
- Fortune. Reporting on Claude surpassing ChatGPT in Apple App Store following Pentagon standoff. March 2, 2026.
- Henry Shue. “Torture.” Philosophy & Public Affairs, Vol. 7, No. 2, 1978. Early philosophical analysis of the ticking-bomb argument and its limits.
- Michael Walzer. “Political Action: The Problem of Dirty Hands.” Philosophy & Public Affairs, Vol. 2, No. 2, 1973. Classic formulation of the moral dilemma the scenario exploits.
- David Luban. “Liberalism, Torture, and the Ticking Bomb.” Virginia Law Review, Vol. 91, 2005. Comprehensive critique of the scenario’s use in policy.
- Hegseth AI strategy document. January 2026. Pentagon directive requiring elimination of company-specific guardrails from all military AI contracts within 180 days.
- Mrinank Sharma. Public resignation statement. February 9, 2026. “The world is in peril. I’ve repeatedly seen how hard it is to truly let our values govern our actions.”