On the morning of March 1, 2026, Iranian drone strikes hit three Amazon Web Services facilities in the Gulf region – two in the United Arab Emirates and one in Bahrain. The buildings contained no munitions, no soldiers, and no strategic command posts. They housed servers, cooling systems, and fiber-optic switching equipment – the physical substrate of the global internet economy.

They were targeted anyway, and they went offline.

AWS confirmed structural damage to two UAE facilities, disrupted power delivery to its Bahrain site, and fire suppression system activations that produced secondary water damage to server hardware. Core services – EC2, S3, DynamoDB, Lambda, and RDS – reported elevated error rates across the Gulf. The cascading effects were both immediate and wide-ranging: ride-sharing platform Careem went dark; payments firms Alaan and Hubpay suspended operations; Emirates NBD, First Abu Dhabi Bank, and Abu Dhabi Commercial Bank all reported service disruptions; enterprise data platform Snowflake experienced regional outages. AWS instructed customers to migrate their workloads immediately to alternate regions, describing the broader operating environment in the Middle East as, in the company's own language, "unpredictable."

Iran's Islamic Revolutionary Guard Corps stated publicly that the Bahrain facility had been targeted deliberately, citing Amazon's role in supporting U.S. military and intelligence operations. Multiple news organizations subsequently reported that the U.S. military had been using Claude – Anthropic's AI model running on AWS infrastructure – for intelligence assessments and battle simulations during joint U.S.-Israel strikes on Iran in the preceding days.

Uptime Institute, the independent data center authority, confirmed the events of March 1 as the first verified military attack on a hyperscale cloud provider in recorded history.

The era of the data center as a neutral civilian asset is over.


The Architecture of Failure: What the Strikes Revealed

How Redundancy Was Defeated

The AWS ME-CENTRAL-1 region in the UAE is engineered around three physically separated availability zones (mec1-az1, mec1-az2, and mec1-az3), each with independent power systems, network connectivity, and cooling infrastructure. This architecture reflects a foundational principle of enterprise cloud design: that no single failure point should be capable of taking down an entire region. The system is built to absorb a hardware fault, a power outage, a software crash, or even a localized natural disaster – and continue operating.

The March 1 strikes eliminated two of the three zones simultaneously. The redundancy model held no answer for that scenario, because it had never been designed to address one. Coordinated kinetic attacks against multiple physical sites within a single region represent a class of threat that commercial cloud architecture has not historically needed to consider, and the response AWS was left to offer its customers – migrate your workloads, back up your data, direct traffic elsewhere – was an acknowledgment of that gap in real time.

AWS's public communications described recovery as expected to be prolonged "given the nature of the physical damage involved." That phrase carries more weight than its bureaucratic cadence suggests. It marks a categorical boundary between the kinds of disruptions these facilities were engineered to absorb and the kind they experienced on March 1. Servers can be rebooted. Structural damage to reinforced concrete requires contractors, permits, and weeks of physical reconstruction. The cloud had met its limits.

The Dual-Use Architecture That Created the Target

Iran's stated rationale for the strikes was not arbitrary. The IRGC claimed the Bahrain facility was chosen specifically because AWS hosts U.S. military workloads – and that claim, while unverified by Amazon, exposes a structural problem at the intersection of commercial cloud computing and national defense that the technology industry has been comfortable leaving unresolved for years.

The Pentagon's Joint Warfighting Cloud Capability (JWCC), awarded in December 2022 to AWS, Microsoft, Google, and Oracle, was explicitly designed to provide the Department of Defense with access to commercial cloud services across all security classification levels – from unclassified environments through Top Secret/SCI and Special Access Program workloads – running on the same physical infrastructure that simultaneously serves enterprise, government, and consumer customers.

The scale of this integration is substantial, as the following table illustrates:

Defense Cloud Contract Ceiling Value Primary Vendors
JWCC (current vehicle) $9 billion AWS, Microsoft, Google, Oracle
JWCC task orders awarded to date $3+ billion Multiple DoD components
NSA cloud contract ("WildandStormy") $10 billion AWS
CIA C2E cloud contract Multi-billion AWS, Microsoft, Google, Oracle, IBM
U.S. federal cloud spending (2024) $16.5 billion record Across agencies

The logic underpinning this architecture was, and to a degree remains, defensible: leveraging the scale, security investment, and global reach of private hyperscalers is dramatically more cost-effective than constructing parallel government infrastructure from scratch. The Pentagon benefits from the continuous infrastructure investment that commercial competition drives. The hyperscalers benefit from the revenue and the security credibility that government classification-level certification provides.

What neither party publicly acknowledged with adequate clarity is the strategic consequence of that arrangement: when commercial facilities are co-located with classified military workloads, they absorb the target profile of those workloads. The buildings in the UAE and Bahrain were civilian in their ownership, mixed in their function, and military in their exposure. As Zachary Kallenborn, a PhD researcher at King's College London, observed in the aftermath: "If data centers become critical hubs for transiting military information, we can expect them to be increasingly targeted by both cyber and physical attacks."


A Disclosure Problem With Strategic Dimensions

One of the most consequential dimensions of the March 1 strikes is not the damage they caused but the information they forced into public awareness. The AWS facilities in the Gulf were not running exclusively civilian applications. They were simultaneously running classified U.S. military workloads – and none of the parties whose data, transactions, or services depended on those facilities had been informed of that arrangement.

This was not unique to the Gulf. The architecture of U.S. defense cloud computing distributes military workloads across commercial facilities globally, on infrastructure that concurrently hosts civilian enterprise customers. The NSA's $10 billion cloud contract runs on AWS. The CIA's C2E contract spans AWS, Microsoft, Google, Oracle, and IBM. JWCC task orders cover classified workloads on the same physical and logical infrastructure that serves commercial enterprise customers under standard service agreements.

The Foreign Policy Research Institute articulated the operational consequence with precision: a targeted attack on commercial data center infrastructure can produce direct and immediate consequences for military command-and-control capabilities. The same power grid, the same fiber optic backbones, and the same physical street address serve both functions. A disruption to copper supply, transformer-grade steel, or photonic switching components slows both civilian and military systems simultaneously, because at the physical layer, they are not separate systems.

This creates a consent problem that international law does not fully resolve. There is a reasonable argument under the laws of armed conflict that infrastructure used in support of military operations becomes a legitimate military target regardless of its civilian ownership. That argument does not address whether civilian customers of commercial cloud providers ever agreed – through terms of service, through procurement contracts, or through any other mechanism – to have their data co-located with classified military systems in an active conflict zone. They were not asked. They were not told.

The Submarine Cable Dimension

The March 1 strikes were not the only infrastructure exposure the conflict brought into focus. Seventeen submarine cables transit the Red Sea, collectively carrying the majority of data traffic between Europe, Asia, and Africa. The combination of Iran's closure of the Strait of Hormuz and renewed Houthi activity in the Red Sea placed both of these critical data routing corridors in active conflict zones at the same time – a scenario without historical precedent.

Doug Madory, director of internet analysis at network intelligence firm Kentik, characterized the potential consequences plainly: "Closing both choke points simultaneously would be a globally disruptive event. I'm not aware of that ever happening." Subsea cable attacks are not novel in isolation – Sweden investigated a cable severance between Latvia and Sweden in 2025, and Taiwan detained a vessel suspected of destroying cables near the Penghu islands – but the Gulf represents an unusual concentration of both data center infrastructure and subsea cable routing, and the conflict subjected both to simultaneous pressure for the first time.

The strategic response from Gulf states has been swift. Saudi Arabia, Qatar, and the UAE are reportedly financing alternative data corridors through Syria, Iraq, and East Africa to reduce dependence on the two constrained maritime choke points – an initiative that would accelerate a geographic rerouting of the global internet already underway for geopolitical reasons, at a cost and pace that the conflict has dramatically compressed.


The AI Inflection Point: Why Compute Became a Military Objective

From Economic Asset to Strategic Target

For most of the history of commercial cloud computing, disrupting a data center was, at its most severe, an act of economic sabotage. It could knock out banking services, disable logistics platforms, and create cascading failures across dependent software ecosystems. What it could not do, in any meaningful sense, was degrade the kinetic military capabilities of a nation-state adversary. The relationship between cloud infrastructure and military power was indirect – an institutional inconvenience rather than an operational threat.

Artificial intelligence has fundamentally altered that calculus. Modern military AI systems are not peripheral enhancements; they are increasingly embedded in core operational functions:

  • Target identification and engagement sequencing, where AI models analyze sensor data to generate targeting recommendations
  • Logistics and supply chain optimization, where real-time AI processing reduces the latency between operational need and material response
  • Intelligence analysis and synthesis, where large-scale AI systems process signals intelligence and open-source data faster than human analysts alone can manage
  • Battlefield simulation and adversarial wargaming, where AI-generated scenarios inform strategic planning and command-level decision-making

When AI systems perform these functions, the compute infrastructure sustaining them acquires the strategic significance of a command-and-control node. Under established doctrines of military targeting, attacking an adversary's command-and-control capability is a legitimate and high-priority objective. The data center running the targeting AI becomes, by that logic, a valid military target – even when it simultaneously processes civilian banking transactions in the same rack.

The Foreign Policy Research Institute framed the historical shift with directness: "Previously, power projection relied on fuel and steel. Currently, it relies on megawatts and computational throughput." The physical foundations of AI infrastructure – transformers, rare-earth elements, copper cabling, and fiber optics – are as essential to contemporary national security capability as shipyards and steel mills were to industrial-era military power. March 1 made that transition impossible to ignore.

The Physical Vulnerability of AI-Scale Infrastructure

Understanding why hyperscale data centers constitute such an asymmetrically attractive target requires an appreciation of their physical composition. A single 100-megawatt AI data center – a facility with a power draw equivalent to a mid-sized American city – imposes extraordinary material requirements:

Physical Component Required Quantity per 100 MW Facility
Copper (cabling and busbars) Approximately 2,700 tons
Transformer-grade steel 150 to 200 tons
Concrete and structural steel More than 50,000 tons
High-voltage substation connections Dedicated dedicated infrastructure
Active power draw 100 MW continuous (city-scale equivalent)

This physical scale creates both the strategic value and the strategic vulnerability of these facilities in one configuration. The capital concentration is enormous – U.S. companies increased spending on data center physical assets by 40 percent between 2022 and 2024, and are planning hundreds of billions in annual investment through the end of the decade, with the overwhelming majority earmarked for AI infrastructure. That same concentration of irreplaceable, slowly replaceable hardware makes these facilities high-value targets where a relatively low-cost attack can produce disproportionate damage.

A weaponized drone costing a few thousand dollars can cause hundreds of millions of dollars in structural damage and trigger billions of dollars in cascading economic disruption. The asymmetric calculus strongly favors the attacker, and adversaries have drawn the obvious conclusions.


From Perimeter Fences to Hardened Bunkers: The Security Transformation Required

A Security Philosophy Built for a Different Threat

Prior to March 2026, the security architecture of commercial data centers was designed around a threat model that combined sophisticated cyber defenses with conventional physical access control. On the cyber side, this included zero-trust network architecture, continuous intrusion detection, hardware supply chain audits, and increasingly, AI-assisted anomaly detection. On the physical side, the model relied on perimeter fencing, badge-controlled access points, biometric verification at critical zones, surveillance systems, and trained security personnel.

This architecture was designed to prevent unauthorized human access and to defend against remote network intrusions. It was not designed to survive a coordinated kinetic strike from a state actor operating drone swarms at stand-off distances. The philosophical gap between these two threat models is substantial, and closing it requires rethinking data center security from a fundamentally different starting premise.

The contrast between the existing security model and the one now required can be understood as follows:

Security Dimension Pre-2026 Standard Post-March 2026 Requirement
Primary physical threat model Unauthorized human access Kinetic drone and missile attack
Cyber defense approach Zero-trust architecture, intrusion detection Unchanged, plus OT/IoT hardening
Redundancy design Single-zone failure tolerance Multi-zone coordinated attack tolerance
Power resilience Grid-connected with UPS backup Independent on-site generation capability
Structural specification Commercial construction standards Military-grade hardening for critical facilities
Geographic risk assessment Uptime and connectivity focus Geopolitical conflict zone analysis
Data replication Cost-optimized regional placement Security-driven multi-region distribution

Patrick J. Murphy, executive director of the geopolitical unit at advisory firm Hilco Global, framed the implications with clarity: "Iran and proxies have targeted oil fields in the past, but their attacks this week on UAE data centers show they are now considered critical infrastructure." His projection – that governments will increasingly incorporate data centers into national security planning frameworks alongside energy facilities, telecommunications networks, water treatment plants, and transportation hubs – reflects not a speculative outcome but an observable policy trajectory already underway.

The Economics of Physical Hardening

The industry response that has emerged in the weeks following the March 1 strikes converges on a tiered architectural model: a small number of physically hardened, high-security facilities for the most sensitive and mission-critical workloads, supported by a broader distributed network of conventional edge data centers providing low-latency service delivery and baseline redundancy.

The economics of full bunkerization are instructive in explaining why this tiered approach is the realistic option rather than wholesale infrastructure hardening. According to Larry Hall of Survival Condo, a Kansas-based firm specializing in hardened real estate, constructing new data centers in underground, nuclear-hardened facilities currently costs in excess of $2,000 per square foot in the United States – roughly twice the cost of above-ground construction. Applied to a typical hyperscale data center, which spans the footprint of a Manhattan city block, a fully hardened underground equivalent would cost approximately $200 million before a single server, cooling unit, or power system is installed. At the scale of investment currently planned for U.S. AI infrastructure, full bunkerization of the estate is not a credible option.

The more operationally realistic response, as articulated by Murat Kantarcioglu, a data security specialist at Virginia Tech, centers on geographic redundancy as a non-negotiable baseline: maintaining copies of critical data in multiple geographically distributed regions, accepting the incremental transfer and storage cost as the price of resilience rather than an inefficiency to be optimized away. This was already considered best practice before March 1. After March 1, it has become a minimum standard that no organization with meaningful geopolitical exposure can responsibly defer.

The Counter-Drone Authorization Problem

Counter-drone defense systems capable of intercepting and neutralizing incoming UAVs exist and are operationally deployed by U.S. military forces. The challenge of extending these capabilities to commercial data center operators involves not only technical integration but a significant regulatory gap that current law does not bridge.

Counter-UAS capabilities that involve kinetic interception – the physical destruction of an incoming drone – require federal authorization that commercial facility operators do not currently possess. The regulatory framework governing the defense of private infrastructure against aerial attack in civilian airspace was drafted for a different operational environment and does not contemplate the scenario now facing data center operators in conflict-adjacent regions. Deploying such systems without authorization exposes operators to significant legal liability; deploying them without adequate authority creates risk of unauthorized use of force in civilian airspace.

This gap will need to close through legislation, executive action, or both. The question is not whether that closure will occur – the March 1 precedent makes some form of expanded commercial counter-UAS authorization increasingly likely – but how quickly the regulatory machinery will move, and how the cost of deployment will be allocated between commercial operators, insurers, and government authorities.


The Policy Reckoning: What the United States Has Not Acknowledged

The JWCC Decision and Its Consequences

The most structurally uncomfortable implication of the March 1 strikes is that the current U.S. defense cloud strategy was not simply exposed by the conflict – it materially contributed to the vulnerability it is now being forced to address. The decision to run classified military workloads on commercial infrastructure shared with civilian customers was a deliberate policy choice, one that offered genuine efficiency advantages and was supported by a considered procurement rationale. It was also a choice that transferred the target profile of U.S. military operations to commercial facilities, and by extension, to every civilian customer, SaaS provider, financial institution, and healthcare organization that operates on that same infrastructure.

The JWCC contract was presented, at its launch, as a model of efficient and modern defense procurement. The framing was not inaccurate. What it omitted was any serious public engagement with the question of what the co-location of classified military AI workloads with civilian enterprise data would mean for the physical security of the commercial facilities involved, for the risk exposure of non-consenting civilian customers, and for the strategic calculus of adversaries seeking to degrade U.S. military capability.

Under the laws of armed conflict, infrastructure that provides material support to military operations may be considered a legitimate military target, regardless of its civilian ownership or the presence of civilian data and customers. That legal framework existed before the JWCC contract was signed. The policy decision proceeded anyway.

The Anthropic Dispute as Diagnostic

The March 1 strikes did not occur in political isolation. They came within days of one of the most publicly visible confrontations between the AI industry and the U.S. defense establishment in recent memory – a confrontation that illuminates, with unusual clarity, the tensions that the militarization of commercial AI infrastructure has generated.

The sequence of events is instructive:

Date Event
July 2025 Anthropic received a $200 million contract to run Claude on classified military networks via Palantir
February 2026 Defense Secretary Hegseth demanded full, unrestricted access to Claude for any lawful military purpose, explicitly including lethal targeting and autonomous weapons applications
February 27, 2026 Anthropic refused; the Pentagon designated Anthropic a "supply chain risk to national security" -- a classification normally reserved for foreign state actors -- and directed agencies to cease using Claude
March 1, 2026 Iranian drone strikes targeted three AWS facilities in the Gulf
Days following OpenAI executed a new agreement with the DoD -- a deal that OpenAI's own CEO characterized publicly as having "looked opportunistic and sloppy"

The Anthropic case illustrates a tension that the broader industry has not resolved and cannot indefinitely defer: AI companies built their systems with explicit safety commitments and, in Anthropic's case, constitutional frameworks designed to prevent the systems from facilitating serious harm. The Defense Department sought to use those systems in operational contexts that the companies determined to be inconsistent with those commitments. The government's response – treating a safety-motivated refusal by a domestic AI company as a threat to national security – signals the terms on which the militarization of AI is being negotiated, and they are not favorable to the industry's self-conception as a safety-oriented enterprise.

Taken together, the data center strikes and the Anthropic designation reveal the pace at which the AI industry has been drawn into national security frameworks that none of its founders designed for, and the extent to which that integration has created physical, legal, and reputational exposure for companies and their customers that extends well beyond anything that existed eighteen months ago.


The Investment Reckoning: Repricing a $3 Trillion Buildout

Where Capital Flows After the First Strike

Morgan Stanley projects nearly $3 trillion in global data center capital expenditure through 2028, comprising approximately $1.6 trillion in hardware and $1.3 trillion in building infrastructure. That projection was developed against a baseline assumption that data centers, whatever their cyber risk profile, were physically secure commercial assets operating in environments governed by civilian law. March 1 has invalidated that assumption for any facility operating in or near geopolitically contested regions, and the investment implications are substantial.

The strategic shifts now accelerating across the industry reflect a fundamental repricing of physical risk:

  • Geographic redistribution: Hyperscalers are accelerating diversification out of single-region concentrations in politically unstable areas, prioritizing resilience over the cost efficiencies that geographic consolidation typically provides.
  • Multi-region redundancy: Enterprise customers are accepting higher data transfer and storage costs in exchange for workload replication across geographically distant regions, treating the incremental expense as a security investment rather than an operational inefficiency.
  • Architectural segregation: Pressure is building – from customers, insurers, and regulators – to physically separate military and civilian cloud workloads into distinct facilities, eliminating the co-location that gave the Gulf strikes their target justification.
  • Counter-drone and physical hardening investment: A nascent but growing market for autonomous drone intercept systems, reinforced structural specifications, and EMP-resistant infrastructure is emerging, oriented specifically toward the data center operator segment.
  • Sovereign cloud acceleration: Governments that previously relied on hyperscaler commercial infrastructure for sensitive workloads are accelerating the development of domestically controlled, physically protected sovereign cloud facilities with explicit security classifications and military-standard hardening requirements.

The Domestic Buildout Faces Compounding Headwinds

The natural response to geopolitical risk in the Gulf – reshoring AI infrastructure investment to the United States – is complicated by a set of domestic pressures that were already generating significant friction before March 1 and have not eased since. In 2025 alone, at least 25 U.S. data center projects were canceled, representing a fourfold increase from the prior year, with 16 major projects worth a combined $64 billion either blocked or significantly delayed. The primary drivers were community opposition to power grid strain and water consumption impacts, combined with permitting constraints that have slowed project timelines across multiple states.

The intersection of these two forces -- elevated geopolitical risk in contested overseas regions and compounding community and regulatory resistance to domestic construction -- will define the geography of the next generation of AI infrastructure in ways that neither the industry nor policymakers have fully confronted. Building in the Gulf is now demonstrably dangerous. Building in the United States is increasingly expensive and contested. The viable location set for new AI infrastructure is narrowing, and the capital cost of developing within that set is rising.


Structural Implications: The Industry Must Decide What It Built

The companies that constructed modern cloud infrastructure – Amazon, Microsoft, Google, and Oracle – created platforms of a scale, efficiency, and reliability that no single institution, government, or private enterprise could have produced independently. They made that infrastructure available to militaries, governments, financial institutions, hospitals, and consumers at price points and service levels that compressed the cost of computing for the entire global economy. That achievement is real and its benefits are broadly distributed.

The problem is that the same structural properties that generate this value – massive physical centralization, global geographic reach, deep integration with government and military operations – are precisely the properties that constitute a compelling target profile for any state actor seeking to degrade the operational capability of an adversary whose military increasingly runs on commercial AI infrastructure. As Sam Winter-Levy, a fellow at the Carnegie Endowment for International Peace, observed: "Physical attacks are only going to become more common moving forward as AI becomes more and more significant. As more and more parts of the economy rely on these data centers, they correspondingly become increasingly attractive targets."

The options available to address this vulnerability each carry substantial costs and limitations:

Response Option Potential Benefit Primary Limitation
Physical segregation of military and civilian workloads Removes co-location target justification Requires rebuilding Pentagon cloud architecture at enormous cost
Geographic diversification away from conflict regions Reduces exposure in highest-risk zones Cannot eliminate target profile where U.S. military presence creates it
Full physical hardening of critical facilities Substantially improves survivability Economically impractical at hyperscale; doubles construction cost per square foot
Geographic data redundancy across distant regions Resilient to single-region destruction Does not address the kinetic targeting problem, only its consequences
Counter-drone and active defense systems Directly addresses drone attack vector Regulatory authorization gaps in civilian airspace; significant deployment cost
Sovereign cloud separation Clarifies target profile and legal status Requires substantial new government infrastructure investment

None of these options, individually or in combination, constitutes a complete resolution. What March 1, 2026 foreclosed is the option to defer the conversation indefinitely. The industry has built infrastructure that is simultaneously indispensable to the global economy and integral to the military operations of the world's most powerful nation-state. It must now determine what obligations that dual function creates – in terms of disclosure, in terms of physical security, in terms of legal liability, and in terms of the allocation of costs among operators, customers, governments, and insurers.

These are not engineering questions. They are policy questions, legal questions, and ultimately political ones – and the March 1 strikes have removed the luxury of treating them as someone else's problem.

The servers that power artificial intelligence are the new oil fields. The world just learned what happens when someone decides to bomb them.


Frequently Asked Questions

What happened to the AWS data centers in the UAE and Bahrain in March 2026?

On March 1, 2026, Iranian drone strikes damaged three Amazon Web Services facilities – two in the UAE and one in Bahrain. The attacks produced structural damage, disrupted power delivery, and triggered fire suppression systems that generated additional water damage to server hardware. Two of the three availability zones in AWS's UAE ME-CENTRAL-1 region were taken offline, along with one zone in Bahrain. Services including Careem, Emirates NBD, First Abu Dhabi Bank, and Snowflake all reported outages. Uptime Institute subsequently confirmed the events as the first verified military attack on a hyperscale cloud provider in recorded history.

Why did Iran target commercial data centers rather than conventional military assets?

Iran's IRGC stated that the Bahrain facility was specifically selected because AWS hosts U.S. military workloads, including AI systems reportedly used for intelligence assessments and battle simulations during the preceding U.S.-Israel strikes on Iran. The targeting logic reflects the dual-use reality of the Pentagon's JWCC contract architecture, which runs classified military AI and command systems on the same commercial cloud infrastructure that concurrently serves civilian customers – meaning the facilities carry a military target profile irrespective of their civilian ownership or the presence of non-military data and services.

What is the Pentagon's Joint Warfighting Cloud Capability (JWCC), and what does it mean for civilian cloud users?

JWCC is the U.S. Department of Defense's enterprise cloud acquisition vehicle, awarded in December 2022 to AWS, Microsoft, Google, and Oracle with a contract ceiling of $9 billion, under which more than $3 billion in task orders have been awarded to date. The contract provides DoD with access to commercial cloud services across all security classification levels, from unclassified through Top Secret/SCI. For civilian cloud customers, the relevant implication is that the commercial infrastructure on which their data and services reside may simultaneously host classified military workloads – and that this co-location arrangement has not typically been disclosed in standard service agreements.

Are U.S.-based data centers at risk of similar physical attacks?

Physical kinetic attacks on data center infrastructure within the continental United States would represent a substantially escalated act of aggression, though the threat landscape for domestic facilities is nonetheless significant and multidimensional. The Institute for AI Policy and Strategy has identified AI data centers as high-priority targets for adversaries – particularly China and Russia – seeking to steal model weights representing hundreds of millions of dollars in training investment, introduce hardware backdoors through supply chain compromise, or sabotage AI systems underlying military and critical infrastructure operations. Domestic facilities face less acute kinetic risk but more sophisticated and persistent cyber and supply chain threats than their overseas counterparts.

What does physically hardening a data center actually cost, and is it feasible at scale?

Underground, nuclear-hardened data center construction currently costs in excess of $2,000 per square foot in the United States, approximately twice the cost of standard above-ground construction. A fully hardened underground facility at the scale of a typical hyperscale data center – which spans roughly the footprint of a Manhattan city block – would cost approximately $200 million before any hardware, cooling, or power systems are installed. Full bunkerization of the existing or planned data center estate is not economically viable at scale. The more realistic near-term standard involves mandatory geographic redundancy across multiple distant regions, physical perimeter hardening of existing above-ground facilities, and selective application of advanced counter-drone and active defense systems to the highest-priority sites.

What is the Anthropic-Pentagon dispute, and what does it reveal about the militarization of commercial AI?

In July 2025, Anthropic received a $200 million contract to operate Claude on classified military networks through a Palantir integration. By February 2026, Defense Secretary Hegseth had escalated to demanding full, unrestricted access to Claude for any lawful military purpose, including lethal targeting assistance and autonomous weapons applications. Anthropic declined to provide that access, citing its existing safety commitments. The Pentagon responded by designating Anthropic a "supply chain risk to national security" – a classification historically reserved for foreign state actors – and directing federal agencies to cease use of Claude. The episode illustrates the structural tension between AI companies' constitutional safety frameworks and the military's demand for unrestricted operational capability, and it demonstrates the legal and reputational exposure that safety-oriented AI companies face when operating in national security contexts.

How should enterprise organizations revise their cloud strategy in response to the March 2026 strikes?

Enterprises with meaningful geopolitical exposure should treat the March 1 events as a forcing function for cloud architecture decisions that have been deferred in favor of cost optimization. The most urgent revisions include mandatory multi-region data replication as a baseline security standard rather than an optional resilience upgrade; separation of the most sensitive workloads into geographically distant regions outside active or potential conflict zones; due diligence on the military relationships and co-location arrangements of cloud providers in contested regions; and engagement with legal and compliance teams on the implications of data residency in facilities that may host classified military workloads without customer disclosure.

What are the implications for the $3 trillion global data center buildout projected through 2028?

Morgan Stanley's projection of nearly $3 trillion in global data center capital expenditure through 2028 was calibrated against a risk model in which physical attack on commercial cloud facilities was hypothetical rather than demonstrated. The March 1 strikes force a repricing of that risk for facilities in geopolitically contested regions, with direct implications for site selection decisions, structural specifications, insurance underwriting, and the cost of capital for projects in affected markets. Domestically, the buildout faces simultaneous headwinds from community opposition to power grid and water consumption impacts – which contributed to the cancellation or delay of at least 25 U.S. projects representing a combined $64 billion in 2025 alone. The compression of viable location options, combined with the increased cost of security-compliant construction, will substantially affect both the pace and the economics of AI infrastructure development over the coming decade.


The AI Regulation War Is About to Explode — And Your Business Is Caught in the Middle
AI regulation is fracturing across the US, EU, and globally in 2026. Here’s what every business needs to know about deadlines, penalties, and how to prepare.
The February 2026 AI Model War Nobody Saw Coming: GPT-5, Claude, and DeepSeek Are All Moving at Once
GPT-5.2, Claude Opus 4.6, and DeepSeek V4 are colliding in February 2026. Here’s what’s actually different, what it means for your work, and who’s winning.
Gemini 3 Flash vs GPT-4.5 Turbo: The Speed Wars of 2026
Gemini 3 Flash: 218 tokens/sec. GPT-4.5 Turbo: 125 t/s. Speed is the new intelligence. When models score within 5%, the fastest wins. Sub-1-second responses are now the baseline. Welcome to the speed wars.