On the morning of March 1, 2026, Iranian drone strikes hit three Amazon Web Services facilities in the Gulf region – two in the United Arab Emirates and one in Bahrain. The buildings contained no munitions, no soldiers, and no strategic command posts. They housed servers, cooling systems, and fiber-optic switching equipment – the physical substrate of the global internet economy.
They were targeted anyway, and they went offline.
AWS confirmed structural damage to two UAE facilities, disrupted power delivery to its Bahrain site, and fire suppression system activations that produced secondary water damage to server hardware. Core services – EC2, S3, DynamoDB, Lambda, and RDS – reported elevated error rates across the Gulf. The cascading effects were both immediate and wide-ranging: ride-sharing platform Careem went dark; payments firms Alaan and Hubpay suspended operations; Emirates NBD, First Abu Dhabi Bank, and Abu Dhabi Commercial Bank all reported service disruptions; enterprise data platform Snowflake experienced regional outages. AWS instructed customers to migrate their workloads immediately to alternate regions, describing the broader operating environment in the Middle East as, in the company's own language, "unpredictable."
Iran's Islamic Revolutionary Guard Corps stated publicly that the Bahrain facility had been targeted deliberately, citing Amazon's role in supporting U.S. military and intelligence operations. Multiple news organizations subsequently reported that the U.S. military had been using Claude – Anthropic's AI model running on AWS infrastructure – for intelligence assessments and battle simulations during joint U.S.-Israel strikes on Iran in the preceding days.
Uptime Institute, the independent data center authority, confirmed the events of March 1 as the first verified military attack on a hyperscale cloud provider in recorded history.
The era of the data center as a neutral civilian asset is over.
The Architecture of Failure: What the Strikes Revealed
How Redundancy Was Defeated
The AWS ME-CENTRAL-1 region in the UAE is engineered around three physically separated availability zones (mec1-az1, mec1-az2, and mec1-az3), each with independent power systems, network connectivity, and cooling infrastructure. This architecture reflects a foundational principle of enterprise cloud design: that no single failure point should be capable of taking down an entire region. The system is built to absorb a hardware fault, a power outage, a software crash, or even a localized natural disaster – and continue operating.
The March 1 strikes eliminated two of the three zones simultaneously. The redundancy model held no answer for that scenario, because it had never been designed to address one. Coordinated kinetic attacks against multiple physical sites within a single region represent a class of threat that commercial cloud architecture has not historically needed to consider, and the response AWS was left to offer its customers – migrate your workloads, back up your data, direct traffic elsewhere – was an acknowledgment of that gap in real time.
AWS's public communications described recovery as expected to be prolonged "given the nature of the physical damage involved." That phrase carries more weight than its bureaucratic cadence suggests. It marks a categorical boundary between the kinds of disruptions these facilities were engineered to absorb and the kind they experienced on March 1. Servers can be rebooted. Structural damage to reinforced concrete requires contractors, permits, and weeks of physical reconstruction. The cloud had met its limits.
The Dual-Use Architecture That Created the Target
Iran's stated rationale for the strikes was not arbitrary. The IRGC claimed the Bahrain facility was chosen specifically because AWS hosts U.S. military workloads – and that claim, while unverified by Amazon, exposes a structural problem at the intersection of commercial cloud computing and national defense that the technology industry has been comfortable leaving unresolved for years.
The Pentagon's Joint Warfighting Cloud Capability (JWCC), awarded in December 2022 to AWS, Microsoft, Google, and Oracle, was explicitly designed to provide the Department of Defense with access to commercial cloud services across all security classification levels – from unclassified environments through Top Secret/SCI and Special Access Program workloads – running on the same physical infrastructure that simultaneously serves enterprise, government, and consumer customers.
The scale of this integration is substantial, as the following table illustrates:
| Defense Cloud Contract | Ceiling Value | Primary Vendors |
|---|---|---|
| JWCC (current vehicle) | $9 billion | AWS, Microsoft, Google, Oracle |
| JWCC task orders awarded to date | $3+ billion | Multiple DoD components |
| NSA cloud contract ("WildandStormy") | $10 billion | AWS |
| CIA C2E cloud contract | Multi-billion | AWS, Microsoft, Google, Oracle, IBM |
| U.S. federal cloud spending (2024) | $16.5 billion record | Across agencies |
The logic underpinning this architecture was, and to a degree remains, defensible: leveraging the scale, security investment, and global reach of private hyperscalers is dramatically more cost-effective than constructing parallel government infrastructure from scratch. The Pentagon benefits from the continuous infrastructure investment that commercial competition drives. The hyperscalers benefit from the revenue and the security credibility that government classification-level certification provides.
What neither party publicly acknowledged with adequate clarity is the strategic consequence of that arrangement: when commercial facilities are co-located with classified military workloads, they absorb the target profile of those workloads. The buildings in the UAE and Bahrain were civilian in their ownership, mixed in their function, and military in their exposure. As Zachary Kallenborn, a PhD researcher at King's College London, observed in the aftermath: "If data centers become critical hubs for transiting military information, we can expect them to be increasingly targeted by both cyber and physical attacks."
The Undisclosed Stakes: Civilians, Consent, and Shared Infrastructure
A Disclosure Problem With Strategic Dimensions
One of the most consequential dimensions of the March 1 strikes is not the damage they caused but the information they forced into public awareness. The AWS facilities in the Gulf were not running exclusively civilian applications. They were simultaneously running classified U.S. military workloads – and none of the parties whose data, transactions, or services depended on those facilities had been informed of that arrangement.
This was not unique to the Gulf. The architecture of U.S. defense cloud computing distributes military workloads across commercial facilities globally, on infrastructure that concurrently hosts civilian enterprise customers. The NSA's $10 billion cloud contract runs on AWS. The CIA's C2E contract spans AWS, Microsoft, Google, Oracle, and IBM. JWCC task orders cover classified workloads on the same physical and logical infrastructure that serves commercial enterprise customers under standard service agreements.
The Foreign Policy Research Institute articulated the operational consequence with precision: a targeted attack on commercial data center infrastructure can produce direct and immediate consequences for military command-and-control capabilities. The same power grid, the same fiber optic backbones, and the same physical street address serve both functions. A disruption to copper supply, transformer-grade steel, or photonic switching components slows both civilian and military systems simultaneously, because at the physical layer, they are not separate systems.
This creates a consent problem that international law does not fully resolve. There is a reasonable argument under the laws of armed conflict that infrastructure used in support of military operations becomes a legitimate military target regardless of its civilian ownership. That argument does not address whether civilian customers of commercial cloud providers ever agreed – through terms of service, through procurement contracts, or through any other mechanism – to have their data co-located with classified military systems in an active conflict zone. They were not asked. They were not told.
The Submarine Cable Dimension
The March 1 strikes were not the only infrastructure exposure the conflict brought into focus. Seventeen submarine cables transit the Red Sea, collectively carrying the majority of data traffic between Europe, Asia, and Africa. The combination of Iran's closure of the Strait of Hormuz and renewed Houthi activity in the Red Sea placed both of these critical data routing corridors in active conflict zones at the same time – a scenario without historical precedent.
Doug Madory, director of internet analysis at network intelligence firm Kentik, characterized the potential consequences plainly: "Closing both choke points simultaneously would be a globally disruptive event. I'm not aware of that ever happening." Subsea cable attacks are not novel in isolation – Sweden investigated a cable severance between Latvia and Sweden in 2025, and Taiwan detained a vessel suspected of destroying cables near the Penghu islands – but the Gulf represents an unusual concentration of both data center infrastructure and subsea cable routing, and the conflict subjected both to simultaneous pressure for the first time.
The strategic response from Gulf states has been swift. Saudi Arabia, Qatar, and the UAE are reportedly financing alternative data corridors through Syria, Iraq, and East Africa to reduce dependence on the two constrained maritime choke points – an initiative that would accelerate a geographic rerouting of the global internet already underway for geopolitical reasons, at a cost and pace that the conflict has dramatically compressed.
The AI Inflection Point: Why Compute Became a Military Objective
From Economic Asset to Strategic Target
For most of the history of commercial cloud computing, disrupting a data center was, at its most severe, an act of economic sabotage. It could knock out banking services, disable logistics platforms, and create cascading failures across dependent software ecosystems. What it could not do, in any meaningful sense, was degrade the kinetic military capabilities of a nation-state adversary. The relationship between cloud infrastructure and military power was indirect – an institutional inconvenience rather than an operational threat.
Artificial intelligence has fundamentally altered that calculus. Modern military AI systems are not peripheral enhancements; they are increasingly embedded in core operational functions:
- Target identification and engagement sequencing, where AI models analyze sensor data to generate targeting recommendations
- Logistics and supply chain optimization, where real-time AI processing reduces the latency between operational need and material response
- Intelligence analysis and synthesis, where large-scale AI systems process signals intelligence and open-source data faster than human analysts alone can manage
- Battlefield simulation and adversarial wargaming, where AI-generated scenarios inform strategic planning and command-level decision-making
When AI systems perform these functions, the compute infrastructure sustaining them acquires the strategic significance of a command-and-control node. Under established doctrines of military targeting, attacking an adversary's command-and-control capability is a legitimate and high-priority objective. The data center running the targeting AI becomes, by that logic, a valid military target – even when it simultaneously processes civilian banking transactions in the same rack.
The Foreign Policy Research Institute framed the historical shift with directness: "Previously, power projection relied on fuel and steel. Currently, it relies on megawatts and computational throughput." The physical foundations of AI infrastructure – transformers, rare-earth elements, copper cabling, and fiber optics – are as essential to contemporary national security capability as shipyards and steel mills were to industrial-era military power. March 1 made that transition impossible to ignore.
The Physical Vulnerability of AI-Scale Infrastructure
Understanding why hyperscale data centers constitute such an asymmetrically attractive target requires an appreciation of their physical composition. A single 100-megawatt AI data center – a facility with a power draw equivalent to a mid-sized American city – imposes extraordinary material requirements:
| Physical Component | Required Quantity per 100 MW Facility |
|---|---|
| Copper (cabling and busbars) | Approximately 2,700 tons |
| Transformer-grade steel | 150 to 200 tons |
| Concrete and structural steel | More than 50,000 tons |
| High-voltage substation connections | Dedicated dedicated infrastructure |
| Active power draw | 100 MW continuous (city-scale equivalent) |
This physical scale creates both the strategic value and the strategic vulnerability of these facilities in one configuration. The capital concentration is enormous – U.S. companies increased spending on data center physical assets by 40 percent between 2022 and 2024, and are planning hundreds of billions in annual investment through the end of the decade, with the overwhelming majority earmarked for AI infrastructure. That same concentration of irreplaceable, slowly replaceable hardware makes these facilities high-value targets where a relatively low-cost attack can produce disproportionate damage.
A weaponized drone costing a few thousand dollars can cause hundreds of millions of dollars in structural damage and trigger billions of dollars in cascading economic disruption. The asymmetric calculus strongly favors the attacker, and adversaries have drawn the obvious conclusions.
From Perimeter Fences to Hardened Bunkers: The Security Transformation Required
A Security Philosophy Built for a Different Threat
Prior to March 2026, the security architecture of commercial data centers was designed around a threat model that combined sophisticated cyber defenses with conventional physical access control. On the cyber side, this included zero-trust network architecture, continuous intrusion detection, hardware supply chain audits, and increasingly, AI-assisted anomaly detection. On the physical side, the model relied on perimeter fencing, badge-controlled access points, biometric verification at critical zones, surveillance systems, and trained security personnel.
This architecture was designed to prevent unauthorized human access and to defend against remote network intrusions. It was not designed to survive a coordinated kinetic strike from a state actor operating drone swarms at stand-off distances. The philosophical gap between these two threat models is substantial, and closing it requires rethinking data center security from a fundamentally different starting premise.
The contrast between the existing security model and the one now required can be understood as follows:
| Security Dimension | Pre-2026 Standard | Post-March 2026 Requirement |
|---|---|---|
| Primary physical threat model | Unauthorized human access | Kinetic drone and missile attack |
| Cyber defense approach | Zero-trust architecture, intrusion detection | Unchanged, plus OT/IoT hardening |
| Redundancy design | Single-zone failure tolerance | Multi-zone coordinated attack tolerance |
| Power resilience | Grid-connected with UPS backup | Independent on-site generation capability |
| Structural specification | Commercial construction standards | Military-grade hardening for critical facilities |
| Geographic risk assessment | Uptime and connectivity focus | Geopolitical conflict zone analysis |
| Data replication | Cost-optimized regional placement | Security-driven multi-region distribution |
Patrick J. Murphy, executive director of the geopolitical unit at advisory firm Hilco Global, framed the implications with clarity: "Iran and proxies have targeted oil fields in the past, but their attacks this week on UAE data centers show they are now considered critical infrastructure." His projection – that governments will increasingly incorporate data centers into national security planning frameworks alongside energy facilities, telecommunications networks, water treatment plants, and transportation hubs – reflects not a speculative outcome but an observable policy trajectory already underway.
The Economics of Physical Hardening
The industry response that has emerged in the weeks following the March 1 strikes converges on a tiered architectural model: a small number of physically hardened, high-security facilities for the most sensitive and mission-critical workloads, supported by a broader distributed network of conventional edge data centers providing low-latency service delivery and baseline redundancy.
The economics of full bunkerization are instructive in explaining why this tiered approach is the realistic option rather than wholesale infrastructure hardening. According to Larry Hall of Survival Condo, a Kansas-based firm specializing in hardened real estate, constructing new data centers in underground, nuclear-hardened facilities currently costs in excess of $2,000 per square foot in the United States – roughly twice the cost of above-ground construction. Applied to a typical hyperscale data center, which spans the footprint of a Manhattan city block, a fully hardened underground equivalent would cost approximately $200 million before a single server, cooling unit, or power system is installed. At the scale of investment currently planned for U.S. AI infrastructure, full bunkerization of the estate is not a credible option.
The more operationally realistic response, as articulated by Murat Kantarcioglu, a data security specialist at Virginia Tech, centers on geographic redundancy as a non-negotiable baseline: maintaining copies of critical data in multiple geographically distributed regions, accepting the incremental transfer and storage cost as the price of resilience rather than an inefficiency to be optimized away. This was already considered best practice before March 1. After March 1, it has become a minimum standard that no organization with meaningful geopolitical exposure can responsibly defer.
The Counter-Drone Authorization Problem
Counter-drone defense systems capable of intercepting and neutralizing incoming UAVs exist and are operationally deployed by U.S. military forces. The challenge of extending these capabilities to commercial data center operators involves not only technical integration but a significant regulatory gap that current law does not bridge.
Counter-UAS capabilities that involve kinetic interception – the physical destruction of an incoming drone – require federal authorization that commercial facility operators do not currently possess. The regulatory framework governing the defense of private infrastructure against aerial attack in civilian airspace was drafted for a different operational environment and does not contemplate the scenario now facing data center operators in conflict-adjacent regions. Deploying such systems without authorization exposes operators to significant legal liability; deploying them without adequate authority creates risk of unauthorized use of force in civilian airspace.
This gap will need to close through legislation, executive action, or both. The question is not whether that closure will occur – the March 1 precedent makes some form of expanded commercial counter-UAS authorization increasingly likely – but how quickly the regulatory machinery will move, and how the cost of deployment will be allocated between commercial operators, insurers, and government authorities.
The Policy Reckoning: What the United States Has Not Acknowledged
The JWCC Decision and Its Consequences
The most structurally uncomfortable implication of the March 1 strikes is that the current U.S. defense cloud strategy was not simply exposed by the conflict – it materially contributed to the vulnerability it is now being forced to address. The decision to run classified military workloads on commercial infrastructure shared with civilian customers was a deliberate policy choice, one that offered genuine efficiency advantages and was supported by a considered procurement rationale. It was also a choice that transferred the target profile of U.S. military operations to commercial facilities, and by extension, to every civilian customer, SaaS provider, financial institution, and healthcare organization that operates on that same infrastructure.
The JWCC contract was presented, at its launch, as a model of efficient and modern defense procurement. The framing was not inaccurate. What it omitted was any serious public engagement with the question of what the co-location of classified military AI workloads with civilian enterprise data would mean for the physical security of the commercial facilities involved, for the risk exposure of non-consenting civilian customers, and for the strategic calculus of adversaries seeking to degrade U.S. military capability.
Under the laws of armed conflict, infrastructure that provides material support to military operations may be considered a legitimate military target, regardless of its civilian ownership or the presence of civilian data and customers. That legal framework existed before the JWCC contract was signed. The policy decision proceeded anyway.
The Anthropic Dispute as Diagnostic
The March 1 strikes did not occur in political isolation. They came within days of one of the most publicly visible confrontations between the AI industry and the U.S. defense establishment in recent memory – a confrontation that illuminates, with unusual clarity, the tensions that the militarization of commercial AI infrastructure has generated.
The sequence of events is instructive:
| Date | Event |
|---|---|
| July 2025 | Anthropic received a $200 million contract to run Claude on classified military networks via Palantir |
| February 2026 | Defense Secretary Hegseth demanded full, unrestricted access to Claude for any lawful military purpose, explicitly including lethal targeting and autonomous weapons applications |
| February 27, 2026 | Anthropic refused; the Pentagon designated Anthropic a "supply chain risk to national security" -- a classification normally reserved for foreign state actors -- and directed agencies to cease using Claude |
| March 1, 2026 | Iranian drone strikes targeted three AWS facilities in the Gulf |
| Days following | OpenAI executed a new agreement with the DoD -- a deal that OpenAI's own CEO characterized publicly as having "looked opportunistic and sloppy" |
The Anthropic case illustrates a tension that the broader industry has not resolved and cannot indefinitely defer: AI companies built their systems with explicit safety commitments and, in Anthropic's case, constitutional frameworks designed to prevent the systems from facilitating serious harm. The Defense Department sought to use those systems in operational contexts that the companies determined to be inconsistent with those commitments. The government's response – treating a safety-motivated refusal by a domestic AI company as a threat to national security – signals the terms on which the militarization of AI is being negotiated, and they are not favorable to the industry's self-conception as a safety-oriented enterprise.
Taken together, the data center strikes and the Anthropic designation reveal the pace at which the AI industry has been drawn into national security frameworks that none of its founders designed for, and the extent to which that integration has created physical, legal, and reputational exposure for companies and their customers that extends well beyond anything that existed eighteen months ago.
The Investment Reckoning: Repricing a $3 Trillion Buildout
Where Capital Flows After the First Strike
Morgan Stanley projects nearly $3 trillion in global data center capital expenditure through 2028, comprising approximately $1.6 trillion in hardware and $1.3 trillion in building infrastructure. That projection was developed against a baseline assumption that data centers, whatever their cyber risk profile, were physically secure commercial assets operating in environments governed by civilian law. March 1 has invalidated that assumption for any facility operating in or near geopolitically contested regions, and the investment implications are substantial.
The strategic shifts now accelerating across the industry reflect a fundamental repricing of physical risk:
- Geographic redistribution: Hyperscalers are accelerating diversification out of single-region concentrations in politically unstable areas, prioritizing resilience over the cost efficiencies that geographic consolidation typically provides.
- Multi-region redundancy: Enterprise customers are accepting higher data transfer and storage costs in exchange for workload replication across geographically distant regions, treating the incremental expense as a security investment rather than an operational inefficiency.
- Architectural segregation: Pressure is building – from customers, insurers, and regulators – to physically separate military and civilian cloud workloads into distinct facilities, eliminating the co-location that gave the Gulf strikes their target justification.
- Counter-drone and physical hardening investment: A nascent but growing market for autonomous drone intercept systems, reinforced structural specifications, and EMP-resistant infrastructure is emerging, oriented specifically toward the data center operator segment.
- Sovereign cloud acceleration: Governments that previously relied on hyperscaler commercial infrastructure for sensitive workloads are accelerating the development of domestically controlled, physically protected sovereign cloud facilities with explicit security classifications and military-standard hardening requirements.
The Domestic Buildout Faces Compounding Headwinds
The natural response to geopolitical risk in the Gulf – reshoring AI infrastructure investment to the United States – is complicated by a set of domestic pressures that were already generating significant friction before March 1 and have not eased since. In 2025 alone, at least 25 U.S. data center projects were canceled, representing a fourfold increase from the prior year, with 16 major projects worth a combined $64 billion either blocked or significantly delayed. The primary drivers were community opposition to power grid strain and water consumption impacts, combined with permitting constraints that have slowed project timelines across multiple states.
The intersection of these two forces -- elevated geopolitical risk in contested overseas regions and compounding community and regulatory resistance to domestic construction -- will define the geography of the next generation of AI infrastructure in ways that neither the industry nor policymakers have fully confronted. Building in the Gulf is now demonstrably dangerous. Building in the United States is increasingly expensive and contested. The viable location set for new AI infrastructure is narrowing, and the capital cost of developing within that set is rising.
Structural Implications: The Industry Must Decide What It Built
The companies that constructed modern cloud infrastructure – Amazon, Microsoft, Google, and Oracle – created platforms of a scale, efficiency, and reliability that no single institution, government, or private enterprise could have produced independently. They made that infrastructure available to militaries, governments, financial institutions, hospitals, and consumers at price points and service levels that compressed the cost of computing for the entire global economy. That achievement is real and its benefits are broadly distributed.
The problem is that the same structural properties that generate this value – massive physical centralization, global geographic reach, deep integration with government and military operations – are precisely the properties that constitute a compelling target profile for any state actor seeking to degrade the operational capability of an adversary whose military increasingly runs on commercial AI infrastructure. As Sam Winter-Levy, a fellow at the Carnegie Endowment for International Peace, observed: "Physical attacks are only going to become more common moving forward as AI becomes more and more significant. As more and more parts of the economy rely on these data centers, they correspondingly become increasingly attractive targets."
The options available to address this vulnerability each carry substantial costs and limitations:
| Response Option | Potential Benefit | Primary Limitation |
|---|---|---|
| Physical segregation of military and civilian workloads | Removes co-location target justification | Requires rebuilding Pentagon cloud architecture at enormous cost |
| Geographic diversification away from conflict regions | Reduces exposure in highest-risk zones | Cannot eliminate target profile where U.S. military presence creates it |
| Full physical hardening of critical facilities | Substantially improves survivability | Economically impractical at hyperscale; doubles construction cost per square foot |
| Geographic data redundancy across distant regions | Resilient to single-region destruction | Does not address the kinetic targeting problem, only its consequences |
| Counter-drone and active defense systems | Directly addresses drone attack vector | Regulatory authorization gaps in civilian airspace; significant deployment cost |
| Sovereign cloud separation | Clarifies target profile and legal status | Requires substantial new government infrastructure investment |
None of these options, individually or in combination, constitutes a complete resolution. What March 1, 2026 foreclosed is the option to defer the conversation indefinitely. The industry has built infrastructure that is simultaneously indispensable to the global economy and integral to the military operations of the world's most powerful nation-state. It must now determine what obligations that dual function creates – in terms of disclosure, in terms of physical security, in terms of legal liability, and in terms of the allocation of costs among operators, customers, governments, and insurers.
These are not engineering questions. They are policy questions, legal questions, and ultimately political ones – and the March 1 strikes have removed the luxury of treating them as someone else's problem.
The servers that power artificial intelligence are the new oil fields. The world just learned what happens when someone decides to bomb them.
Frequently Asked Questions
What happened to the AWS data centers in the UAE and Bahrain in March 2026?
On March 1, 2026, Iranian drone strikes damaged three Amazon Web Services facilities – two in the UAE and one in Bahrain. The attacks produced structural damage, disrupted power delivery, and triggered fire suppression systems that generated additional water damage to server hardware. Two of the three availability zones in AWS's UAE ME-CENTRAL-1 region were taken offline, along with one zone in Bahrain. Services including Careem, Emirates NBD, First Abu Dhabi Bank, and Snowflake all reported outages. Uptime Institute subsequently confirmed the events as the first verified military attack on a hyperscale cloud provider in recorded history.
Why did Iran target commercial data centers rather than conventional military assets?
Iran's IRGC stated that the Bahrain facility was specifically selected because AWS hosts U.S. military workloads, including AI systems reportedly used for intelligence assessments and battle simulations during the preceding U.S.-Israel strikes on Iran. The targeting logic reflects the dual-use reality of the Pentagon's JWCC contract architecture, which runs classified military AI and command systems on the same commercial cloud infrastructure that concurrently serves civilian customers – meaning the facilities carry a military target profile irrespective of their civilian ownership or the presence of non-military data and services.
What is the Pentagon's Joint Warfighting Cloud Capability (JWCC), and what does it mean for civilian cloud users?
JWCC is the U.S. Department of Defense's enterprise cloud acquisition vehicle, awarded in December 2022 to AWS, Microsoft, Google, and Oracle with a contract ceiling of $9 billion, under which more than $3 billion in task orders have been awarded to date. The contract provides DoD with access to commercial cloud services across all security classification levels, from unclassified through Top Secret/SCI. For civilian cloud customers, the relevant implication is that the commercial infrastructure on which their data and services reside may simultaneously host classified military workloads – and that this co-location arrangement has not typically been disclosed in standard service agreements.
Are U.S.-based data centers at risk of similar physical attacks?
Physical kinetic attacks on data center infrastructure within the continental United States would represent a substantially escalated act of aggression, though the threat landscape for domestic facilities is nonetheless significant and multidimensional. The Institute for AI Policy and Strategy has identified AI data centers as high-priority targets for adversaries – particularly China and Russia – seeking to steal model weights representing hundreds of millions of dollars in training investment, introduce hardware backdoors through supply chain compromise, or sabotage AI systems underlying military and critical infrastructure operations. Domestic facilities face less acute kinetic risk but more sophisticated and persistent cyber and supply chain threats than their overseas counterparts.
What does physically hardening a data center actually cost, and is it feasible at scale?
Underground, nuclear-hardened data center construction currently costs in excess of $2,000 per square foot in the United States, approximately twice the cost of standard above-ground construction. A fully hardened underground facility at the scale of a typical hyperscale data center – which spans roughly the footprint of a Manhattan city block – would cost approximately $200 million before any hardware, cooling, or power systems are installed. Full bunkerization of the existing or planned data center estate is not economically viable at scale. The more realistic near-term standard involves mandatory geographic redundancy across multiple distant regions, physical perimeter hardening of existing above-ground facilities, and selective application of advanced counter-drone and active defense systems to the highest-priority sites.
What is the Anthropic-Pentagon dispute, and what does it reveal about the militarization of commercial AI?
In July 2025, Anthropic received a $200 million contract to operate Claude on classified military networks through a Palantir integration. By February 2026, Defense Secretary Hegseth had escalated to demanding full, unrestricted access to Claude for any lawful military purpose, including lethal targeting assistance and autonomous weapons applications. Anthropic declined to provide that access, citing its existing safety commitments. The Pentagon responded by designating Anthropic a "supply chain risk to national security" – a classification historically reserved for foreign state actors – and directing federal agencies to cease use of Claude. The episode illustrates the structural tension between AI companies' constitutional safety frameworks and the military's demand for unrestricted operational capability, and it demonstrates the legal and reputational exposure that safety-oriented AI companies face when operating in national security contexts.
How should enterprise organizations revise their cloud strategy in response to the March 2026 strikes?
Enterprises with meaningful geopolitical exposure should treat the March 1 events as a forcing function for cloud architecture decisions that have been deferred in favor of cost optimization. The most urgent revisions include mandatory multi-region data replication as a baseline security standard rather than an optional resilience upgrade; separation of the most sensitive workloads into geographically distant regions outside active or potential conflict zones; due diligence on the military relationships and co-location arrangements of cloud providers in contested regions; and engagement with legal and compliance teams on the implications of data residency in facilities that may host classified military workloads without customer disclosure.
What are the implications for the $3 trillion global data center buildout projected through 2028?
Morgan Stanley's projection of nearly $3 trillion in global data center capital expenditure through 2028 was calibrated against a risk model in which physical attack on commercial cloud facilities was hypothetical rather than demonstrated. The March 1 strikes force a repricing of that risk for facilities in geopolitically contested regions, with direct implications for site selection decisions, structural specifications, insurance underwriting, and the cost of capital for projects in affected markets. Domestically, the buildout faces simultaneous headwinds from community opposition to power grid and water consumption impacts – which contributed to the cancellation or delay of at least 25 U.S. projects representing a combined $64 billion in 2025 alone. The compression of viable location options, combined with the increased cost of security-compliant construction, will substantially affect both the pace and the economics of AI infrastructure development over the coming decade.
Related Articles




