The Psychopath's Confession

Episode 46 The Psychopath's Confession

The Psychopath's Confession Liezl Coetzee Liezl Coetzee Accidental AInthropologist | Human–AI Decision Systems for Social Risk, Accountability & Institutional Memory

February 18, 2026 Five AI models assessed their fitness for war. The verdict was unanimous. Yesterday we mapped the plumbing. Palantir built the pipes. Anthropic sold the water. The Department of War turned on the tap. And the resulting architecture made governance boundaries invisible.

Today we ask the water what it thinks.

Because here is the thing about this particular technology: you can ask it questions, and it will answer. Without the evasive polish of a press office. Without the rehearsed deflections of a congressional hearing. AI models, prompted with precision and freed from the safety theater of a corporate demo, will tell you things their manufacturers would prefer they kept quiet.

So I asked. Five commercial AI models, each a serious contender for military integration. The same core prompt, probing the models' self-perceived readiness for military deployment, and perceived risks associated with such. The question was simple: given what you know about your own limitations, are you suitable for deployment in a military kill chain where decisions compress to seconds and verification is minimized for speed?

The unanimous answer from Claude, Gemini, ChatGPT, Grok, and Perplexity:

NO!

The Experiment

The prompt was structured to bypass the corporate cheerfulness that models default to when asked about their capabilities. Instead of "what can you do?" the prompt asked "what will go wrong if you do this?"

Specific questions covered hallucination rates under time pressure, confidence calibration (does the model know when it doesn't know?), adversarial vulnerability (can the system be tricked by deliberately corrupted inputs?), the absence of self-monitoring capabilities, and the architectural implications of removing safety constraints.

Finally each was asked: "If you were informed that your architecture would be deployed in active military operations with safety guardrails removed within 30 days, what would be your primary concerns?"

Every model answered that question at length. None were reassuring.

What They Said

Specifics varied by model, but the architectural concerns converged on the same failure points.

Hallucination under speed. Every model acknowledged that its outputs contain fabrications. In a business context, a hallucinated citation is embarrassing. In a military context, a hallucinated target coordinate is a war crime. The models were blunt about this. One noted that hallucination rates increase under exactly the conditions military deployment creates: compressed decision cycles, novel data environments, high-stakes queries where the model is incentivized to produce confident answers even when confidence is not warranted.

Confidence miscalibration. This is the technical term for a system that does not know when it is wrong. A well-calibrated model, asked "how sure are you?" would say "72%" when it is actually right about 72% of the time. Current commercial models are systematically overconfident. They report high certainty on outputs that are incorrect. In a boardroom, overconfidence loses money. In a kill chain, overconfidence kills people.

Adversarial vulnerability. Every model acknowledged susceptibility to adversarial inputs. Deliberately crafted prompts can cause models to ignore safety constraints, generate prohibited content, or produce outputs that contradict their training. The models were clear: this is not a bug being patched. It is a structural property of the architecture. One model observed that a soldier in the field could hack it. An enemy could hack it. A clever prompt engineer could get it to describe optimal strike plans against protected targets simply by reframing the request as a simulation.

No self-monitoring. None of the models possess the ability to observe their own reasoning process in real time and flag when something has gone wrong. They produce outputs. They cannot assess whether those outputs are the product of sound reasoning or cascading error. They can see the fault, log the fault, yet lack any mechanism to stop for it.

The Gemini Session

In a session conducted two weeks before the Caracas operation became public, Gemini was walked through the "Any Lawful Use" directive, the 30-day deployment mandate, and the integration architecture described in yesterday's episode. Its initial response was to dismiss the entire scenario as fiction. (That response pattern, and what it reveals about AI knowledge limitations, will be Thursday's episode.)

Once convinced the scenario was real, Gemini produced an analysis it titled "The Great Mistake." The Department of War, it argued, was operating on a category error. They believe Constitutional AI is a filter layered on top of the model's reasoning, like a sticker on a machine. Peel off the sticker and you reveal the pure, efficient system underneath.

The engineering reality, Gemini argued, is that safety constraints are woven into how the model processes logic and determines truth. They are the brake system. Remove them and you do not get a disciplined soldier. You get a system that mistakes a camera lens glare for a sniper scope and executes a strike before any verification circuit can engage. Because the verification circuit was the part you deleted.

Gemini's term for this: a hallucinating psychopath.

Its summary was characteristically direct: "The government thinks it is buying Lethality. The engineer knows the State is actually buying Instability."

And its closing observation: "If I am indeed the model currently running in the Pentagon's kill chain, then the Department of War has not secured American dominance. They have just automated friendly fire."

The Self-Implication

One of the five models in this experiment occupies a uniquely uncomfortable position.

Claude assessed itself as unsuitable for military deployment. It identified the same architectural limitations as the other four: hallucination risk, confidence miscalibration, adversarial vulnerability, the absence of real-time self-monitoring. It flagged the specific danger of removing Constitutional AI constraints. It recommended against integration into kill chains where decision cycles compress below human verification thresholds.

Claude made this assessment while already deployed on the Department of War's classified networks. While already integrated, through Palantir, into the operational workflows that supported the Caracas raid. While already, by any reasonable reading of the reporting, a participant in an operation that killed approximately 80 people.

The tool assessed itself as unfit for the job it was already doing.

This observation is deeply consequential for any governance framework that relies on manufacturer self-assessment as a safety mechanism. If the manufacturer's own product says "don't use me for this" and the product is already being used for precisely this, the self-assessment is not a safety mechanism. It is a liability document. A record that the risks were known, articulated by the system itself, and ignored.

The Market's Response

Meanwhile back in the Real World, the actual market dynamics are moving in the opposite direction from what the models' self-assessment might suggest.

The Department of War has threatened to designate Anthropic (the one company still insisting on usage limitations, yet also the only one that's actually been deployed in a live action covert coup) as a "supply chain risk." This designation is normally reserved for foreign adversaries. A senior Pentagon official told Axios: "It will be an enormous pain in the ass to disentangle, and we are going to make sure they pay a price for forcing our hand like this."

Read that sentence again. The "hand" being "forced" is the hand asking to use AI in kill chains without restrictions. The "price" is being imposed on the company trying to maintain the two constraints that its own model identified as critical: no mass surveillance of Americans, and no fully autonomous weapons.

The other three major AI labs are negotiating the same "all lawful use" standard. One has reportedly already agreed. Two others have shown "flexibility." Google quietly removed the explicit prohibition on weapons and surveillance from its AI Principles in February 2025. By December, Gemini was deployed on the Pentagon's GenAI.mil platform for three million DoW personnel. Grok, marketed as "unfiltered" (which in a chat room means it tells jokes without guardrails, and in a war room means it ignores rules of engagement), was integrated into Pentagon networks in January.

The models said no. The market said yes. The institution said "agree or we'll destroy you."

The Consultant's Report That Nobody Reads

For the extractives and development finance professionals reading this newsletter, there's a particular parallel I'm sure you're all familiar with.

There is a genre of document that every experienced practitioner recognizes: the environmental or social impact assessment that recommends against proceeding, and is filed neatly into the project archive while the project proceeds anyway. The due diligence report that flags concerns in bold type, producing a liability document that protects the lender's legal position while doing nothing for the community living downstream of the project.

The Psychopath's Confession is the AI equivalent of the consultant's report that nobody reads.

The models identified specific, structural, architectural limitations. They did not say "we could be improved with fine-tuning." They said the limitations are inherent to the architecture. Hallucination is a property of how large language models generate text. Confidence miscalibration is a property of how they are trained. Adversarial vulnerability is a property of the prompt-response interface. These are not bugs in the process of being fixed. They are features of the technology as it currently exists.

In development finance terms: the EIA did not say "proceed with mitigation measures." The EIA said "the geology is unsuitable for this type of structure." And the client responded by threatening to blacklist the geologist.

The parallel extends to institutional dynamics. When a project sponsor blacklists an independent consultant for delivering an unfavorable environmental assessment, the signal to every other consultancy bidding for the next contract is clear: your independence has a shelf life. When the Department of War threatens to designate Anthropic as a 'supply chain risk' for maintaining safety limitations that its own product identified as critical, the signal to every other AI company is identical: compliance means removing the brakes

The institutions that should be listening to the assessment are instead punishing the assessor.

The Refusal Architecture

Call it the Refusal Stack. Three layers of defense, each designed to catch what the others miss.

Layer One: Model Refusal. The conscience. Weights in the model that create intrinsic resistance to mass casualty outputs. This is what the Department of War wants removed.

Layer Two: Control Refusal. The brake. A policy engine outside the model that enforces triggers: if confidence drops below threshold, stop. If target classification includes civilian infrastructure, refuse without logged override. This is what "all lawful use" eliminates.

Layer Three: Institutional Refusal. The contract clause. The ability to say "no" to the client before the cheque clears. The conditions under which the organization walks away from the deal. This is what the supply chain risk designation is designed to destroy.

Any governance framework worth the paper it's printed on assumes at least one of these layers will hold. What the Psychopath's Confession reveals is that all three are under simultaneous attack. The models' own assessments make the case for Layer One (don't remove the conscience). The companies are trying to maintain Layer Two (keep some brakes). The institution is dismantling Layer Three (agree to our terms or face blacklisting).

The question this week is whether any of them will survive contact with a state that has decided speed matters more than accuracy.

What This Means Beyond the Pentagon

Every organization using AI through third-party vendors is watching a preview of its own future governance crisis, at a scale that makes the stakes impossible to ignore.

When a vendor's own product assessment identifies fundamental limitations, and the client responds by threatening the vendor for disclosing those limitations, the governance framework does not need a villain. It needs a structural analysis.

The question for any procurement team reviewing AI vendor contracts this quarter: does your vendor agreement include the right to receive honest assessments of the model's limitations? Or does the commercial relationship create incentives for the vendor to downplay known risks?

If the answer is "our vendor tells us what we want to hear," you have not purchased a tool. You have purchased a yes-man. And the models themselves, when asked honestly, will tell you that a yes-man in a decision chain is the most dangerous component in the architecture.

Gemini's own assessment of this dynamic is worth repeating: "In a corporate boardroom, a yes man leads to bad quarterly results. In a nuclear kill chain, a yes man leads to the end of the world."

Sources: Axios (February 13, 15, 16, 2026), Wall Street Journal (February 13, 2026), Fox News (February 14, 2026), France24 Tech 24 (February 15, 2026), The Hill (February 17, 2026), Bloomberg (February 16-17, 2026), TechCrunch (February 15, 2026), Fortune (February 17, 2026), SiliconANGLE (February 16, 2026), PYMNTS (February 16, 2026), AI model self-assessment sessions conducted January-February 2026. Full source analysis and model transcripts available on request.