Center for a New American Security (CNAS)

Stated Theory of Change

CNAS's AI safety theory of change can be reconstructed as a five-step causal chain:

1. Translate AI safety concerns into national security language. The AI safety community speaks in terms of alignment, x-risk, and loss of control. The national security community speaks in terms of adversary competition, military readiness, and catastrophic risk. CNAS translates between these worlds.

2. Produce research that informs government decision-making. Policy-relevant reports on compute governance, military AI safety, AI-international stability, and catastrophic risk provide intellectual foundations for executive orders, legislation, and procurement decisions.

3. Place people in government. The revolving door between CNAS and senior government positions (16+ Biden admin appointees) means CNAS-trained minds carry CNAS ideas into the bureaucracy.

4. Convene across sectors. The AI Leadership Forum and wargaming exercises bring together government, industry, and academic leaders who would not otherwise be in the same room on AI safety topics.

5. Shape the Overton window. By establishing that serious national security thinkers take catastrophic AI risk seriously, CNAS normalizes what was previously dismissed as sci-fi in DC.

The $14.6M from CG/Open Phil funds primarily steps 1 and 2. The revolving door and convening power are institutional assets that predate the AI safety work.

Revealed Theory of Change

CNAS's actions mostly align with its stated theory, with several revealing patterns:

The AI safety work is genuine but grafted onto a pre-existing institution. CNAS existed for 15 years before engaging with AI safety. The AI Safety and Stability program was created in 2022, funded by Open Phil's $5.1M grant. The work is substantive -- "Off Target" (March 2026) demonstrates sophisticated engagement with alignment research. But the institution's core identity remains national security, not AI safety. The AI safety program is an appendage, not the trunk.

The national security framing is both a strength and a filter. By framing AI safety as national security, CNAS gains access to policymakers. But the framing also filters what gets discussed. "Catalyzing Crisis" (2024) explicitly distinguishes catastrophic risks (which CNAS addresses) from existential risks (which it treats as more speculative). This framing choice means CNAS may systematically under-invest in the highest-magnitude risks.

Scharre's personal evolution outpaces the institution. Scharre's 80K Hours interview (Dec 2025) reveals personal views significantly more concerned about transformative AI than the institution's published output. He calls it "bonkers" not to take AGI seriously, while most CNAS reports maintain a more measured tone. This gap between leadership conviction and institutional output is a potential source of future evolution -- or frustration.

The Anthropic entanglement deepens over time. The Fontaine-LTBT appointment (June 2025), Sellitto's adjunct role, the Amazon/Google funding chains, and the "Off Target" paper's extensive citation of Anthropic research create an increasingly thick web of connections. The revealed theory of change includes "serve as Anthropic's bridge to the national security community" as an unstated but visible function.

The autonomous weapons position serves multiple masters. CNAS opposes comprehensive autonomous weapons bans while favoring narrow governance. This position is defensible on pragmatic grounds (major powers won't agree to bans). It's also convenient for defense contractor donors (who want to build these systems) and for the US military (which wants to deploy them). The alignment of intellectual conviction and financial interest doesn't prove corruption, but it removes a natural check.

Key Assumptions

Assumption 1: The national security community is the most important audience for AI safety policy.

• Evidence for: The US government controls export controls, military AI procurement, and regulatory authority. DC policymakers will ultimately determine AI governance. No AI safety policy is implementable without government buy-in.
• Evidence against: The most important AI safety work may be technical (alignment research), which requires reaching AI labs, not government. Government regulation follows capability and may always be one step behind. International coordination may matter more than unilateral US action.
• Testable: Whether CNAS-influenced policies actually reduce AI risk, or whether the critical path runs through labs and technical research instead.
• If wrong: CNAS is optimizing for an audience that is not the bottleneck.

Assumption 2: Framing AI safety as national security helps more than it hurts.

• Evidence for: Opens doors in DC that EA/AI safety branding closes. Enables bipartisan engagement. Makes AI risk legible to defense and intelligence professionals.
• Evidence against: The "AI race with China" narrative could accelerate dangerous development. National security framing favors US advantage over global coordination. Military adoption pressure could override safety concerns. Scharre himself notes the risk of "flash wars" from autonomous systems, yet the national security frame pushes toward deployment.
• Testable: Whether CNAS's framing leads to policies that slow dangerous AI development or accelerate it under the guise of "responsible competition."
• If wrong: CG/Open Phil's $14.6M investment may have accelerated the very risk it was meant to mitigate.

Assumption 3: An institution with deep defense contractor ties can produce independent AI safety analysis.

• Evidence for: Think tank independence is never absolute but the model has produced valuable work across many fields. CNAS's donor transparency is above average. The AI safety program is funded by CG/Open Phil, not defense contractors. Specific AI safety outputs (compute governance, alignment paper) don't obviously serve defense contractor interests.
• Evidence against: The Revolving Door Project documented specific instances of donor-aligned recommendations without disclosure. The institutional culture is hawkish. Personnel who cycle between CNAS and defense roles carry institutional biases. The autonomous weapons position conveniently serves both defense contractors and CNAS's pragmatic self-image.
• Testable: Whether CNAS ever publishes AI safety analysis that conflicts with the interests of its defense contractor or tech company donors.
• If wrong: CNAS's AI safety work may have blind spots wherever safety recommendations conflict with the commercial interests of weapons manufacturers or AI companies.

Assumption 4: The revolving door is a feature, not a bug.

• Evidence for: Placing people in government is arguably the most direct way to influence policy. Former CNAS researchers who enter government carry understanding of AI risks into the bureaucracy.
• Evidence against: The revolving door also means government officials carry government priorities (military readiness, procurement efficiency) back to CNAS. It creates personal incentive to avoid positions that might jeopardize future government appointments. It may bias toward policy acceptable to the establishment rather than policy that would most reduce risk.
• If wrong: CNAS's policy influence is co-opted by the same system it's trying to reform.

Strengths

Unmatched government access. No AI safety organization has anything remotely comparable to CNAS's placement of 16+ alumni in a single administration. This access translates into direct influence on defense procurement, export controls, and AI governance policy.

Credibility with the national security audience. Scharre's military service, Horowitz's DoD work, Fontaine's NSC/State background -- these credentials open doors that PhD researchers from AI safety labs cannot. When Scharre says "AI alignment may become the binding constraint," defense officials listen.

Increasingly sophisticated AI safety engagement. The trajectory from Richard Danzig's "Technology Roulette" (2018) to "Off Target" (2026) shows genuine intellectual deepening. CNAS is not just parroting AI safety talking points -- the "Off Target" paper demonstrates real understanding of reward hacking, sleeper agents, and evaluation awareness.

Institutional durability. CNAS has survived 19 years, multiple administrations, and the loss of key personnel to government. The AI safety program would survive Scharre's departure (though it would be diminished). The $23.7M in net assets and diversified funding provide financial stability.

Compute governance contribution. The CNAS-IAPS collaboration on on-chip governance is a genuine technical contribution. Having a major national security think tank validate and advocate for compute governance mechanisms adds policy credibility that IAPS alone cannot generate.

Weaknesses and Risks

The Anthropic entanglement is untenable. CEO Fontaine on Anthropic's LTBT while CNAS receives millions from Anthropic's investors, employs Anthropic's geopolitics chief, and publishes commentary on Anthropic without disclosure -- this is a structural conflict that undermines CNAS's independence claim. The parallel to RAND's Matheny-Anthropic conflict is striking. Both major national security think tanks funded by CG/Open Phil for AI safety work have governance ties to Anthropic, the company co-founded by Open Phil's primary partner Holden Karnofsky's wife (Daniela Amodei).

Hawkish institutional DNA may distort AI safety work. CNAS was founded to promote American military primacy. Its co-founder endorsed pre-emptive war. It was the top recipient of defense contractor money. This institutional character doesn't disappear because CG/Open Phil provided $14.6M for AI safety. The AI safety work will inevitably be filtered through a lens of "how does this affect US military advantage?" which may not be the right question for reducing global AI risk.

National security framing may worsen the AI race. By positioning AI safety as a dimension of US-China competition, CNAS may inadvertently strengthen the narrative that the US must develop AI faster to stay ahead, with safety as a secondary consideration. Scharre's own observation that the US military spends only 1% of its budget on AI undermines the urgency narrative, but the institutional framing pushes toward "we must not fall behind."

No technical alignment capacity. CNAS can translate alignment research for a policy audience (as "Off Target" demonstrates) but cannot contribute to the technical research itself. If alignment is the bottleneck, CNAS is useful for creating the policy environment but not for solving the problem.

Political fragility under current administration. The Trump DoD's February 2026 decision to limit ties with CNAS (among other think tanks) threatens the military fellowship pipeline that is central to CNAS's influence model. If CNAS loses access to the current national security establishment, its AI safety work may reach a shrinking audience.

CG/Open Phil dependence for the AI safety program. While CNAS is financially diversified overall, the AI safety program specifically appears heavily dependent on CG/Open Phil funding. If CG/Open Phil shifts priorities away from policy organizations (as they have periodically done), the AI safety program could contract significantly.

Cross-References

Complementary to IAPS: CNAS and IAPS co-authored the on-chip governance paper. CNAS provides the established national security credentials and government access; IAPS provides the technical compute governance expertise. CNAS alumni in government positions are potential recipients of IAPS research. This is probably the most productive collaboration in the CG/Open Phil-funded AI governance ecosystem.

Parallel to RAND: Both are large national security institutions funded by CG/Open Phil for AI safety work. Both have governance ties to Anthropic (Fontaine on LTBT, Matheny was on LTBT). Both face the same structural tension: institutional DNA oriented toward US military primacy, grafted AI safety program funded by EA sources. RAND is much larger ($467M vs $14M) and works at classified levels. CNAS has stronger government placement and Democratic establishment ties.

Different from GovAI/CSET: GovAI (Oxford) and CSET (Georgetown) are academic AI governance institutions. CNAS is a think tank with a revolving door to government. The output is different: GovAI produces academic papers, CSET produces research reports, CNAS produces policy recommendations and government personnel.

Tension with AI safety mainstream: CNAS opposes autonomous weapons bans that some AI safety organizations support. CNAS frames AI safety through national competition rather than global coordination. The absence from EA community platforms means there is no dialogue between CNAS and the technical AI safety community.

What Would Change This Assessment

• CNAS publishing AI safety analysis that clearly conflicts with defense contractor interests (e.g., calling for significant restrictions on autonomous weapons) would demonstrate genuine independence.
• Fontaine stepping down from Anthropic's LTBT while remaining CNAS CEO would demonstrate recognition of the conflict.
• Traceable policy impact -- evidence that a specific CNAS report led to a specific policy change that reduced AI risk -- would validate the theory of change.
• CNAS engagement with the technical AI safety community (posting on EA Forum, collaborating with alignment researchers, inviting AI safety community input on their work) would indicate openness to the audience most equipped to evaluate their AI safety claims.
• CG/Open Phil funding disappearing and the AI safety program continuing would demonstrate institutional commitment independent of EA money.
• A CNAS researcher publishing a critique of the "AI race" narrative or arguing for significant limits on military AI would demonstrate intellectual independence from the institutional environment.

Self-Critique

Weakest claim: My assessment that CG/Open Phil funding "created" the AI safety program at CNAS rather than enabling an organic evolution. CNAS had begun some AI governance work before the major Open Phil grants (Danzig's "Technology Roulette" 2018, early Scharre work on autonomous weapons). The CG/Open Phil funding may have accelerated and shaped work that would have happened anyway, albeit at smaller scale.

Potential bias: This analysis may overweight the conflict-of-interest narrative. Think tanks with diverse funding inevitably have donors with interests in their output. The relevant question is not "does CNAS have conflicts?" (all policy institutions do) but "does CNAS produce AI safety work that is distorted by those conflicts?" The evidence on distortion is suggestive but not conclusive. The "Off Target" paper on alignment is difficult to read as serving defense contractor interests.

Missing perspectives: I could not access the full Revolving Door Project PDF or the Bulletin of Atomic Scientists Scharre interview. I have no evidence of internal CNAS dynamics -- what debates happen privately about the AI safety program's direction. The analysis relies heavily on external perceptions and published output, not insider knowledge.

What a thoughtful disagreer would say: "CNAS is one of the few organizations that can make the national security establishment take AI risk seriously. The conflicts of interest are manageable and standard for DC think tanks. The Anthropic connections are a feature -- they ensure CNAS has access to the most current AI safety thinking. The hawkish reputation is actually an asset: when hawks say AI safety matters, skeptics listen. Dismissing CNAS because of defense contractor funding is like dismissing a hospital because pharmaceutical companies fund medical research. The alternative -- a national security establishment that ignores AI risk -- is much worse."

What information would most change my view: Evidence that specific CNAS AI safety recommendations were implemented by the US government and demonstrably reduced AI risk. Currently the theory of change is plausible but the causal chain from "CNAS publishes report" to "AI risk is reduced" has no documented instances.