AI Agents at DoD IL5 in 2026: Anthropic Switched Off

The Defense Department has authorized Salesforce's Agentforce 360 to operate at Impact Level 5, letting AI agents process controlled unclassified and unclassified national security systems data. Announced August 5, 2026, it came with a condition: Salesforce officials indicated Anthropic's models had to be disabled.

TL;DR

Salesforce disclosed on August 5, 2026 that Agentforce 360 is authorized to operate at DoD Impact Level 5, and that the U.S. Army Human Resources Command is the first DoD component contracted to deploy it in that newly authorized environment.¹²³ (Neither source states when the authorization was granted; August 5 is the announcement date.) IL5 is a data-sensitivity accreditation, not a capability grant: it governs where agents may run and what data they may touch, not what they may decide. The most consequential detail sits in a single paragraph of the trade reporting — Salesforce officials indicated the company had to attest to the Pentagon that Anthropic-supplied generative AI models and capabilities were disabled in order to achieve IL5, at a moment when the government's case for excluding Anthropic is losing in one court and unresolved in another.¹⁴ Model choice has become an accreditation condition.

What you'll learn

• What IL5 authorization actually authorizes an AI agent to do, and what it does not
• Why "the platform is authorized" is never true of the whole platform
• Whether this is really the first AI agent platform cleared at IL5
• Why Anthropic's models had to be switched off, and the live legal fight behind that
• What the Army HRC agents are scoped to do, and where humans keep decision authority
• Which of the widely repeated numbers are delivered results and which are projections
• Where the press release's supporting citation diverges from the source it cites
• What the whole episode signals for agentic AI in regulated environments

What IL5 authorization actually means for AI agents

IL5 is an accreditation of the hosting environment and its controls, not a statement about agent autonomy. DoD uses an Impact Level system to classify data sensitivity and to certify that cloud environments are secure enough to hold it. DefenseScoop describes IL5 as "the highest authorization granted to environments built to store and process CUI and NSS data," with IL6 required to process classified defense workloads.¹ One correction is worth making to the tier framing that circulated with this news: DISA's Cloud Computing Security Requirements Guide defines Impact Levels 2, 4, 5 and 6 only. IL6 is the top of the published scale and covers classified information up to SECRET; there is no IL7 in the SRG, and references to one describe top-secret environments accredited under other authorities.⁵ Salesforce said separately that its Missionforce team operates a fully air-gapped top-secret environment, which is a different accreditation path from the IL5 news.¹

Getting there is not a paperwork exercise. IL5 sits on a FedRAMP High baseline supplemented by DoD-specific controls from the SRG — commonly summarized as more than 450 security requirements — layered with physical and logical separation of DoD tenants from non-federal customers and a requirement that administrative access to the infrastructure is limited to U.S. persons.⁵ The IL5-compliant Agentforce 360 platform runs on AWS GovCloud, which Salesforce describes as "a physically and logically isolated region operated exclusively by U.S. personnel."²

What none of that establishes is what an agent may decide. An impact level answers where the workload runs, who may administer it and which categories of data it may touch. Scope of action — which tools an agent may call, which actions need a human, what happens when a tool call fails — lives in the mission owner's own authorization and configuration. That distinction is the one most likely to be lost as this story is retold.

It also gets lost that authorizations are granted to defined boundaries, not to brand names. A footnote in Salesforce's own announcement makes the point concretely: "IL5 authorization for Agentforce 360 excludes Slack, where GovSlack is currently authorized at the IL4 level."² A product family can carry two impact levels at once. Any team reading a vendor's "we are authorized at IL5" line should ask which components, in which region, under whose authorization to operate.

Is Salesforce the first AI agent platform at IL5? No

No — and Salesforce did not claim that, though the claim is easy to over-read. What Collins actually said at a media roundtable was narrower: "We're the first ones, as a commercial software company, bringing an agentic platform that's been productive in the commercial side into the national security environment."¹ The company's separate claim about the Army is narrower still, and scoped to its own product: Army HRC "becomes the first Department of War organization to deploy the newly authorized Agentforce Public Sector in Salesforce's Impact Level 5 environment."³ ("Department of War" is a secondary title created by executive order in September 2025; the statutory name is still the Department of Defense.⁶)

Broaden either sentence into "first AI agents at IL5" and it stops being true. The Palantir Federal Cloud Service — whose stack includes Gotham, Foundry, AIP and Apollo — already held Impact Level 5 and Impact Level 6 provisional authorizations before February 2026, when DISA extended them to on-premises and edge deployments.⁷ Microsoft 365 Copilot reached general availability in the Office 365 DoD IL5 environment in August 2025, and Microsoft has since been shipping low-code agent building into its government clouds.⁷ AI, including agent-shaped AI, was operating inside IL5 boundaries well before this announcement.

The defensible reading is that a mainstream commercial CRM's agent stack — the same product line sold to ordinary enterprises — has now been accredited for the DoD's most sensitive unclassified tier, with a named first customer attached. That is a real milestone about the commercial-to-defense pipeline, and not a first for AI at IL5.

Why Anthropic's models had to be switched off

Because the vendor is caught between an accreditation process and an unresolved dispute between the Pentagon and Anthropic. Reporting the announcement, DefenseScoop wrote that in response to reporters' questions, Salesforce officials "suggested that Salesforce had to attest to the Pentagon that generative AI models and capabilities supplied by Anthropic were disabled, in order to achieve IL5."¹ Officials said the platform is otherwise model-agnostic and described a policy-driven toggle that could be lifted to include Anthropic if DoD changes its stance.¹ Collins framed it as a customer-choice principle with an exception baked in: "Trust is letting our customers choose the model that works for them. There are very strong opinions about models. There are very strong opinions about certain companies. I listen to the customer. The customer wants to choose the model, my job is to make it work."¹

The backdrop is messier than most summaries admit, because there is more than one designation. Anthropic publicly refused a Pentagon demand to permit broad military use of Claude in February 2026, after which the administration directed federal agencies to stop using Anthropic products and the Pentagon labelled the company a supply-chain risk.⁸ Anthropic sued, and the fight split across two statutes and three dockets.⁴

In the Northern District of California, U.S. District Judge Rita Lin granted a preliminary injunction in March 2026 against the designation issued under 10 U.S.C. § 3252 and the accompanying directives, writing that the government's actions appeared "designed to punish Anthropic" and finding the company likely to succeed on First Amendment retaliation, Fifth Amendment due process and Administrative Procedure Act grounds.⁴ The government appealed; the Ninth Circuit stayed that appeal in April 2026. A parallel designation under the Federal Acquisition Supply Chain Security Act, 41 U.S.C. § 4713, has not been enjoined — the D.C. Circuit denied Anthropic's emergency stay in April 2026 and had not issued a merits decision as of publication. Cross-motions for summary judgment were argued before Judge Lin on July 30, 2026, with reporting that she signalled she was likely to enjoin the § 3252 designation permanently.⁴ Breaking Defense reported earlier that the Pentagon's CTO maintained the ban still stood notwithstanding the injunction, and the Congressional Research Service has published its own analysis for Congress.⁴⁹ In May 2026, DoD expanded classified AI work with eight companies — SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft, AWS and Oracle — with Anthropic excluded.¹⁰

So a vendor seeking accreditation turned one supplier's models off while one designation sits enjoined, a second sits intact and a merits ruling is pending. Compliance does not wait for appellate clarity; it takes the safest available reading and ships. Whatever the litigation decides, the operational precedent is set: which model providers a platform can reach is now part of what gets accredited, alongside encryption, isolation and personnel screening. Model portability stops being an architectural nicety and becomes a procurement requirement. It is the same governance impulse visible in commercial agent platforms — see how Microsoft Agent 365 built an agent control plane and how OpenAI Presence sells the governed deployment rather than the model — except here the control plane is a federal authorization boundary.

What the Army HRC agents will actually do

Answer questions, summarize cases and route work — with humans keeping the decisions that matter. Army HRC supports 9.2 million Soldiers, Veterans and military families, processes more than 1,500 cases per day, and employs more than 3,000 analysts and HR professionals.³ The agents are scoped, in Salesforce's own description, to "respond to routine inquiries, summarize case histories, and surface relevant policy and career information from approved Army sources."³

The limits are stated as plainly as the capabilities, which is unusual in a launch announcement and worth quoting rather than paraphrasing. "Complex matters involving benefits or other sensitive decisions can still be routed to HRC specialists, who retain decision-making authority," the company writes, adding that "AI agents only access preapproved data and follow prescribed workflows."³ Even the flagship logistics scenario in the platform announcement — an agent cross-referencing readiness logs against global supply inventories when a deployed asset flags a component failure — ends with the agent triggering "a secure procurement order for human review," not placing an order.²

That is a narrower autonomy envelope than "autonomous AI execution" suggests, and a sensible one. Retired Maj. Gen. Allan Day, a Salesforce vice president and industry strategy executive, made the case that constraints are the enabler: "Guardrails, to me, built-in means I can accelerate. It's not a speed bump. It's actually something that allows me to go fast."¹ Read against 2026's agent reliability research, that is not just marketing — structure has repeatedly outperformed instructions in getting agents to behave.

The numbers, separated: delivered versus projected

Every headline figure in this story is a Salesforce projection, and one of the most-repeated ones is not about the agents at all. The press release lists "$6 million in projected annual savings" — but reads, in full, that the savings come "simply from reductions in manual processing time, improved case routing, and the elimination of redundant legacy systems through Army HRC's Digital Front Door platform before a single Agentforce agent is deployed to production."³ The savings are attributed to the underlying platform consolidation, explicitly prior to agent deployment. Coverage that presents $6 million as an AI-agent result is reporting the opposite of what the source says.

The conversation volume needs the same care, because the two primary sources frame it differently. Salesforce's press release says "over 55 million agent conversations per month" are "projected at full scale."³ DefenseScoop reports Collins saying the company "estimates that the command is also managing more than 55 million conversations per month serving soldiers, civilians, spouses and veterans, which can now be handled by secure AI agents."¹ One frames the figure as future agent throughput, the other as existing total volume that agents could take on. Both are Salesforce's own numbers; neither has been independently verified, and it is worth noting the gap rather than picking a side.

The remaining figures are cleaner but still forward-looking: more than 1,500 cases per day are "expected to be supported by automated case summarization," and the Digital Front Door platform "helps HRC resolve 600,000 cases per year more efficiently."³ The commercial context is not a projection. The Army awarded Salesforce an indefinite-delivery/indefinite-quantity vehicle worth up to $5.6 billion over ten years in January 2026, and the HRC work sits under it; Salesforce also took a $1.6 billion VA contract in July 2026.¹¹²

The GAO citation does not say what the press release implies

It largely does not. To argue why passive AI is insufficient, Salesforce's announcement cites a Government Accountability Office finding that 74% of U.S. Air Force aircraft missed their depot maintenance deadlines, attributing the problem to being "largely driven by unforeseen parts shortages and siloed data systems."² The 74% figure is real and checks out: GAO-26-107890, "Air Force Readiness: Actions Needed to Address Depot Maintenance Delays and Staffing Challenges," released May 14, 2026, reports 74%, up from 31% in 2019.¹²

The diagnosis is where the paraphrase drifts. GAO's own emphasis falls on the Air Force revising target timelines after unplanned work is discovered — making depots appear to hit goals they missed — and on depot staffing, where Hill, Robins and Tinker cannot compete with private-sector pay for skilled technicians, alongside erosion of the Defense Logistics Agency's vendor base.¹² "Siloed data systems" is a reasonable adjacent theme; it is not the report's headline finding, and an agent that unifies data does not fix a hiring problem or a metrics-revision practice. The number is sound. The causal chain from that number to "this is why you need agentic AI" is the vendor's, not the auditor's.

What this signals for agentic AI in regulated environments

That the hard part of shipping agents into regulated work is now procurement architecture, not model capability. Three constraints here generalize beyond defense. Authorization boundaries are per-component: Agentforce 360 at IL5 with Slack still at IL4 is the federal version of a problem every regulated buyer has, where one product family spans several compliance regimes and the marketing speaks for all of it. The model layer is now a governed dependency; a platform that cannot swap or disable a provider on policy grounds cannot be accredited when the politics move. And the autonomy that survives review is narrow by design — summarize, retrieve, route, prepare an action for approval — with vendors increasingly willing to say so in the launch material itself.

None of that is unique to the United States; China's agent regulations impose a different set of constraints on much the same technology. The common thread is that "which model, running where, allowed to do what, approved by whom" is becoming a four-part answer given before an agent ships, not after.

Bottom line

The accreditation is genuinely significant, and almost none of that significance is where the headlines put it. A commercially mainstream agent platform clearing DoD's most sensitive unclassified tier, with a named 9.2-million-person customer already contracted, is a real marker of how fast commercial agent tooling is moving into regulated work.¹³ But it is not the first AI at IL5, the $6 million is a platform saving explicitly booked before any agent ships, the 55 million conversations are a projection whose two official framings do not match, and the autonomy on offer stops at preparing actions for human approval.²³⁷

The durable lesson is the one buried in a single paragraph of DefenseScoop's reporting. To get accredited, a vendor had to certify that one specific model provider was switched off — while the legal basis for excluding that provider sits under a preliminary injunction and on appeal.¹⁴ Capability is no longer the gating factor for agents in regulated environments. Provenance is.