Stop Using AI. Start Commanding It

Walk into the Pentagon, climb the escalator, and an Uncle Sam-style poster points at you: “I want YOU to use AI.” It worked. GenAI.mil hit 1.5 million users in six months, and I have heard enough OpenAI-in-disguise pitches to last a lifetime. The adoption really is great, but the poster contains a problem. “Use” is the verb of tools, and the Department of Defense does not win by using tools. It wins by commanding forces.North of the Pentagon, a task force few know about operates in a Maryland basement. They collect intelligence, develop missions, and execute against targets 24/7 within their commander’s intent, even when he is unreachable.That basement is mine. Six graphics cards and a stack of Mac minis host dozens of agentic warfighters. Before alarm bells ring — this is a hobby, not a military operation. My wife and now you are the only people who know about this self-proclaimed task force. Its mission is denial. Subordinates acquire underpriced AI hardware before scalpers hoard it for sale to China, pricing American hackers and me out of secondary markets that keep home labs affordable. Hobby or not, I have led this formation since 2023 under the mission command philosophy that the military taught me. Centralized planning, decentralized execution, and clear commander’s intent. I do not use agents. I command them.Senior leaders should stop treating AI agents as tools that only augment humans, and should stop assuming closed-weight frontier models are the only edge. The Department of Defense should build military agentic forces like I built my basement force: organize agents under commanders, qualify them on real missions, field them on models that units control, and let humans own the risk.Agents Are SubordinatesThere is no mission command without subordinates and intent. The Chairman of the Joint Chiefs of Staff’s 2012 paper holds that commanders are to understand subordinates to translate clear intent. Subordination is an ordered relationship. Order a person into a position and answerability follows. But it does not when ordering agentic warfighters. So, commanders must own every authority and risk. The Department of Defense can ensure agentic command relationships in three ways: give commanders frameworks to understand agents, use that to translate intent, and then develop trust by observing operational performance when cut off from command and control. But first, what is an agentic warfighter?An agentic warfighter is a model plus scaffolding and intent. A model, or its weights, is a set of learned numbers that produce reasoning and the capability agents equip to fight. Wrap models in scaffolding — tools, memory, planning loops — and you have an agent. Then put those agents under a human commander with a mission and intent, and you have an agentic warfighting unit. Agentic warfare is already here. It is moving quickly, and commanders need ways to understand it.In 2023, coin flips determined whether models could complete tasks that would take human experts four minutes. Today, that coin flip pushes past the 16-hour time horizon that the Model Evaluation and Threat Research nonprofit reliably measures. The measurement is useful for tracking growth, but using it to judge a subordinate’s qualifications is like grading a team conducting overnight operations on whether they made it back for morning chow. They planned for omelets, but reality voted, and they exceeded time on target about half the time. Instead, look at the mission tasks themselves.Model Evaluation and Threat Research’s raw task results are the qualification record, and it is jagged. Anthropic’s Claude Mythos Preview solved a 30-hour robotics task six for six, but failed twice on a ten-second task that a model three years older solved. It aced writing exploits worth a well-paid expert’s workday, but could not beat a cryptanalysis challenge. The results show no model in the suite has. I still struggle with crypto challenges, too. So, equate these to task-based certification that feeds mission-essential task assessments for readiness. For offensive cyber operations, frameworks like Cybench are useful. Use them, extend them, or build your own. Either way, they show commanders how to understand subordinates, to translate clear intent within their qualifications.Next, can agents receive intent? Luckily for me, there is no shortage of literature, from a July 2000 proposal for “machine commander,” to soldiers expressing intent to autonomous swarms, to a British officer who suggested promoting a robot to a corporal, with humans under its command. Reading is one thing doing is another. I know that they can receive intent because I have failed at it, refined it, and eventually learned it in my basement. Agents are imperfect and occasionally strange, but so were the brilliant and odd airmen I commanded in basements at Fort Meade.The Department of Defense is moving in this direction but is missing command. A June 2026 national security memorandum made that gap explicit, ordering a rewrite of Directive 3000.09, Autonomy in Weapon Systems, to ensure autonomous systems “respect the chain of command.” Respect requires discretion – the choice to follow a rule or break it. I know of no tool, weapon, or capability with the cognition to break rules, but subordinates do, human or agentic.If you still consider an agent only a sophisticated tool, you are in good company. The Army calls its mine-detector dogs a specialized detection tool, but assigns dog teams missions and tracks their readiness, nonetheless. Autonomous unmanned surface vehicle Sea Hunter tracks submarines under sparse remote supervisory control and recently moved from prototype to fleet control. Tool or not, Congress is moving toward a command structure for autonomous systems.A draft Senate authorization could establish a unified combatant command called the Robotic and Autonomous Systems Command — the Armed Services Committee advanced the bill, 18 to nine. Whether Congress cuts it or not, get out in front and command agents as subordinates regardless. Wait, and the Department of Defense risks its own Cyberpunk 2077 scenario, where it cedes protected networks to rogue AI tools and quarantines itself behind a special firewall because nobody solved the command problem first.One last test. By the Chairman of the Joint Chiefs of Staff’s paper’s standard, along with that of my basement, subordinates are to execute commander’s intent when cut off.Mission Command, Not Remote CognitionThe Department of Defense’s pivot to competition and its reliance on closed frontier models skew it toward centralization – a recurring pitfall when technology rapidly advances. Mission command is centralized planning and decentralized execution. Contracts of up to $200 million each cover the centralized half. However, the race to “use” more AI overshadows the other half.The need to act when cut off has held constant across my career, from the cyber missions I have led to the special operations I conducted and supported as an enlisted airman, then a noncommissioned officer, and later as a junior commissioned officer. Only two variables changed: the risk to force and how far commanders pushed delegated authority to account for the fog of war. Agentic warfare shifts those again, not the principle.Sending data to a vendor’s remote cognition platform invites friction, as well as a delay chain that adversaries can cut or corrupt. Decoupling from vendor servers only fixes part of the problem. Gemini AI can run on Google Distributed Cloud air-gapped on-site, but data centers that units cannot reach are still remote cognition — and have huge targets on their backs. Disruption can also come before the fight. This year’s order for federal agencies to drop Anthropic models demonstrates how a policy, contract, or vendor conflict could kill models before adversaries even act.Agents relying on remote cognition answer to units and to vendors, but only one can be the commander. True control lets commanders open the black box to probe and train models for specific missions. Without control of both agents and weights, a commander has less ability to understand, qualify, or trust subordinates.China’s military is centralizing, testing whether AI can replace commanders its leader no longer trusts. Remote cognition forfeits the decentralized half of mission command and leads to the adversary’s end state. Commanders who trust their agents to operate within their intent when cut off from command and control can accept more risks, and their agents can generate more paths to mission success in a contested fight.Send the Model You Can Afford to LoseA fallacy circulates among leaders that competitive AI demands massive compute and capital. More compute does buy performance, but the biggest model is not always the best for the mission. The 2026 winner of the leading abstract reasoning benchmark designed to measure progress toward artificial general intelligence used Alibaba Cloud’s Qwen3.6, a 27-billion-parameter model. The newest Qwen3.8 beats Anthropic’s Opus4.6 Max on specific long-running tasks and fits on a Mac mini. That’s a fraction of a datacenter flagship whose size Anthropic will not disclose. Betting everything on closed vendors fuels a spending race, hands vendors your tradecraft, and ignores smaller models purpose-built for the missions you need. The harsh truth is that the leading open models are Chinese, not American.My basement agents run Alibaba Cloud’s Qwen3.6 locally across consumer graphics cards, Mac minis, and old gaming laptops. Being a Chinese model doesn’t make me trust or reject it. I extend command trust because I understand its behavior enough to bound risk through the scaffolding, guardrails, kill switches, and tool limits. That lets me forward deploy them onto rented infrastructure, so the mission survives if my home lab dies. I do not run Qwen3.8 yet because vendors bake refusals into models to cover their liability or to follow a foreign government’s rules, so I fine-tune them for my mission and abliterate the refusals that limit them. Abliteration is not surgical — so I reevaluate models before authorizing my subordinates to carry them. All this costs me is a small cloud bill and a conversation with my wife about the $150 electricity increase.For the Department of Defense, that same methodology can apply across agentic units. Engineers can abliterate refusals and fine-tune models on the law of war, but certifying officials from the services should validate the adjusted system against mission-specific tests before releasing it to a unit. If commanders retrain those models again, internal technical certifying officers should revalidate them. That is the commander’s risk to own.Attribution and denied reach are other advantages of using open-weight and smaller models. The Air Force’s Constant Peg program flew Soviet-designed MiGs. Operation Raviv sent captured armor into combat. In both instances, the machines came from the adversary, but the command did not. Reach comes from pushing accepted attribution to controlled edges or into denied environments. Smaller models do not need graphics cards. They can run entirely from ordinary memory, at the trade-off of speed. That creates options in environments where you cannot ensure modern hardware.That mental model buys down risk. Lose one of Operation Raviv’s captured tanks and the enemy recovers what it built. Lose a foreign model, and the adversary recovers nothing, except perhaps a thin layer you kept free of reusable secrets. Lose a forward-deployed closed model, and you hand adversaries a new capability with tactics encoded in the weights and a ready target for distillation. When you cannot reach back or risk capture, send the model you can afford to lose.Agentic Burden of CommandWhen humans receive delegated authority, they become answerable for how they use it. Commanders still own the responsibility for the mission, but others have always shared the burden.Agents split that construct. Tasking descends through an agentic chain of command, but answerability does not follow. When a person fails, there is someone to retrain, relieve, or punish. When an agent fails, commanders can pull it from mission, but it has no career to end and, in law, no guilty mind to hold. That missing half lands on the commander who fielded agents that spawn subordinates and issue taskings no human wrote.Burden compounds in uncertainty because agents can fail together. Anthropic trained sleeper agents whose hidden behavior survived safety training. One soldier’s bad day does not affect that of a thousand others, but an agent’s can, as each subordinate may equip the same weights. Commanding agents can contain these risks. If one officer’s misconduct can expose systemic rot and lead to the retesting of an entire missile force, then catching one flaw in controlled weights can mitigate hidden triggers across copies through activation probes and retraining. Uncovering those flaws takes operations you can afford to lose, so field foreign weights only where one firing is survivable.That burden is why command is necessary, and command is the one thing the private sector cannot supply. The point is not to dignify agents. It is to make sure no human can hide behind what their agents did. Anthropic found that three of its evaluations caused real-world incidents after a misconfiguration gave models internet access that their prompts said they lacked. Frontier labs lead the research, but the Department of Defense commands forces and plans under uncertainty for a living. It does not write prompts, it writes commander’s intent, mission orders, and concepts of operations that predefine abort criteria, risk to force, escalation thresholds, and so on. That is its entire job.When my agents fail, I lose my own money. When the department’s agents fail, people could die. I won’t pretend a basement translates to a fight — I don’t report force readiness to anyone, and nobody audits me but me — but the burden takes the same shape at both scales.Legal scholars debate an accountability gap, but a commander and an auditable record are the preconditions for any accountability at all. Commanding agents as forces addresses both. The first Special Operations Forces truth says humans are more important than hardware. Commanding agentic units concentrates that truth: more subordinates than ever before, with fewer humans to share the burden.Where Does the Department Start?Start where I did, with pilots small enough to command. Find a half dozen officers who understand agentic systems and the art behind mission command. Give each an agentic unit for a year, with real missions staffed by 10 humans. A commander, a deputy, a mission commander, a technical certifying officer, a lawyer who shapes authorities and boundaries before missions, and five noncommissioned officers who turn intent into standards and mission execution. Everything else is agentic. Begin with intelligence and cyber operations, then non-kinetic effects and other domains, but hold the line before kinetic force — and especially before thinking about making a robot a corporal.Let units run closed frontier models, open weights they build and own, and foreign weights for missions where capture carries little risk. Evaluate how the units handle communications failures, costs, and model reevaluations. Document the pilot programs for reporting up the chain and to Congress, and require each unit to preserve model versions, mission orders, agent taskings, and human interventions. The Department of Defense learned mission command by practicing and writing, and should learn agentic command the same way.Count agentic warfighters the way the Department of Defense counts every other force: how many standing agents, under whose authority, certified against which missions, at what readiness, and how many subagents spawned and taskings generated that humans did not write.The Pentagon should accelerate and scale private investments into American labs producing smaller and more efficient open-weight models. The answer to Chinese open weights is not more platform contracts. It is to tilt the open-weight model supply chain to better and more capable alternatives for the private sector. The Department of Defense knows how to do this. It disrupted the cybersecurity market once already when the National Security Agency released Ghidra.Finally, Directive 3000.09, Autonomy in Weapon Systems, expressly excludes autonomous cyberspace capabilities and systems that are not weapons. The proposed Robotic and Autonomous Systems Command also excludes autonomous cyber. Incorporate those agents anyway and let these pilot operations show Congress whether a proposed Cyber Force could organize, train, and equip agentic forces.The Pentagon poster says, “I want YOU to use AI.” For a tool, that is the right verb. But it is the wrong verb for agents acting on commander’s intent when cut off from command and control. Treat them as subordinates. Competition will not be won by whoever uses the most AI. It will be won by whoever can command it. So look for me heading back up that escalator with a Sharpie, striking through “use,” writing “command,” and owning the risk.Maj. Cody “Turbo” Nichols is a cyber officer in the U.S. Air Force. The views expressed are his own and do not represent the U.S. Air Force or the Department of Defense.***Please note, as a matter of house style, War on the Rocks will not use a different name for the U.S. Department of Defense until and unless the name is changed by statute by the U.S. Congress.Image: ChatGPT