DRONA 2.0: A Military College Replaced Its Custom GPT

The Short Answer

India's Defence Services Staff College launched DRONA 2.0 on 18 August 2026, moving its AI from a customised GPT to Sarvam-105B running on a GPU server inside the college's own secure network. That is the sovereign pattern: open weights, owned infrastructure, no outbound calls. On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, with no per-seat pricing, so you can deploy anywhere.

Two clarifications, because the circulating version is wrong in ways that make it less useful than the truth.

This is professional military education, not battlefield AI. DRONA 2.0 runs at a staff college, for faculty and student officers, on a closed campus network. Reading it as an operational weapons system misses what makes it copyable.

The 105B model was not built by the military. It is Sarvam-105B, from Sarvam AI, a Bengaluru startup, released under Apache 2.0 in February 2026. The college adopted open weights and hosted them.

And the detail that turns a press release into a template: DRONA 1.0 was a customised GPT. The college ran one for 14 months, then replaced it.

What did India's Defence Services Staff College actually deploy in DRONA 2.0?

The Defence Services Staff College (DSSC) sits at Wellington, in Tamil Nadu, and trains mid-career officers from the Indian Army, Navy and Air Force. DRONA stands for DSSC Resource Optimising Neural AI.

DRONA 2.0 was formally inaugurated on 18 August 2026 by Lieutenant General Manish Erry, Commandant of DSSC, with Dr Vivek Raghavan, co-founder of Sarvam AI, present. The two organisations signed a memorandum of understanding at the same event.

The deployment description is the part worth reading closely. DRONA 2.0 runs Sarvam-105B "integrated with open-source models and deployed on a state-of-the-art GPU server inside DSSC's secure network."

Every architectural claim an institution cares about is in that one sentence: the weights are open, the inference hardware belongs to the institution, and the whole thing sits inside a perimeter the institution controls.

It is multimodal across text, image and speech, and it is available to DSSC faculty and student officers on the college network. Performance benchmarks have not been published.

Why did a military college replace a customised GPT with a self-hosted model?

DRONA 1.0 launched on 16 June 2025, on the DSSC Wide Area Network. It was a customised GPT, built jointly by DSSC and the Weapons Electronics Systems Engineering Establishment (WESEE) of the Indian Navy.

So the sequence at this military college runs: hosted commercial model in June 2025, self-hosted open-weight model 14 months later.

That ordering is the opposite of how sovereign AI is usually pitched. The common framing treats using a commercial API as the mistake you avoid. DSSC's record suggests it is the step you take first, deliberately, and then leave.

There is a practical reason. You cannot specify the AI system an institution needs until people have used one. A hosted model is the cheapest possible way to discover which tasks actually get used, which documents matter, and where the real sensitivity lies.

Only then can you tell whether an open-weight model is good enough for those specific tasks — which is a much narrower question than whether it is good enough in general.

What changed between June 2025 and August 2026 was not the college's ambition. It was the availability of an indigenous open-weight model capable of the work, which did not exist when DRONA 1.0 shipped.

We made a version of this argument for public-sector buyers in Sovereign or Supervised: Government AI Architecture, and traced the same dynamic across three jurisdictions in Why Government AI Must Be Sovereign: EU, Kenya, Taiwan.

What is Sarvam-105B, and why does an Apache 2.0 licence matter for defense AI?

Sarvam-105B is a reasoning model from Sarvam AI in Bengaluru. Per Sarvam's own model documentation:

• 105B+ total parameters, in a Mixture-of-Experts transformer with 128 sparse experts and Multi-head Latent Attention — so serving cost tracks the active parameters, not the total.
• 128K-token context window.
• Pre-trained on 12 trillion tokens across code, maths, multilingual and web data.
• Apache 2.0, released alongside a 30B sibling as open weights.
• Native support for the most-spoken Indian languages plus English, including romanised and code-mixed input.

Reported benchmarks include 98.6 on Math500 and 88.3 on AIME 2025 (96.7 with tools), 85.8 on HMMT, and 68.3 on Tau2 for agentic tasks.

The licence is the specification that matters most here, and it is the one least often discussed.

Apache 2.0 carries no field-of-use restriction. That is not a detail for a defence institution — several prominent "open" model licences explicitly restrict military or intelligence application, which makes them unusable for this deployment regardless of benchmark scores.

Apache 2.0 also means no usage-tier gate, no per-seat entitlement, and no counterparty who can change the terms after the system is embedded in a curriculum. Read the licence file, not the announcement.

There is one more property that only shows up years later. A model you have downloaded still runs at the same version next year. A hosted endpoint can be deprecated on the vendor's schedule, which is a genuine continuity risk for a syllabus built around it.

Does sovereign AI require a government to build its own model?

No — and DRONA 2.0 is the clearest available evidence.

DSSC did not train a foundation model. Sarvam did, and then gave the weights away. The college's contribution was the deployment: hardware inside its own perimeter, integration with its own material, and access control on its own network.

Sarvam-105B itself was trained on GPU capacity provided under the IndiaAI Mission, the Indian government's ₹10,372-crore national AI programme. So the public investment went into the model layer once, and any Indian institution can now host the result for free.

That is a materially different economic model from every institution buying seats. One publicly-funded training run, unlimited self-hosted deployments, no marginal licence cost.

The distinction worth internalising is that model sovereignty and infrastructure sovereignty are separate decisions, and only the second one is available to most organisations.

Almost nobody should train a frontier model. Almost everybody can control where inference runs, who sees the prompts, and which weights are loaded. That second set is where the compliance and security properties actually live.

We covered how open weights changed the calculus for public buyers in How Washington Made Sovereign AI the Path of Least Resistance, and what "ownable frontier reasoning" requires beyond the weights themselves in The IMO-Perfect Model's Open Sibling.

What does the DRONA pattern cost against per-seat AI subscriptions?

Per-seat AI pricing is not one option among several. It is the wrong shape for an institution, because the bill tracks headcount rather than use.

A staff college, an agency, or a hospital pays for every person on the roster whether they open the tool daily or twice a term. Self-hosted inference does not work that way: the same GPU server serves 250 people or 5,000.

Here is what published list prices do as an institution grows. Every figure is arithmetic on a vendor's own per-user price.

The right-hand column is deliberately not a dollar figure. Hardware and power vary too much between institutions to quote honestly, and inventing a number would defeat the point.

What is not in doubt is the shape. Three columns multiply by headcount; one does not. At 5,000 people the per-seat lines have grown twentyfold and the server has not changed.

Weights alone are not a deployment, and this is where most sovereign-AI projects stall.

Running an open-weight model in production also requires a serving stack, permissions-aware retrieval, guardrails, evaluation harnesses built from your own traffic, and audit logging a compliance reviewer will accept.

That surrounding layer is what Agentic OS provides, and why a licence change is actionable rather than merely interesting.

How can a defense or government institution copy the DRONA pattern?

Four steps, in the order DSSC appears to have taken them.

Run a hosted model first, and instrument it. You are not buying a permanent system. You are buying a requirements document. Log which tasks people actually perform, which sources they cite, and where sensitive material shows up.

Set the trigger for moving in advance. DSSC did not move when open weights became available in general. It moved when an open-weight model handled its specific work. Write down the capability threshold before you start evaluating.

Bring inference inside the perimeter before you expand scope. DRONA 2.0 shipped to faculty and student officers on one secure network. A narrow first deployment on owned hardware beats a broad one on someone else's.

Keep the model layer swappable. Sarvam-105B is the right model for an Indian defence college in 2026 partly because of language coverage. It will not be the right model everywhere or forever. Architect so the model can be replaced without rewriting the application.

For deployments where the perimeter has no outbound connectivity at all, that last requirement becomes a hard constraint on the platform, not just the model — which is the subject of air-gapped AI deployment.

ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.

What does DRONA 2.0 not prove about sovereign AI?

Three honest limits, because the enthusiastic version of this story oversells it.

No published benchmarks. DSSC has not released performance data for DRONA 2.0, and neither has Sarvam AI for this deployment. We know what was installed. We do not know how well it works, and nobody outside the college does.

Education is not operations. A staff college network is a demanding environment, but it is not a deployed headquarters. The security properties that hold for coursework do not automatically transfer to operational systems.

Indigenous is not the same as sovereign. Sarvam-105B being Indian-built matters politically. What matters architecturally is that the weights are downloadable under Apache 2.0 and the inference runs on the institution's hardware — properties an American, French or Japanese institution can obtain from a different open-weight model tomorrow.

That last point is the reason this story travels. The transferable asset is not the model or the nationality. It is the sequence: use a hosted model to learn, adopt open weights when they clear your bar, host them yourself, and keep the model layer replaceable.

A comparable state-level version of the same logic is worked through in Karnataka's Government-First AI Test.