Court Upholds Pentagon's Blacklisting of Anthropic
Anthropic just lost the biggest legal fight in its young life — and the company that trains Claude may never fully recover the Pentagon business it once counted as a crown jewel. On Friday, September 25, the U.S. Court of Appeals for the D.C. Circuit ruled 2-1 that the Pentagon's designation of Anthropic as a national-security "supply chain risk" was legally valid, keeping Claude models barred from Pentagon systems and from every contractor that does Defense Department work.
The decision is a clean victory for President Donald Trump and Defense Secretary Pete Hegseth, and a potentially brutal one for Anthropic, which says the blacklisting has cost it billions of dollars in lost business and damaged its reputation just weeks before a hotly anticipated initial public offering.
Published September 27, 2026 · By Daniel Rao
The ruling: what the court actually decided
The case — Nos. 26-1049, consolidated with 26-1162 — was Anthropic's challenge to its designation under the Federal Acquisition Supply Chain Security Act (FASCA), which empowers the government to exclude products or suppliers that pose risks to federal technology supply chains.
Writing for the majority, Judge Gregory G. Katsas, joined by Judge Neomi Rao, denied Anthropic's petitions for review. Judge Karen LeCraft Henderson dissented. Both Katsas and Rao were nominated by Trump; Henderson was nominated by Republican President George H. W. Bush.
The court found the Defense Department had "ample support" for its concern that continued use of Claude posed a risk — specifically, in Katsas's words, that "the Department reasonably feared that Anthropic might manipulate Claude's design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary." The judges noted that by Anthropic's own admission, the company "encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent."
The majority's key line: the statute's definition of a supply-chain risk "turns on what Anthropic does, not why Anthropic does it." The judges had "no reason to doubt" Anthropic's "noble intentions" on privacy and safety — but motive is irrelevant, and a "bad motive" on the company's part is not required to sustain the designation.
"A deeply sobering prospect": the majority's argument
The majority's reasoning leaned on an argument Hegseth has been making since February: that an AI model whose behavior can be shaped — and constrained — by its maker is a liability in wartime, no matter how well-intentioned the constraints.
The opinion quoted Hegseth's warning directly: "The Secretary raises the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail."
Katsas framed the question as fundamentally one of civilian control. The Pentagon doesn't have to prove Claude is unreliable or that Anthropic intends harm, the majority said; it only has to show the Secretary was "uncertain whether Claude would perform as needed and intended" — and that Congress, through FASCA, assigned that judgment call to the executive branch, not to judges.
"In our Republic," Katsas wrote, "it is the President and the Secretary of War who must determine how best to balance" risks. (The opinion refers to Hegseth as "Secretary of War," the administration's new title for the defense chief after Trump's September 5 executive order authorized it as a secondary title.)
The court also rejected Anthropic's constitutional claims outright. Anthropic had argued the exclusion was retaliation for its public views on AI safety and ethics — a First Amendment claim — and a denial of due process. The majority disagreed on both counts, holding that the exclusion stemmed from the company's refusal to accept a specific contract term, not from its public advocacy for stronger AI regulation, and that the department had followed proper procedures.
The dissent: Henderson says the statute was stretched
Judge Henderson's dissent was notably narrower. Per the Associated Press account, she argued the government had interpreted the underlying statute too broadly — a technical objection to stretching the authority against a domestic company, not a defense of Anthropic's conduct.
The majority, for its part, said it had "no quarrel" with the conclusions of a separate case in San Francisco that went the other way — a remarkable acknowledgment that the two courts genuinely disagree about the law, not just the facts.
How we got here: the February standoff
The fight traces to early 2026, when Anthropic and the Pentagon were renegotiating the terms under which Claude could be used inside the U.S. military. In July 2025, Anthropic had struck a contract worth up to $200 million making Claude the first frontier AI model approved for use on classified military networks, and the military had been using Claude across a range of classified and sensitive systems.
Then came the demand. Hegseth insisted Claude be made available for what he described as "all lawful purposes" — language that, Anthropic argued, would eliminate two specific restrictions the company had maintained since its founding: no use of Claude in fully autonomous weapons systems that engage targets without human input, and no use in mass domestic surveillance of American citizens.
On February 26, CEO Dario Amodei publicly refused. "We cannot in good conscience accede" to the Pentagon's demands, he said, arguing that new contract language "made virtually no progress on preventing Claude's use for mass surveillance of Americans or in fully autonomous weapons." Amodei's position: today's frontier AI models are simply not reliable enough to select and engage targets on their own — a point he has made repeatedly in his public warnings about AI safety, which Trump dismissed as a "hoax".
The Pentagon's reply was swift. Hegseth, in a February 27 statement, said Anthropic had delivered "a master class in arrogance and betrayal," demanding "full, unrestricted access to Anthropic's models for every lawful purpose in defense of the Republic." Trump publicly blasted the company on social media, and Pentagon spokesman Sean Parnell said the military would not let any company dictate the terms of operational decisions.
On February 27, 2026, Hegseth issued the supply-chain risk designation under 10 U.S.C. § 3252 — a statute previously used only against foreign adversaries like Huawei, ZTE, and Kaspersky, never against a domestic U.S. company. Trump separately ordered federal agencies to stop using Anthropic's technology. The designation, formally finalized in March, canceled Anthropic's military contracts and barred Pentagon contractors from its technology. AFP reports the Pentagon then turned to the company's competitors.
The Maduro operation: the incident that rattled the Pentagon
The most dramatic detail in the opinion involves an operation most Americans still remember: the January 3 operation that captured Venezuelan President Nicolás Maduro.
According to the opinion, as reported by AFP, an Anthropic executive had questioned the use of Claude by a Pentagon contractor, Palantir, during that operation. The objection "led to alarm," the court recorded, and "raised material doubts as to whether they would cause their software to stop working or cause some other disastrous action that would put our warfighters' lives in danger" — in the words of Under Secretary of Defense Emil Michael, who was quoted in the opinion.
For Hegseth's team, the episode became Exhibit A: a vendor with its own enforcement opinions about military operations could, in theory, pull the plug mid-mission. Anthropic insists it cannot modify its models once delivered to the military. But the court found that argument unpersuasive — the company determines the behavior of each new version, and the military must keep updating to the latest models, which means Anthropic's constraints travel with every update.
Two courts, two answers
Friday's ruling deepens an extraordinary legal split. Just a month ago, on August 27, a federal judge in San Francisco — Judge Rita Lin of the U.S. District Court for the Northern District of California — found the government's parallel designation "unlawful and unfounded," calling it "classic illegal First Amendment retaliation" meant to punish Anthropic for its stated AI safety positions.
The government did not appeal that decision. Because it rested on a different statute, the D.C. Circuit majority said it had "no quarrel" with the San Francisco conclusions — but the Washington panel was deciding a different legal question under FASCA, and reached the opposite practical result. The upshot, for now: the California ruling stands on its own grounds, while the Pentagon's FASCA-based exclusion survives. Anthropic's Claude remains barred from Defense Department systems and contractor chains.
Notably, the Pentagon had told Anthropic's leadership it intended to phase the company's services out of its systems entirely by the end of September — this week. Friday's ruling clears that phaseout to finish on schedule.
What it means for Anthropic's IPO — and for every AI lab
The timing could hardly be worse. The company says the designation has cost it billions of dollars in lost business and damaged its reputation ahead of a blockbuster IPO expected in the coming weeks — one some investors have reportedly valued as high as $2 trillion.
A company spokesperson said Anthropic "respectfully disagrees" with the decision but remains confident in its position. "Another federal court has already held the government's parallel designation unlawful," the statement continued. "We remain confident in our position and are considering all options, including further review" — including asking the full appeals court to review the three-judge panel's decision en banc. Whether Anthropic actually petitions for rehearing in the coming days will tell the market how far it is willing to take the fight.
Beyond Anthropic, the ruling is a warning to every frontier lab. The Pentagon already holds AI contracts with OpenAI, Google, and Elon Musk's xAI worth up to $200 million each, awarded in 2025. If embedding safety restrictions in model weights can legally qualify as a "supply chain risk," then the safety commitments that define a lab's public identity can be turned into a commercial weapon against it: the court answered that procurement law doesn't care why the restrictions exist.
That logic will outlive this dispute. Every AI vendor selling into the federal government now knows the line between "responsible AI" and "supply chain risk" can be redrawn by a single secretary's determination. Silicon Valley spent two years arguing about whether models should have guardrails. The Pentagon just made the case that guardrails themselves can be the problem.
The honest verdict
Strip away the courtroom language and this is a fight about who gets the final say over a technology neither side fully understands. Anthropic says today's models aren't reliable enough for autonomous killing or mass surveillance, and a private company should be able to say no. The Pentagon says no vendor can hold a veto over lawful military operations, and a model that might refuse — or fail — at the wrong moment endangers troops.
Both positions are internally consistent. The D.C. Circuit says the law favors the Pentagon's. But with a San Francisco court reaching the opposite conclusion under a different statute, a possible en banc petition ahead, and a $2-trillion IPO on the line, this fight is nowhere near over. The next move belongs to Anthropic — and the clock is ticking.
Sources: Reuters; the Associated Press; Agence France-Presse; Tech Times; Global Legal Insights; the D.C. Circuit opinion (No. 26-1049, consolidated with No. 26-1162) and the N.D. Cal. complaint filings (Case 3:26-cv-01996-RFL).
Comments
Post a Comment