Anthropic v. United States (Pentagon ban challenge)

Anthropic v. United States is a federal lawsuit in which Anthropic PBC challenges three measures taken on February 27 and March 3, 2026: a directive from President Trump ordering every federal agency to stop using Anthropic's products, a same-day directive from Secretary of War Pete Hegseth designating the company a supply-chain risk and barring military contractors from doing business with it, and the formal supply-chain-risk designation that followed under 10 U.S.C. § 3252. On March 26, 2026, Judge Rita Lin granted a preliminary injunction blocking enforcement of both measures, finding the government's actions likely retaliatory against Anthropic's publicly stated use restrictions. A parallel petition for review at the U.S. Court of Appeals for the D.C. Circuit, challenging the supply-chain-risk designation directly, produced a contrary outcome when the panel denied Anthropic's emergency motion to stay on April 8, 2026. On August 27, 2026, the district court entered summary judgment largely for Anthropic, holding the challenged actions unlawful retaliation under the First Amendment and a deprivation of liberty interests without due process, vacating the supply-chain-risk designation under the Administrative Procedure Act, and entering a permanent injunction. Judgment was entered for the government on the ultra vires separation-of-powers count and as to several agencies that took no relevant action. On September 25, 2026, a divided D.C. Circuit panel denied Anthropic's petitions for review of the parallel exclusion the Department had made under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. § 4713), holding that the statute's definition of supply chain risk is broader than that of 10 U.S.C. § 3252 and does not require bad motive (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

Provenance note: The August 27, 2026 disposition below rests on the court's own filings, both retrieved in full from the CourtListener RECAP docket and summarized at Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026) (Dkt. No. 250, 59 pages) and Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026) (Dkt. No. 251, 4 pages). The account of the preliminary-injunction stage still rests on reporting; the March 26, 2026 order is published at 825 F. Supp. 3d 1101 (N.D. Cal. 2026) but its text has not been retrieved. The D.C. Circuit's September 25, 2026 opinion in Nos. 26-1049 and 26-1162 was read in full from the court's PDF and is summarized at Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026); quotations from it below are checked against that text.

Case information

Background

The dispute grew out of disagreement between Anthropic and the Department of Defense over the terms governing military use of Claude. The U.S. military allegedly used Claude in the January 2026 Venezuela/Maduro operation; Anthropic's public position is that it did not discuss that specific use with the Department of War. The D.C. Circuit record adds that an Anthropic executive "questioned the propriety" of a contractor's use of Claude "for a sensitive military operation abroad," which the Department says its usage policy "clearly permitted" and which "led to alarm by the DoW and the prime contractor"; the Department did not identify the operation, but Anthropic put into the record media reports that it had raised concerns with Palantir about its technology's role in the January 3, 2026 operation to capture Nicolás Maduro. Anthropic characterized the incident as a misunderstanding (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)). Anthropic's use policy forbids autonomous weapons and mass surveillance of Americans. The Pentagon pushed to renegotiate Claude Gov contracts for "all lawful use," which Anthropic refused.

According to The Verge (May 26, 2026), the dispute originated in a January 12, 2026 memo from Hegseth demanding renegotiation of existing AI contracts on "any lawful use" terms and arguing that "the risks of not moving fast enough outweigh the risks of imperfect alignment." That memo underlies the February 27 ultimatum and supply-chain-risk designation that followed (Source: theverge.com). The signed memorandum shows these to be one instrument, not two: Artificial Intelligence Strategy for the Department of War is dated January 9, 2026 and was posted on January 12, the date The Verge reported; both the "any lawful use" directive and the "risks of not moving fast enough" passage appear in it. Its subsection "Clarifying 'Responsible AI' at the DoW — Out with Utopian Idealism, In with Hard-Nosed Realism" gives the Under Secretary of War for Acquisition and Sustainment 180 days to incorporate "any lawful use" language into any Department contract procuring AI services, and the Chief Digital and AI Office 90 days to establish "benchmarks for model objectivity as a primary procurement criterion" (Artificial Intelligence Strategy for the Department of War (Hegseth memorandum, 2026); Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The prior working relationship

The undisputed record set out in the opinion establishes a multi-year procurement relationship before the dispute. U.S. intelligence and defense agencies had used Claude since 2024, and the Department of War had used Claude Gov through partner platforms since March 2025. The Defense Counterintelligence and Security Agency granted Anthropic Top Secret facility security clearance after an 18-month vetting process. In June 2025 GSA and the Department granted Claude FedRAMP authorization for FedRAMP High and DoD Impact Level 4 and 5 workloads. In July 2025 the Department's Chief Digital and Artificial Intelligence Office awarded Anthropic a two-year agreement worth up to $200 million, and in August 2025 Anthropic and GSA announced an agreement to deliver Claude Gov to the civilian executive, legislative and judicial branches. Before March 2, 2026 the Department "did not identify any potential supply chain risk posed by Anthropic," and outside the usage-restriction negotiations Anthropic "only ever received positive feedback about Claude's performance from [its] governmental customers" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The government relied in litigation on a 2025 incident in which the Centers for Disease Control and Prevention, using a general commercial Claude model rather than a tailored Claude Gov model, had some prompts refused. The court recorded that nothing indicates the CDC believed the limitations were introduced maliciously or negligently (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The negotiation and the ultimatum

In fall 2025 the Department told Anthropic it must remove all usage restrictions for a deployment on the GenAI.mil platform and accept a clause permitting use "for all lawful uses." Anthropic agreed to drop most restrictions but refused on two — lethal autonomous warfare and mass surveillance of Americans. Between December 4, 2025 and March 4, 2026 Dario Amodei and Under Secretary of War for Research and Engineering Emil Michael exchanged emails trading draft contract language. Amodei wrote that "AI fundamentally changes what is possible with surveillance on Americans in ways that existing law was not written to address," and framed the proposals "with tremendous respect and deference for the D[oW]'s expertise in this domain." He repeatedly offered to help offboard Claude if the Department concluded Anthropic was not the right vendor (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

At a February 24, 2026 meeting attended by Amodei, Anthropic Head of Policy Sarah Heck and Secretary Hegseth, the Secretary said Claude had "exquisite capabilities" and that Anthropic's concerns were "understandable," but that the Department "had many other vendors to choose from that have never raised" those concerns and who "would never hold any veto power over" it. He said nothing about the models being unsafe, insecure or subject to compromise. He gave Anthropic until 5:00 p.m. on February 27 to accept "all lawful uses," failing which it would be designated a supply chain risk — or, alternatively, the Department might invoke the Defense Production Act to designate Anthropic as essential to national security and compel its services without the restrictions. On February 26 Amodei issued a public statement saying Anthropic "cannot in good conscience" provide the access requested, while acknowledging that "[DoW], not private companies, makes military decisions" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The three challenged actions

Three measures, which the court collectively calls the Challenged Actions, followed:

• The Presidential Directive, posted on Truth Social at 3:47 p.m. on February 27, 2026, ordering "EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic's technology," with a six-month phase-out for agencies such as the Department of War, and describing Anthropic as a "RADICAL LEFT, WOKE COMPANY" whose employees are "Leftwing nut jobs."
• The Hegseth Directive, posted on X about an hour later, stating that Anthropic "delivered a master class in arrogance and betrayal," directing the Department to designate the company a supply-chain risk, and ordering that "[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic."
• The Supply Chain Designation, comprising a March 3, 2026 determination and a March 4 letter on Department letterhead signed by Hegseth citing 10 U.S.C. § 3252, which excluded Anthropic from supplying products or services as contractor or subcontractor for procurements involving national security systems. The effect was immediate and permanent, with thirty days to appeal; the underlying determination documents were not disclosed to Anthropic until after it filed suit.

Together the directives created an immediate, permanent, government-wide bar on Anthropic technology and prohibited any company doing business with the military from doing any business with Anthropic, "even if unrelated to the military or national security" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026); Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).

A separate March 5, 2026 memorandum from the Department's Chief Information Officer instructed components to remove Anthropic products "from all DoW systems and networks" within 180 days and to incorporate the restriction into all current and future contracts (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)). The D.C. Circuit opinion dates the same Chief Information Officer memorandum March 6, 2026, and describes it as ordering removal "as soon as practical" and in any event within 180 days and as prohibiting contractors from using Anthropic products in their work for the Department (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

Claims

The complaint pleads five counts, identified by number in the court's orders (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)):

The claims center on retaliation against Anthropic's public policy positions — its refusal of autonomous-lethal-weapons and mass-surveillance uses. The parallel D.C. Circuit petitions for review, Nos. 26-1049 and 26-1162, challenged the Department's covered procurement actions under the Federal Acquisition Supply Chain Security Act, 41 U.S.C. § 4713, as arbitrary, unauthorized by the statute, and contrary to the Fifth and First Amendments (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026); Federal Acquisition Supply Chain Security Act of 2018 (FASCSA)).

Procedural history

Preliminary injunction (March 26, 2026)

Judge Lin issued a 43-page ruling granting a preliminary injunction. It blocks the government from enforcing the ban and the supply-chain-risk designation. The ruling finds that the government's actions were retaliatory against Anthropic's public policy positions (the refusal of autonomous-lethal-weapons and mass-surveillance uses) and holds that the retaliation likely violated the law, on an implicit First Amendment / administrative-law theory.

The later opinion records the order's own scope: it restored the status quo as of February 27, 2026 and expressly did not bar any defendant from lawful action available before the challenged actions, did not require the Department to use Anthropic's products, and did not prevent it from transitioning to other providers. The order is published at 825 F. Supp. 3d 1101 (N.D. Cal. 2026). The government appealed but did not seek an emergency stay; the appeal, Anthropic, PBC v. United States Department of War, No. 26-2011 (9th Cir.), was filed April 2, 2026 and has been stayed at the parties' mutual request pending a ruling from the D.C. Circuit in the related matter No. 26-1049 (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

D.C. Circuit denial of stay (April 8, 2026)

A separate petition for review at the D.C. Circuit, challenging the Pentagon's supply-chain-risk designation directly, produced a contrary outcome 13 days after Judge Lin's preliminary injunction. The D.C. Circuit denied Anthropic's emergency motion to stay the Pentagon designation while the petition proceeds, concluding that "the equitable balance here cuts in favor of the government. On one side is a relatively contained risk of financial harm to a single private company. On the other side is judicial management of how, and through whom, the Department of War secures vital AI technology during an active military conflict." The panel found that "substantial expedition is warranted" in moving the case forward (Source: cnbc.com; thehill.com; axios.com).

D.C. Circuit oral argument (May 19, 2026)

A three-judge D.C. Circuit panel heard nearly two hours of oral argument on Anthropic's challenge to its Pentagon blacklisting. Judge Karen Henderson characterized the Defense Department's "supply chain risk" designation a "spectacular overreach" unsupported by the record, the most skeptical signal from the bench to that point in the supply-chain-risk track (Source: cnbc.com).

Summary judgment and final relief (August 27, 2026)

On August 27, 2026, Judge Lin issued a 59-page order on the parties' cross-motions for summary judgment (Dkt. No. 250) together with a four-page order of final relief (Dkt. No. 251). The opinion's caption reads Order on Cross Motions for Summary Judgment; Granting Motion to Supplement the Administrative Record; in its conclusion the court grants Anthropic's Motion to Consider Evidence Outside the Administrative Record (Dkt. No. 169) and denies the alternative Motion to Complete the Administrative Record as moot (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026); Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).

The opinion records that the government submitted the administrative record justifying the February 27 and March 3, 2026 actions and that "the record is slim," a four-page memorandum by Under Secretary of War for Research and Engineering Emil Michael that post-dates two of the three challenged actions supplying "the entirety of the government's rationale." The court states that the defendants "backed away from the thrust of their risk assessment," which had rested on Anthropic holding backdoor access to its technology once deployed in a national security system; it is undisputed that Anthropic has no such access, and the defendants conceded that its technology is "no riskier to the national security than any other 'black box' artificial intelligence model." What remained was the government's position that Anthropic's "increasingly hostile manner through the press" meant it "cannot trust Anthropic to ensure the integrity of its models." The court wrote that "[n]either the Constitution nor the federal statute invoked by Defendants allows them to impose sweeping penalties based principally on Anthropic's critique of the Administration's views," and that "[t]he empty invocation of national security is not a blank check to punish and retaliate against government critics" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The opinion identifies three contemporaneous facts it reads as inconsistent with a genuine sabotage concern: that Hegseth proposed applying the Defense Production Act to Anthropic days before the challenged actions, a measure that would treat the company as essential to national security rather than a threat to it; that the Department of War continued to pursue a contract with Anthropic immediately afterwards, saying "we are very close here"; and that the government was, as of the ruling, discussing collaboration with Anthropic on Mythos "in an array of sensitive contexts" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The technical premise of the designation was found to be unsupported. Anthropic submitted unrebutted declarations from its Chief Science Officer and its Head of Public Sector, Thiyagu Ramasamy, establishing that deployed models are static and cannot "degrade or change on [their] own," that once deployed Anthropic cannot "access, alter, [or] shut down" a model, that Claude models cannot be updated like conventional software but must be replaced by a newly trained model after Department testing and approval, and that Anthropic cannot view the Department's prompts. The administrative record contains nothing describing "what technological means would give rise to the so-called 'backdoors'" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

On the statute, the court held that 10 U.S.C. § 3252 defines supply chain risk as the risk "that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert" a national security system, and that "[t]he plain text of the statute is directed at covert acts or hacks, not overt, public positions regarding contract terms." Congress enacted the provision in 2010 against the globalization of the information technology industry, and the Department's own 2012 implementing instructions described the risk as "sabotage or subversion" by "foreign intelligence, terrorists, or other hostile elements." Reading the section to reach a vendor the Secretary finds too arrogant or difficult to trust "would effectively gut" its requirement that exclusion be necessary to reduce supply chain risk (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

Two procedural safeguards were held to have been breached. Section 3252(b)(2)(B) requires a written determination that "less intrusive measures are not reasonably available," and § 3252(b)(3)(B) requires the congressional notifications to contain "a discussion of less intrusive measures that were considered and why they were not reasonably available"; the record held only boilerplate assertions and the six identical committee notices contained no such discussion. Separately, 48 C.F.R. § 239.7304(a) requires a joint recommendation made on the basis of a risk assessment by the Under Secretary of Defense for Intelligence, and the assessment instead came from Under Secretary Michael, then conducting the contract negotiations. The court rejected the government's harmless-error argument (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The designation was also held arbitrary and capricious, with the court finding an inference of pretext from timing — the factual basis was prepared one business day after Hegseth's instruction and the designation issued two business days later, against a multi-year relationship in which "there was not a single documented supply chain risk concern" — and from shifting justifications, Under Secretary Michael's March 17, 2026 declaration asserting it "reasonably likely" that Anthropic would alter or shut off the Department's use of Claude during an operation while his March 24 declaration dropped the claim and addressed only model-update risk (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

On the First Amendment, the court held the Pickering framework inapplicable because the challenged actions were an exercise of sovereign rather than contractual power, and found that applying it anyway would reach the same result. It relied on NRA v. Vullo and Janus against the government's contention that "no speech or expressive conduct is at issue," and on the D.C. Circuit's August 18, 2026 decision in Hesai Technology Co. v. U.S. Department of Defense for the stigma-plus liberty interest and for the requirement of pre-deprivation notice absent a particularized showing of urgency (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The opinion also records the chilling-effect evidence. Before the preliminary injunction, defense contractors using Claude-integrated APIs began assessing and in many cases seeking to terminate their reliance on Anthropic; one partner with a multi-million-dollar annual contract switched to a competing model to service a Food and Drug Administration contract; and Anthropic "received inquiries regarding the [Challenged Actions] from over one hundred enterprise customers expressing deep fear, confusion, and doubt." Its unrebutted evidence is that if the restrictions stood, defense-contractor and other Department-related client revenue would fall by "50–100 percent" and its "2026 revenue by multiple billions of dollars." Trade associations representing government contractors filed an amicus brief describing "contracts terminated, partnerships frozen, workflows thrown into disarray" and stating that "[t]hese harms affect the entire technology industry, not just Anthropic"; separately, 38 employees of major AI companies argued the actions threaten to "chill open deliberation" and "professional debate" among those best placed to understand the technology's potential for "catastrophic misuse" (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).

The disposition is split across five counts:

The "non-participating defendants," against whom the government prevailed on all claims, are the National Endowment for the Arts, the Social Security Administration, the Federal Reserve Board of Governors, the Executive Office of the President, their respective heads, and Does 1–10 (Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).

The order of final relief entered three distinct remedies. It declared the challenged actions unlawful First Amendment retaliation and a deprivation of constitutionally protected liberty interests "without sufficient pre-deprivation notice or opportunity to be heard"; it permanently enjoined all defendants other than the non-participating defendants from implementing, enforcing or giving effect to those actions, and directed them to rescind every guidance, directive, communication or instruction issued in furtherance of them; and it vacated, set aside and remanded the Supply Chain Designation under 5 U.S.C. § 706(2), holding it "arbitrary, capricious, and in excess of statutory jurisdiction, authority, or limitations under 10 U.S.C. § 3252." The court separately vacated the portion of the Hegseth Directive providing that "[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic," and vacated the implementing orders of nine agencies as imposed "without jurisdiction delegated to those agencies and without authorization by law" under 5 U.S.C. §§ 558(b) and 706. Relief does not extend to acts taken by the Federal Housing Finance Agency in a conservator capacity, under 12 U.S.C. § 4617(f) (Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).

The order states its own limits. It "does not bar any Defendant from taking any lawful action that would have been available to it on February 27, 2026," and specifically "does not require the Department of War to use Anthropic's products or services and does not prevent the Department of War from transitioning to other artificial intelligence providers, so long as those actions are consistent with applicable regulations, statutes, and constitutional provisions." The court retained jurisdiction to enforce (Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).

Contemporaneous reporting recorded the ruling as a finding that the Pentagon had retaliated against Anthropic for criticizing its contracting position. Anthropic said it was "pleased the court has ruled that this supply chain risk designation was unlawful" (Source: wsj.com; yahoo.com).

D.C. Circuit merits decision (September 25, 2026)

The D.C. Circuit track concerned a different instrument from the one vacated in San Francisco. The Department relied on two designations, which had to be litigated in separate courts (Source: cnbc.com): the district court reviewed the designation under 10 U.S.C. § 3252, while the Federal Acquisition Supply Chain Security Act channels review of "covered procurement action[s]" under 41 U.S.C. § 4713 exclusively to the D.C. Circuit (41 U.S.C. § 1327). After the April 8 stay denial, Anthropic asked the Department on April 17 to rescind the exclusion; the Secretary denied reconsideration on June 3, clarifying that his determination did not rest on the premise that Anthropic could control a version of Claude after delivery for deployment on classified systems. Anthropic filed a second petition, No. 26-1162, on June 17, and the court consolidated the two on June 24. The panel ordered supplemental briefing after the May 19 argument on jurisdiction and on the June 3 order (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

On September 25, 2026 the panel (Henderson, Katsas and Rao, Circuit Judges) denied the petitions for review. Judge Gregory Katsas wrote for the court, joined by Judge Neomi Rao; Judge Karen LeCraft Henderson dissented. The majority held that "[t]he Department had ample support for its conclusion that the continued integration of Claude into the Department's information systems, by the Department or its contractors, presented a statutorily covered national-security risk," citing Anthropic's admission that it encodes restrictions into Claude that prevent the model from performing tasks the company wishes to prevent, occasions on which those restrictions stopped Claude from performing tasks requested by government users, and a dispute over whether the contractual prohibitions barred Claude's use in an ongoing overseas military operation (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026); Source: cnbc.com).

The holdings, as stated in the opinion (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)):

• Jurisdiction: The court held it had jurisdiction over at least one of the two petitions and did not resolve whether Anthropic's April 17 rescission request rendered the first petition incurably premature.
• Statutory definition: Section 4713(k)(6) defines supply chain risk as the risk that "any person" may "sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate" a covered product. The majority read "otherwise manipulate" in its ordinary, neutral sense and held that the Secretary's concern about Anthropic disabling Claude from performing lawful actions requested by the Department falls within it. It rejected Anthropic's reading that the clause requires surreptitious action and its reliance on legislative history pointing to foreign companies.
• Relation to the district court's ruling: The majority stated it had "no quarrel" with the Northern District's conclusions that § 3252, with its reference to an "adversary," requires bad motive and that Anthropic acted with no such motive, but held that "no such bad motive is required" under the broader § 4713 definition. It wrote that the Northern District's determinations on arbitrariness and exigency under § 3252 do not control its review under § 4713, given Congress's grant of exclusive jurisdiction to the D.C. Circuit.
• Less intrusive measures: The Secretary reasonably concluded that less intrusive measures were not reasonably available; Anthropic's suggestion that any restriction be narrowed to systems involving lethal autonomous warfare or domestic mass surveillance was raised in one sentence and not preserved. The majority questioned the claimed reputational harm, noting reported increases in Anthropic's valuation since the determination.
• Urgency and notice: Assuming without deciding that the Secretary's finding of an urgent national-security interest was reviewable and wrong, the majority held any error harmless, because by March 19 the Department had given Anthropic notice and the supporting materials and invited a response, and Anthropic's later submissions would not have changed the decision.
• Due process: The claim failed because the Department promptly notified the company of the exclusion and its rationale and gave it a fair opportunity to contest it.
• First Amendment: The court found that Anthropic's advocacy on AI safety is protected and that the exclusion was materially adverse, but found no causal link: the Department excluded Anthropic "because Anthropic refused to agree to a contract term the Department deemed essential to national security." It read Secretary Hegseth's February 27 social-media post, which criticized Anthropic's "sanctimonious rhetoric," as addressing the refusal of the "all lawful uses" term.

The majority's account of the record rests largely on Anthropic's own declarations. It found it "undisputed that Anthropic can and does control how Claude responds—or fails to respond—to user prompts," through the constitutional training described by Jared Kaplan and Dario Amodei, and quoted Anthropic's head of public-sector business that "[m]odel training is the primary mechanism through which Anthropic can influence the behavior of models used by the Department." Anthropic disclaimed any ability to access or alter a delivered model, but can encode new restrictions in each new version. The 2024 refusals by commercial Claude models to process classified material, which led to Claude Gov, and the 2025 refusal of Centers for Disease Control and Prevention queries showed, in the court's words, that "Anthropic's model training does effectively enforce contractual usage restrictions." Anthropic's proposal that the Department test each new model and keep using an older one if dissatisfied was rejected: the contested restrictions are "hardly self-defining," Department record material describes models with "approximately 5 to 10 trillion" parameters as making "rigorous analysis or auditing of its output mathematically impossible," Claude may answer differently worded requests differently, and "the Department cannot utilize AI systems that remain trapped in amber." The court accepted that Under Secretary Emil Michael's memorandum erred in one sentence suggesting Anthropic could disable delivered technology mid-operation, but held that its "basic thrust" remained intact and that the Secretary's June 3 order disclaimed reliance on post-deployment control (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

Two passages rest on press reports placed in the record. On reputational harm, the majority cited a May 13, 2026 Wall Street Journal report of investment offers valuing Anthropic at more than $900 billion. On urgency, it cited a February 28, 2026 Wall Street Journal report that the United States began offensive military operations in Iran two days after Anthropic's refusal, "reportedly using Claude in connection with its strikes." On the First Amendment, it relied on the timeline — the Department's inclusion of Anthropic in a $200 million AI contract in July 2025 and continued negotiation after Amodei's January 2026 article calling for "limits" and "safeguards" on AI-powered weapons — and concluded that "[t]he nub of this dispute was contractual." Footnote 1 rejected Anthropic's argument that the Northern District's judgment is preclusive, citing the different statutory issues and the D.C. Circuit's exclusive jurisdiction over § 4713 actions (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

Kelly P. Dunbar argued for Anthropic and Sharon Swingle of the Department of Justice for the government. Amici supporting Anthropic included the ACLU and the Center for Democracy and Technology, the Foundation for American Innovation, former Secretary of Defense Leon Panetta and the Institute for Security and Technology, former senior national security officials, former service secretaries and retired senior military officers, 149 former judges, employees of OpenAI and Google in their personal capacities, industry trade associations, and Professor Alan Rozenshtein; one amicus brief, by Joel Thayer of the America First Policy Institute, supported the government (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

The opinion closes: "in our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks. In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution." Judge Henderson's dissent argued that "manipulate" in § 4713(k)(6) should be read, under the noscitur a sociis and ejusdem generis canons, as limited to "intentionally subversive and deceptive acts" like the terms that precede it, a reading under which Anthropic would fall outside the definition. She added a series-qualifier argument carrying "maliciously" forward to "extract data," relied on the Senate report on the Act as directed at "[h]ostile nation state and other bad actors," and wrote that under the majority's reading a contractor's "honest and upfront enforcement of restrictions on a covered article's use disfavored by the government" suffices for designation, so that a replacement vendor would face the choice to "[a]gree to the Secretary's demands or risk being designated a national security threat" (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)).

The panel delayed the decision from taking immediate effect to give Anthropic time to seek rehearing by the panel or rehearing en banc; Anthropic could also petition the Supreme Court. An Anthropic spokesperson said the company "respectfully disagree[s] with the court's decision," that "[a]nother federal court has already held the government's parallel designation unlawful," and that it is "considering all options, including further review." CNBC noted that Katsas and Rao were appointed by President Trump and Henderson by President George H.W. Bush (Source: cnbc.com; insideaipolicy.com).

Current status

Following the August 27, 2026 judgment, the supply-chain-risk designation is vacated and the challenged actions are permanently enjoined, subject to the order's stated limits and to any appeal. Information Technology Industry Council president and chief executive Jason Oxman said the ruling "removes uncertainty for businesses across industry seeking to partner with the U.S. government"; the Pentagon did not return a request for comment (Source: nextgov.com). The government's remaining wins are the ultra vires count and the § 558 count as to five agencies. The question of whether the D.C. Circuit petition survived the vacatur was resolved on September 25, 2026: the D.C. Circuit treated the § 4713 exclusion as a separate action outside the district court's judgment and upheld it 2–1, leaving Anthropic with a district-court win on the § 3252 designation and an appellate loss on the § 4713 exclusion. The appellate decision's effect was delayed pending any rehearing petition (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026); Source: cnbc.com).

The paragraphs below describe the position that obtained between April and August 2026, while the preliminary injunction and the D.C. Circuit denial of stay ran in parallel. The split rulings left Anthropic excluded from DOD contracts while the D.C. Circuit petition was pending, while Judge Lin's N.D. Cal. preliminary injunction barred enforcement of the Trump directive against the rest of the federal government, allowing Anthropic to continue serving non-DOD agencies during the litigation.

The D.C. Circuit oral argument came the same week the White House was independently nearing a deal to make a version of Anthropic's Mythos model available to the NSA and other U.S. intelligence agencies (The Information, May 25, 2026), and the same week the White House approved a secret $9 billion request to buy frontier AI chips for intelligence-community classified networks (NYT, May 22, 2026). The executive branch was thus expanding Anthropic procurement on the civilian-IC side while the Department of War maintained the supply-chain-risk exclusion (Source: theinformation.com; nytimes.com).

Released correspondence (July 2026)

Newly released court documents in the litigation, published July 2, 2026, revealed months of back-and-forth between CEO Dario Amodei and Undersecretary of Defense for Research and Engineering Emil Michael over safety guardrails for the Pentagon's use of AI — tensions that persisted even as Anthropic resolved its separate export-control dispute with the administration on June 30, 2026 (Source: wsj.com).

A remark by Judge Rita Lin suggesting that federal agencies' own use of Anthropic's cyber-focused Mythos model could undercut the government's position became public on July 31, 2026 (Source: insideaipolicy.com). The argument the remark bears on is the supply-chain risk designation the Department of Defense issued on March 5, 2026, asserting that Anthropic's products could be used to sabotage U.S. operations, which prompted Anthropic's March 9 suit. The date and setting of the remark itself, and whether it came from the bench or in a written order, are not established by the available reporting, whose body sits behind a subscriber wall.

Anthropic's use restrictions and the autonomous-weapons question

The Verge (May 26, 2026) reported two developments in Anthropic's stated position. Anthropic reaffirmed two "red lines": bans on domestic mass surveillance and on weapons that identify, track, and kill targets with zero human involvement. The relationship with DOD has reportedly warmed since the Mythos release on the cybersecurity side, but Anthropic describes the autonomous-weapons and mass-surveillance prohibitions as non-negotiable.

Separately, Dario Amodei has written that "fully autonomous weapons … may prove critical for our national defense" and offered to "work directly with the Department of War on R&D to improve the reliability of these systems." Tech Justice Law's Maddy Batt called the language "fundamentally in tension" with international humanitarian law. The company's stated commercial-product red line and Amodei's R&D offer to the Department of War operate on different premises (Source: theverge.com).

The FY27 NDAA Chairman's mark, released the same day (FY27 National Defense Authorization Act (Chairman's Mark)), updates the rules governing autonomous weapons, setting up a collision between the legislative vehicle and Anthropic's stated red line at the June 4 markup (Source: theverge.com).

The same Verge investigation notes that eight companies — Google, Microsoft, AWS, Nvidia, OpenAI, Reflection, Oracle, and SpaceX — have signed deals to deploy AI on classified networks. Anthropic's autonomous-weapons and mass-surveillance red lines are a commercial cost it is absorbing while those eight competitors take classified-network business without comparable public restrictions (Source: theverge.com).

Precedent and commentary

Judge Lin's March 26 ruling is the first federal-court ruling that the U.S. government cannot retaliate against an AI vendor for publicly stated use restrictions. The ruling treats supply-chain-risk designations as reviewable and as enjoinable where retaliation intent is present. The April 8 D.C. Circuit denial of stay shows the dual-track posture is not stable: parallel exclusions of the same vendor on the same facts can be held retaliatory in one court and upheld as a defensible national-security determination in another. The September 25, 2026 D.C. Circuit opinion shows that the two tracks concern separate designations under different statutes — 10 U.S.C. § 3252 in the district court and 41 U.S.C. § 4713 in the D.C. Circuit — whose definitions of supply chain risk the D.C. Circuit read differently (Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026); Federal Acquisition Supply Chain Security Act of 2018 (FASCSA)). Observers have noted downstream implications for Anthropic, OpenAI, and any frontier lab whose use policy may conflict with future U.S. government requests, and the case bears on whether lab-level AI governance functions as a constraint on U.S. military and intelligence use.

Note on confidence

The August 27, 2026 opinion and order of final relief have been retrieved and read in full (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026), Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)), which establishes the court, case number, parties, undisputed facts and disposition directly: N.D. Cal., No. 3:26-cv-01996-RFL, before Judge Rita F. Lin, with the U.S. Department of War as lead defendant. The primary complaint and the March 26, 2026 preliminary-injunction order text have still not been retrieved, and the account of the preliminary-injunction stage above remains triangulated from multi-source reporting (CBS, Axios, NBC, Reuters, Breaking Defense, Military Times, TechPolicy.Press, TIME, NYU Stern) except where the summary-judgment opinion describes it.

A date discrepancy carried on this page since the preliminary-injunction stage is now resolved from the primary record. Earlier subscription reporting placed the supply-chain-risk designation on March 5, 2026. The designation was in fact effected by a March 3 determination and a March 4 letter, both preceded by the February 27 directives; March 5 is the date of a separate memorandum from the Department's Chief Information Officer instructing components to remove Anthropic products within 180 days. The filing date of March 9, 2026 is confirmed by the opinion.

The defendant is named in the caption as the U.S. Department of War. The opinion notes that the parties use that name for the Department of Defense throughout, citing the tension between the National Security Act Amendments of 1949 and Executive Order 14347, 90 Fed. Reg. 43893 (Sep. 5, 2025), and adopts the parties' phrasing.

Open questions

• Whether the government has appealed the August 27, 2026 judgment. The court denied its request for a seven-day administrative stay of the permanent injunction.
• Whether Anthropic seeks panel or en banc rehearing of the D.C. Circuit's September 25, 2026 decision in Nos. 26-1049 and 26-1162, or petitions the Supreme Court. The Ninth Circuit appeal of the preliminary injunction, No. 26-2011, was stayed pending the D.C. Circuit ruling; what becomes of it now that the ruling has issued is not established.
• How the Department's § 4713 exclusion, upheld by the D.C. Circuit, operates alongside the district court's permanent injunction against implementing the Hegseth Directive and the vacated § 3252 designation.
• What the Department does on remand. The Supply Chain Designation was vacated, set aside and remanded, and the order does not require the Department to use Anthropic's products.
• The date, setting and exact wording of the July 31, 2026 remark by Judge Lin on agency use of Mythos, which reached the record only through a subscription lede.

Source summary

Full context: Anthropic Claude Gov + Pentagon Dispute (2025–2026) (sources/).

Relationships

• supports: Autonomous Weapons, ICRC Position on Autonomous Weapon Systems (source summary), AI Whistleblowing, AI and the First Amendment.
• contradicts: Trump Feb 27 directive + Hegseth supply-chain-risk designation.
• depends-on: Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026), Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026), Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026), Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), Anthropic, Dario Amodei, Pete Hegseth, Emil Michael, DoD Directive 3000.09 — Autonomy in Weapon Systems (source summary).
• instance-of: Government AI Procurement.
• related: Gregory Katsas, Neomi Rao, Karen LeCraft Henderson (D.C. Circuit panel), Palantir Technologies.
• related: Anthropic Claude Gov + Pentagon Dispute (2025–2026), Clawed (Dean Ball analysis), (Source: nytimes.com), GSA OneGov Program and USAi Platform (August 2025), DOD — Department of Defense (AI Deployer), Defense / Military — AI Deployment.