Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026)

This is the opinion of the United States Court of Appeals for the District of Columbia Circuit in Anthropic PBC v. United States Department of War, No. 26-1049, consolidated with No. 26-1162, decided September 25, 2026 after argument on May 19, 2026. The panel of Circuit Judges Karen LeCraft Henderson, Gregory Katsas and Neomi Rao denied Anthropic's petitions for review of the Department of War's decision to exclude Claude from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. § 4713). Judge Katsas wrote for the court; Judge Henderson dissented. The majority opinion runs to 43 slip pages and the dissent to 8 separately numbered pages. Page references below are to the slip opinion.

The petitions challenged a different instrument from the one vacated by the Northern District of California in Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026): that court reviewed a designation under 10 U.S.C. § 3252, while § 4713 actions are reviewable only in the D.C. Circuit. The case is tracked at Anthropic v. United States (Pentagon ban challenge).

Parties, counsel and amici

The respondents were the Department of War and Secretary of War Peter B. Hegseth in his official capacity. Kelly P. Dunbar argued for Anthropic, with Joshua A. Geltzer, Kevin M. Lamb, Anneke Dunbar-Gronke and Megan O. Gardner on the briefs. Sharon Swingle of the Department of Justice argued for the respondents, with Assistant Attorney General Brett A. Shumate, Deputy Assistant Attorney General Eric D. McArthur, and Sean R. Janda and Brian J. Springer on the briefs (slip op. 1–3).

Amicus briefs in support of Anthropic were filed by the Foundation for American Innovation and others; the Taxpayers Protection Alliance Foundation; Catholic Moral Theologians and Ethicists; Former Senior National Security Government Officials (counsel including Harold Hongju Koh); Employees of OpenAI and Google in their personal capacities; the American Civil Liberties Union and the Center for Democracy and Technology (Samir Jain, Ashley Gorski and Patrick Toomey on the brief); the Association for Competitive Technology; former Secretary of Defense Leon Panetta and the Institute for Security and Technology; 149 Former Judges and the Democracy Defenders Fund; the Foundation for Individual Rights and Expression and others; the Faith Family Technology Network; Industry Trade Associations; Professor Alan Z. Rozenshtein; Former Service Secretaries and Retired Senior Military Officers; and the Freedom Economy Business Association and Values-Led Investors. A single amicus brief supported the respondents, filed on behalf of Joel Thayer, Senior Fellow at the America First Policy Institute (slip op. 1–3).

Statutory framework

The Act authorizes "covered procurement action[s]" to prevent agencies from using information technologies that pose a risk to national security, including barring agency contracts with a supplier and subcontracts that use it (41 U.S.C. § 4713(a), (k)(4)). Before acting, the agency head must make a written determination that use of the authority "is necessary to protect national security by reducing supply chain risk" and that "less intrusive measures are not reasonably available," specifying the class of actions covered (§ 4713(b)(3)). The supplier must receive notice and an opportunity to respond first, unless the agency head determines that "an urgent national security interest requires the immediate exercise of the authority," in which case notice follows "as soon as practicable" (§ 4713(b)(2), (c)). "Supply chain risk" is defined as "the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement" of covered articles "so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of" them or information on them (§ 4713(k)(6)). Review lies in the D.C. Circuit on a petition filed within 60 days of notice, and other judicial review of any "action taken under" § 4713 is barred (41 U.S.C. § 1327(a), (b)(1)) (slip op. 5–6).

Facts as recounted by the majority

Anthropic's three kinds of restriction

The court described three layers by which Anthropic restricts Claude (slip op. 6–8). First, it embeds safety considerations in the model: Claude is disabled from tasks such as making biological, chemical, nuclear or radiological weapons, and is trained to a constitution that, in the words of co-founder and Chief Science Officer Jared Kaplan, makes it follow "a set of normative principles, like balancing helpfulness against harm avoidance, and respecting values such as individual privacy and political freedom." CEO Dario Amodei is quoted describing training that gives Claude an "identity, character, values, and personality." Second, Anthropic stacks "technical measures" on top of the model, including monitoring and targeted interventions, a "second line of defense" begun around mid-2025 because "all models can be jailbroken." Third, it contractually prohibits uses; the Usage Policy imposed on Palantir Technologies, which analyzes data for the Department, prohibits among other things using Claude to compromise children's safety, incite violence, invade privacy, spread misinformation, interfere in elections, or monitor individuals' physical locations.

The relationship with the Department

In 2024 the Department and the intelligence community began using commercially available Claude models on classified systems through contractors, and Claude refused tasks "appropriate in a national security context—such as summarizing threat assessments, processing classified documents, or translating intercepted materials describing violence." Anthropic responded with a "Claude Gov" model, which the opinion states was released in March 2025, and a "government-specific addendum" to its Usage Policy. Over time Anthropic came to permit use of Claude to design more effective weapon systems, analyze foreign intelligence and conduct offensive cyber operations, while retaining prohibitions on "lethal autonomous warfare" and "mass surveillance of Americans." The opinion records that Anthropic released three new versions of Claude Gov in 2025 (slip op. 8–9, 22).

In fall 2025 the parties negotiated a direct contract; the Department asked for permission to deploy Claude for "all lawful uses," and Anthropic agreed to substantially relax prior restrictions while insisting on the two exceptions. On January 9, 2026 Secretary Hegseth issued the Department's AI strategy (Artificial Intelligence Strategy for the Department of War (Hegseth memorandum, 2026)), which stated that the Department must use models "free from usage policy constraints that may limit lawful military applications" and directed incorporation of "any lawful use" language into AI contracts (slip op. 9–10).

Around the same time an Anthropic executive "questioned the propriety" of a contractor's use of Claude "for a sensitive military operation abroad." The Department states the governing usage policy "clearly permitted" the use, and the question "led to alarm by the DoW and the prime contractor who provides Anthropic software." The Department did not identify the operation; Anthropic put into the record media reports that it had raised concerns with Palantir about its technology's role in the January 3, 2026 operation to capture Venezuelan president Nicolás Maduro. The Department also learned that Claude had refused queries from the Centers for Disease Control and Prevention on research into preventing the spread of infectious disease (slip op. 10).

On February 24, 2026 Amodei met Hegseth, who praised Claude's capabilities but demanded acceptance of an "all lawful uses" term by February 27. On February 26 Anthropic refused; Amodei's statement called mass domestic surveillance "incompatible with democratic values" and said fully autonomous weapons "may prove critical for our national defense" but that current AI was not "reliable enough" to power them, while recognizing "the Department's prerogative to select contractors most aligned with their vision" and pledging a "smooth transition to another provider." On February 27 President Trump and Secretary Hegseth denounced the decision on social media (slip op. 10–11).

The determination and its aftermath

On March 3, 2026 Hegseth made a formal determination under the Act that use of Claude "presents a significant supply chain risk," that removal was "necessary to protect national security," that no "less intrusive measures" were "reasonably available," and that an "urgent national security interest" required immediate action. It rested on a recommendation from senior officials, which rested on a memorandum by Under Secretary for Research and Engineering Emil Michael citing Anthropic's refusal to allow all lawful uses, its ability to "alter system guardrails and model weights," and its questioning of a sensitive military mission abroad. A notice letter dated March 3 was emailed on March 4, effective immediately, with 30 days to seek reconsideration. On March 6, according to the opinion, the Department's Chief Information Officer ordered removal of Anthropic products "as soon as practical" and within 180 days and barred contractors from using them in Department work; the Department moved to expand its relationship with OpenAI, and Amodei wrote to employees that the Department, OpenAI and Palantir had not established adequate safety protocols for AI use (slip op. 11–12).

Anthropic petitioned on March 9. A March 19 supplemental notice supplied the determination, the recommendation, the Michael memorandum and the scope of the actions, restarting the 30-day response period. On April 8 the court denied a stay but expedited the case (2026 WL 1042493 (per curiam)), ordering briefing on jurisdiction and on how Anthropic could affect its models before or after delivery. Anthropic asked the Department on April 17 to rescind the exclusion. On June 3 the Secretary denied reconsideration, clarifying that his determination did not rest on the premise that Anthropic could control any version of Claude after delivery for deployment on classified systems. Anthropic petitioned again on June 17 (No. 26-1162), and the cases were consolidated on June 24 (slip op. 12–13, 15).

Holdings and reasoning

Jurisdiction (Part III)

The court held that the March 9 petition properly invoked jurisdiction because the determination and the covered procurement actions took effect together: the notice said the determination was "effective immediately," and within three days the Department ordered Claude removed. It did not decide whether Anthropic's April 17 rescission request made the first petition "incurably premature," because jurisdiction exists over at least one of the two petitions either way (slip op. 14–15).

Standard of review

Review is for whether the actions were "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law" (41 U.S.C. § 1327(b)(2)), tracking the APA. Legal questions are reviewed de novo under Loper Bright, but the court stated that in construing national-security statutes "we resolve ambiguities against intruding on the national-security determinations of the Executive Branch," and that factual national-security assessments receive greater deference even where constitutional claims are raised, citing Trump v. Hawaii and Holder v. Humanitarian Law Project (slip op. 16–17).

Supply chain risk (Part IV.A)

The court held that the Secretary reasonably concluded exclusion was necessary to reduce supply chain risk. It found it "undisputed that Anthropic can and does control how Claude responds—or fails to respond—to user prompts," quoting Anthropic's head of public-sector business that "[m]odel training is the primary mechanism through which Anthropic can influence the behavior of models used by the Department." Anthropic disclaims any ability to access or alter a delivered model, but may encode additional restrictions in each "new version of the model." The CDC refusals and the early classified-use refusals showed that "Anthropic's model training does effectively enforce contractual usage restrictions," whether or not the restrictions were themselves arbitrary. It quoted Michael's account of the overseas-operation incident, which Anthropic characterized as a misunderstanding, and concluded that "[w]ith such diametrically opposed positions and with contractual limitations that are hardly self-defining, the prospect for disputes is apparent" (slip op. 17–20).

On Anthropic's factual response that the Department could test each new model before approving it and keep using an older model that "does not degrade or change on its own," the court held that testing is no "panacea": the contested restrictions are not self-defining; Claude's technology is "opaque," and Department record material states that its models "have weights or parameters that number approximately 5 to 10 trillion per model," making "rigorous analysis or auditing of its output mathematically impossible"; Anthropic acknowledged "some legitimacy to DoW's concern about the opacity of these systems generally"; and Claude may respond differently to differently worded requests. Declining upgrades was not a satisfactory option given the pace of model releases: "Quite obviously, the Department cannot utilize AI systems that remain trapped in amber." The court accepted that Michael's memorandum erred in one sentence suggesting Anthropic could disable delivered technology mid-operation, but held that its "basic thrust" survived and that the June 3 order confirmed the determination "did not depend" on post-deployment control (slip op. 20–23).

On the statutory question, the court held that "manipulate" in § 4713(k)(6) carries its ordinary meaning, "[t]o move, arrange, operate, or control," and that "there is not only a 'risk'—but a certainty—that Anthropic will so manipulate the 'design' or 'operation' of Claude to deny it the 'function' of conducting lethal autonomous warfare or mass domestic surveillance." It rejected the reading, advanced briefly by Anthropic and at length by the dissent, that the definition requires bad motive. The first verb string does not uniformly connote malice (only "sabotage" does, and "introduce" only as modified by "maliciously"), and the verbs take different objects rather than forming a tight parallel list, so the associated-words and ejusdem generis canons do not apply; the series-qualifier canon does not carry "maliciously," which sits mid-list, forward to "extract"; and the second string ("surveil, deny, disrupt, or otherwise manipulate") is dominated by neutral or ambiguous verbs. The statute is concerned with the effect on "function, use, or operation," not intent. "We have no reason to doubt that Anthropic manipulates Claude's function, use and operation with noble intentions ... But at least as applied here, the statutory definition of a 'supply chain risk' turns on what Anthropic does, not why Anthropic does it" (slip op. 23–28).

Broader context reinforced that reading: § 4713 imposes no criminal or civil liability, Anthropic did not challenge the Department's "fundamental prerogative" to choose contractors, and national-security procurement statutes are construed in the government's favor. The court distinguished Fischer v. United States (2024), whose narrowing construction had tracked Judge Katsas's own dissent below, on the grounds that the canons' predicates were met there, a broad reading there would have produced "massive surplusage" and reached protected advocacy, and that case was criminal. It also rejected an implied requirement of surreptitious action and Anthropic's reliance on legislative history pointing to foreign companies, since the definition covers "any person" (slip op. 28–31).

Relation to the Northern District of California ruling

The majority distinguished the August 27, 2026 judgment setting aside the § 3252 designation. Section 3252(d)(4) defines supply chain risk as the risk that "an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert" a covered system. The court stated: "We have no quarrel with the Northern District's conclusion that use of the critical noun adversary, combined with the sinister connotation fairly pervading the string ... indicate that bad motive is required to support a designation under section 3252," nor with its conclusion that Anthropic acted with no such motive, "[b]ut ... no such bad motive is required to support a designation under the much broader definition set forth in section 4713." Footnote 1 rejects Anthropic's argument that the district court's decision is preclusive: the issues differ, the Northern District's arbitrariness and exigency determinations under § 3252 do not control review under § 4713, and Congress's grant of exclusive jurisdiction to the D.C. Circuit makes it inappropriate to constrain review by another court's judgment, citing Restatement (Second) of Judgments § 28 (slip op. 30–31).

Less intrusive measures (Part IV.B)

The court upheld the finding that less intrusive measures were not reasonably available. Anthropic "all but acknowledges" the concerns would justify terminating its subcontracts, and objected mainly that § 4713 "brand[ed]" it a national-security threat. The court wrote that "[o]ne may fairly question whether Anthropic has suffered any such harm," citing a May 13, 2026 Wall Street Journal report of investment offers valuing it at more than $900 billion, and that Anthropic had not explained why conventional contract termination on the same stated grounds would carry less stigma. Its one-sentence suggestion to narrow the restriction to systems involving lethal autonomous warfare or domestic mass surveillance was not preserved, and in any event overlooked that a model "layered into other applications" can "limit the functionality of that larger system" (slip op. 32–33).

Urgency and advance notice (Part IV.C)

Assuming the urgency finding was reviewable and wrong, the court held any error harmless. It applied the prejudicial-error rule as a background principle of judicial review, citing its application in foreign-terrorist-organization review under AEDPA in Chai v. Department of State (2006). By March 19 Anthropic had notice and the underlying materials and made a full submission, which did not persuade the Secretary in June; the only new information, that Anthropic cannot monitor models on classified systems, did not bear on the rationale as clarified. The court rejected Anthropic's arguments that the "shall hold unlawful" language forecloses harmless-error review, that "psychological and bureaucratic realities" had locked the Department in, and that harmless-error review would nullify the advance-notice requirement; a party could still seek interim relief immediately after a suspect urgency determination by showing it could "mount a credible challenge," but "[w]hen a petitioner has already mounted a failed challenge—as in this case—it can no longer show prejudice" (slip op. 33–38).

Due process (Part V.A)

Assuming a protected liberty or property interest, the court held post-deprivation process sufficient where the government "must act quickly." It relied on agreement that AI is evolving at "unprecedented velocity," on Amodei's own statements about AI's military significance, on Anthropic's definitive rejection of the Department's terms after a controversy over an overseas operation, and on reporting that two days later the United States began offensive operations in Iran, reportedly using Claude, citing a February 28, 2026 Wall Street Journal report. It rejected arguments that a year of prior deployment and the 180-day phase-out showed no urgency, the latter being an outer bound reflecting the difficulty of removing the technology "in the midst of active operations" (slip op. 38–41).

First Amendment (Part V.B)

The court held that Anthropic satisfied the first two elements of retaliation, since "[t]he First Amendment squarely protects Anthropic's advocacy regarding the safe and appropriate use of AI products" and exclusion is materially adverse, but failed causation: the Department acted "because Anthropic refused to agree to a contract term the Department deemed essential to national security." It relied on the timeline, including the Department's inclusion of Anthropic in a $200 million AI contract in July 2025 and continued negotiation after Amodei's January 2026 article calling for "limits" and "safeguards" on AI-powered weapons. It acknowledged the "pungent statements" in Hegseth's February 27 post ("sanctimonious rhetoric," "virtue-signaling," "Silicon Valley ideology") but read the post as addressing Anthropic's refusal of "full, unrestricted access ... for every lawful purpose" and its asserted "veto power over the operational decisions of the United States military." "The nub of this dispute was contractual" (slip op. 41–43).

Conclusion (Part VI)

The court wrote that the case "raises profoundly difficult questions about the appropriate military uses of an almost unimaginably powerful new technology," setting the Secretary's concern about "overly constrained AI models shutting down unexpectedly" against Anthropic's concern about "unconstrained AI models hallucinating inappropriate targets for lethal military force," and concluded: "in our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks. In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution. Accordingly, we deny the petitions for review" (slip op. 43).

Dissent (Henderson, J.)

Judge Henderson would have held that Anthropic falls outside the statutory definition. She wrote that whether the Secretary lawfully invoked the Act "turns on whether Anthropic falls within the statute's definition of a 'supply chain risk,'" that the majority does not dispute the question turns on the residual clause "or otherwise manipulate," and that "the context decidedly favors the narrower reading" under which the word means "[t]o manage, control, or influence in a subtle, devious, or underhand manner" (dissent 1–3).

Applying noscitur a sociis, she read "sabotage" and "maliciously introduce unwanted function [and] extract data" as connoting intentionally subversive acts, and the second string ("surveil, deny, disrupt") as directed in context at deliberately impeding or eavesdropping on a covered article. She argued that the series-qualifier canon carries "maliciously" to "extract data," illustrating with a hypothetical library rule, "Do not shout, loudly talk on the phone, play music, or otherwise disturb others," and quoted Judge Katsas's own Fischer dissent on reading words in context. Under ejusdem generis and the anti-surplusage canon, she wrote that the neutral definition "renders an unnerving amount" of the definition's "motive-infused language 'mere surplusage'" (dissent 2–7).

She described the consequences of the majority's reading: a contractor becomes a supply chain risk if it is "willing and able to enforce contractual restrictions" the Department deems too restrictive, even restrictions the Department previously accepted, enforced on a good-faith and legally correct interpretation, and possibly even where the restrictions prevent unlawful uses; a replacement vendor told to permit any functions the Department deems necessary would face the choice to "[a]gree to the Secretary's demands or risk being designated a national security threat." Drawing on the Senate report on the Act (S. Rep. No. 115-408), 2018 testimony by FBI Director Christopher Wray about companies "beholden to foreign governments," and a 2018 U.S.-China Economic and Security Review Commission report, she concluded that the legislative history supports Anthropic's reading and refutes the view that manipulation covers "a contractor's honest and upfront enforcement of restrictions on a covered article's use disfavored by the government" (dissent 7–8).

The dissent's text as captured cites the provision as "10 U.S.C. § 4713(k)(6)" and in places as sections "4173(k)(6)" and "4716(k)(6)"; the majority and the statute cite 41 U.S.C. § 4713.

Key claims

Discrepancies with the Northern District of California record

• The Chief Information Officer's removal memorandum is dated March 6, 2026 in this opinion and March 5 in the district court's summary-judgment opinion (Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026)).
• Both courts describe a March 3 determination and a notice transmitted March 4, but the district court describes the instrument it reviewed as citing 10 U.S.C. § 3252, while this opinion describes the March 3 determination as made under the Supply Chain Security Act (41 U.S.C. § 4713).
• The courts reach opposite conclusions on causation for First Amendment retaliation and on the adequacy of post-deprivation process, each with respect to the instrument before it; this opinion does not address the district court's First Amendment or due-process holdings, and addresses its § 3252 holdings only as described above.
• This opinion gives the Claude Gov release as March 2025; other accounts, including Anthropic Claude Gov + Pentagon Dispute (2025–2026), date the Claude Gov launch to June 6, 2025.

Provenance

Text extracted from the court's own PDF (media.cadc.uscourts.gov), whose SHA-1 matches the file CourtListener records; also available at courtlistener.com. Contemporaneous reporting that the panel delayed the decision's effect to allow Anthropic to seek rehearing, and Anthropic's response, is not part of the opinion text and is recorded on Anthropic v. United States (Pentagon ban challenge).

Relationships

• instance-of: Anthropic v. United States (Pentagon ban challenge)
• depends-on: Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), Artificial Intelligence Strategy for the Department of War (Hegseth memorandum, 2026)
• contradicts: Anthropic PBC v. U.S. Department of War — Order on Cross Motions for Summary Judgment (N.D. Cal., August 27, 2026) — on First Amendment causation and on the need for pre-deprivation process, as applied to a parallel exclusion under a different statute; agrees with it on the reading of 10 U.S.C. § 3252
• supports: Government AI Procurement, Procurement-Driven AI Governance
• related: AI and the First Amendment, Autonomous Weapons, DOD — Department of Defense (AI Deployer), Anthropic, Palantir Technologies, OpenAI, Pete Hegseth, Emil Michael, Dario Amodei, Jared Kaplan, Gregory Katsas, Neomi Rao, Karen LeCraft Henderson, Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)