This is the reasoned opinion in Anthropic PBC v. U.S. Department of War, No. 3:26-cv-01996-RFL, entered by United States District Judge Rita F. Lin in the Northern District of California on August 27, 2026 as docket entry 250. It runs to 59 pages and disposes of the parties' cross-motions for summary judgment on all five counts, together with a motion to consider evidence outside the administrative record. A separate four-page order entered the same day sets out the remedies (Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026)).
The case arises from three measures the opinion collectively calls the Challenged Actions: a February 27, 2026 statement by President Trump on Truth Social (the "Presidential Directive") ordering every federal agency to cease using Anthropic's technology; a post by Secretary of War Pete Hegseth on X about an hour later (the "Hegseth Directive") directing the Department of War to designate Anthropic a supply-chain risk and barring any military contractor, supplier or partner from doing commercial business with the company; and the formal designation effected by a March 3 determination and a March 4 letter citing 10 U.S.C. § 3252 (the "Supply Chain Designation"). Anthropic filed suit on March 9, 2026 and obtained a preliminary injunction on March 26, reported at 825 F. Supp. 3d 1101 (N.D. Cal. 2026).
The opinion adopts the parties' usage in calling the Department of Defense the "Department of War," noting the tension between the National Security Act Amendments of 1949 and Executive Order 14347, 90 Fed. Reg. 43893 (Sep. 5, 2025).
The administrative record and what the government abandoned
The opinion's central factual finding concerns the thinness of the record the government produced. It states that "[t]he record is slim" and that "[a] four-page memorandum, which post dates two of the three challenged actions, provides the entirety of the government's rationale." That memorandum, dated March 2, 2026, was written by Under Secretary of War for Research and Engineering Emil Michael — the same official then conducting the contract negotiations with Anthropic.
The Michael Memo asserted that AI models "are acutely vulnerable to manipulation," that Anthropic could "attempt to disable" or "alter the behavior of the model . . . in the middle of ongoing warfighting operations," that Claude could "degrade as new data is introduced," and that the Department "would be forced to operate a black box controlled by a hostile party, which could contain hidden biases or backdoors."
By the summary-judgment stage the government had, in the court's words, "backed away from the thrust of their risk assessment, which relied on Anthropic having backdoor access to its technology once deployed in a national security system." The opinion records as undisputed that Anthropic lacks any such access and that, "as Defendants concede, Anthropic's technology is itself no riskier to the national security than any other 'black box' artificial intelligence model." The technical basis is unrebutted evidence from Anthropic's Chief Science Officer and its Head of Public Sector, Thiyagu Ramasamy: deployed models are static and "cannot degrade or change on [their] own"; once deployed Anthropic cannot "access, alter, [or] shut down" the model; Claude models cannot be updated like conventional software but must be wholly replaced by a newly trained model, after testing and approval by the Department; and Anthropic cannot view the Department's prompts.
What remained, the opinion says, was a single factor: "trust." The government's position was that because of Anthropic's "increasingly hostile manner through the press" and its criticism of the Department's views on AI use, it "cannot trust Anthropic to ensure the integrity of its models." The introduction answers that directly — "Neither the Constitution nor the federal statute invoked by Defendants allows them to impose sweeping penalties based principally on Anthropic's critique of the Administration's views" — and closes: "The empty invocation of national security is not a blank check to punish and retaliate against government critics."
The prior relationship
The opinion records an undisputed history that runs against the designation. U.S. intelligence and defense agencies had used Claude since 2024, and the Department of War had used Claude Gov through partner platforms since March 2025. After an 18-month vetting process the Defense Counterintelligence and Security Agency granted Anthropic Top Secret facility security clearance. In June 2025 the General Services Administration and the Department granted Claude FedRAMP authorization for FedRAMP High and DoD Impact Level 4 and 5 workloads. In July 2025 the Department's Chief Digital and Artificial Intelligence Office awarded Anthropic a two-year agreement worth up to $200 million, and in August 2025 Anthropic and GSA announced an agreement to deliver Claude Gov across the civilian executive, legislative and judicial branches. The administrative record reflects that before March 2, 2026 the Department "did not identify any potential supply chain risk posed by Anthropic," and that outside the usage-restriction negotiations Anthropic "only ever received positive feedback about Claude's performance from [its] governmental customers."
The government relied repeatedly on a 2025 incident in which the Centers for Disease Control and Prevention, using a general commercial Claude model rather than a tailored Claude Gov model, had some prompts refused. The opinion records that nothing indicates the CDC believed the limitations were introduced maliciously or negligently, or that it was dissatisfied with the resolution.
The contract dispute
In fall 2025 the Department told Anthropic it must remove all usage restrictions on Claude for the GenAI.mil deployment and accept a clause permitting use "for all lawful uses." Anthropic agreed to drop most restrictions but refused on two: lethal autonomous warfare and mass surveillance of Americans. Between December 4, 2025 and March 4, 2026, Dario Amodei and Under Secretary Michael exchanged emails trading draft contract language. Amodei wrote that "AI fundamentally changes what is possible with surveillance on Americans in ways that existing law was not written to address," and in a January 15, 2026 email framed the proposals "with tremendous respect and deference for the D[oW]'s expertise in this domain," adding that they arose "from our understanding of how these particular models behave — their capabilities, edge cases, and failure modes — not second-guessing the D[oW]'s expertise in conducting its operations." Anthropic's position was that "[s]evering Claude from the usage limitations we have determined are essential would erode the very purpose for which our company was founded." Amodei repeatedly offered to help offboard Claude if the Department concluded Anthropic was not the right vendor.
A January 9, 2026 Hegseth memorandum, Artificial Intelligence Strategy for the Department of War, contained a subsection titled "Clarifying 'Responsible AI' at the DoW — Out with Utopian Idealism, In with Hard-Nosed Realism," instructing that the "any lawful use" provision be incorporated into any Department contract procuring AI services.
At a February 24, 2026 meeting attended by Amodei, Anthropic Head of Policy Sarah Heck and Secretary Hegseth, the Secretary said Claude had "exquisite capabilities" and that Anthropic's concerns were "understandable," but that the Department "had many other vendors to choose from that have never raised" those concerns and who "would never hold any veto power over" it. The opinion records that Hegseth said nothing about Anthropic's models being unsafe, insecure or subject to compromise. He gave Anthropic until 5:00 p.m. on February 27 to accept "all lawful uses," failing which the Department would designate it a supply chain risk — or, alternatively, might invoke the Defense Production Act to designate Anthropic as essential to national security and compel its services without the restrictions. On February 26 Amodei issued a public statement saying Anthropic "cannot in good conscience" provide the access requested, while stating that "Anthropic understands that [DoW], not private companies, makes military decisions."
First Amendment
Applying the three-part retaliation test of Ariz. Students' Ass'n v. Ariz. Bd. of Regents, the court found Anthropic's prima facie showing undisputed on each element. On protected activity, it rejected the government's contention that "no speech or expressive conduct is at issue," citing Janus for the proposition that contract negotiations may raise matters of great public concern and NRA v. Vullo for the rejection of the argument that targeting "business practices and relationships" involves only nonexpressive activity. Anthropic, the court held, "was not critiquing a 'single contract'; it was discussing the appropriate limits on the government's use of frontier AI technology."
On motive, the opinion points to the text of the actions themselves — Hegseth's "master class in arrogance," "sanctimonious rhetoric of 'effective altruism,'" "corporate virtue-signaling" and "Silicon Valley ideology"; the President's "RADICAL LEFT, WOKE COMPANY" and "Leftwing nut jobs" — and to the designation materials, which describe Anthropic having "opted to publicly spat with DoW" and cite its "increasingly hostile manner through the press" as the reason its risk level escalated. Read against the "undisputedly staid and respectful" private negotiations, the court reads "strong-arm" in both directives as characterizing public pressure rather than coercion.
The government failed to carry its rebuttal burden under Hartman v. Moore and CarePartners — that it would have acted the same absent the speech. The court notes the government's own contemporaneous filing conceding a concern that Anthropic "could . . . preemptively and surreptitiously alter the behavior of the model in advance," which means acceptance of the terms on February 27 would not have averted the actions. It describes two parallel tracks in early 2026: negotiations proceeding by email through March 4 "with apparent optimism that a deal could be reached," alongside a threatened and then executed public punishment issued the day after Amodei's public post.
The court held the Pickering framework inapplicable, because the Challenged Actions were an exercise of sovereign rather than contractual power: they permanently debarred Anthropic from contracting with any federal agency and imposed a secondary boycott extending beyond the government supply chain, and "[a] public example, by definition, operates by deterring third-party behavior." Government counsel conceded at oral argument that actions outside maintaining or terminating contractual relationships fall outside Pickering. Applying the framework anyway, the court reached the same result, finding the actions far exceeded what could mitigate a hypothetical sabotage risk and that the asserted national-security interest was contradicted by the government's own conduct. It distinguished American Federation of Government Employees v. Trump, 178 F.4th 456 (9th Cir. 2026), where the challenged order had no retaliatory language and a legitimate national-security grounding.
The opinion records government counsel's answer at oral argument when asked whether terminating a contract for the sole purpose of "stop[ping] public criticism of the President" would violate the First Amendment: counsel was "reticent to offer" a yes or no or to "foreclose a potential argument." The court replied that "the argument is already foreclosed," citing Rosenblatt v. Baer. It did not reach Anthropic's content- and viewpoint-discrimination theories or its Petition Clause theory.
Due process
The court applied the Mathews v. Eldridge balancing test and found a protectible liberty interest under the stigma-plus doctrine, relying on Wisconsin v. Constantineau and on the D.C. Circuit's decision in Hesai Technology Co. v. U.S. Department of Defense, 2026 WL 2409540 (D.C. Cir. Aug. 18, 2026), which held that labeling a company a "Chinese military company" combined reputational injury with automatic contracting ineligibility. Anthropic likewise lost "the 'right to be considered for government contracts in common with all other persons'" — described in Hesai as "the prototypical example of a sufficient change in legal status."
On the process due, the court held there were no exigent circumstances justifying the bypass of pre-deprivation notice. The risk of erroneous deprivation was high because "DoW's risk assessment was based on a core misunderstanding about how Anthropic's technology works, which it could have readily dispelled." Concerns about hypothetical future models were held not exigent, since the Department controls when a future model is deployed. The court noted that compliance with § 3252's own procedures does not relieve the government of its constitutional obligations, and that the government submitted no evidence that sensitivity concerns prevented notice — "Defendants filed the entire Administrative Record on the Court's public docket." It did not reach Anthropic's property-interest theory.
The statutory holding on 10 U.S.C. § 3252
The opinion sets out the statute's origin and limits at length. Congress enacted the provision in 2010 out of concern that "the globalization of the information technology industry" left the Department vulnerable to "attacks on its systems and networks," and defined supply chain risk as "the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert" a national security system. Departmental implementing instructions issued in 2012 described the relevant risk as "sabotage or subversion" by "foreign intelligence, terrorists, or other hostile elements."
The court held that "[t]he plain text of the statute is directed at covert acts or hacks, not overt, public positions regarding contract terms," and that "[a]n IT vendor does not become a potential adversary of the United States whenever it asks probing questions or stubbornly insists on particular contracting terms, even if doing so causes DoW to doubt its trustworthiness." Permitting a designation on grounds of arrogance or distrust "would effectively gut" the statutory requirement that exclusion be necessary to reduce supply chain risk, and would "eviscerate the longstanding statutory and regulatory protections for government contractors."
Two procedural safeguards were held to have been breached. Section 3252(b)(2)(B) requires a written determination that "less intrusive measures are not reasonably available," and § 3252(b)(3)(B) requires that the congressional notifications contain "a discussion of less intrusive measures that were considered and why they were not reasonably available." The record contained only boilerplate assertions, and the six identical notices to congressional committees contained no such discussion. Separately, 48 C.F.R. § 239.7304(a) requires a joint recommendation made "on the basis of a risk assessment by the Under Secretary of Defense for Intelligence"; the assessment instead came from Under Secretary Michael, and no evidence showed the Under Secretary for Intelligence was unavailable or the regulation amended. The court rejected the government's harmless-error argument.
The court also held the Hegseth Directive's secondary boycott — "[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic" — to be final agency action in excess of statutory authority, noting that the government conceded there was no statutory basis for it and did not defend it. Evidence in the record showed several law firms had sent client alerts suggesting Department contractors "may be best served by reevaluating their relationship with Anthropic."
Arbitrary and capricious, and pretext
The designation was held arbitrary and capricious under State Farm and Department of Commerce v. New York. The court found the timing raised an inference that the record "was generated after the fact to justify the foreordained conclusion" announced on February 27: the factual basis was prepared one business day after Hegseth's instruction and the designation issued two business days later, against a multi-year working relationship in which "there was not a single documented supply chain risk concern." It distinguished Biden v. Texas, where the agency took six weeks. It found the government's justifications shifting — Michael's March 17 declaration asserted it was "reasonably likely" Anthropic would alter or shut off the Department's use of Claude during an operation, while his March 24 declaration dropped the claim and addressed only model-update risk.
The court admitted the March 4 Michael email — "I think we are very close here" — as evidence of pretext under the Lands Council bad-faith exception, describing it as "wholly inconsistent" with the determination two days earlier that Anthropic was a hostile company presenting an "unacceptable national security threat," while noting the email was not necessary to the conclusion.
Three further contemporaneous facts are recorded as inconsistent with a genuine sabotage concern: the Defense Production Act proposal days before the actions; the continued pursuit of a contract immediately afterwards; and the government's ongoing discussions with Anthropic about Mythos. On the last, the opinion records that Anthropic announced Project Glasswing on April 7, 2026, briefed senior officials across multiple agencies before releasing Mythos externally, and that on April 17 Amodei and senior White House officials had "productive and constructive" discussions about "opportunities for collaboration"; news reports indicated the Office of Management and Budget began setting up protocols for agency use of Mythos and that the National Security Agency and NASA began deploying it. "Defendants do not submit any evidence explaining why the government would seek to collaborate on these types of projects with a company believed to pose an intolerable national security risk."
Section 558 and the agency defendants
Section 558(b) of the APA bars agencies from imposing sanctions or issuing orders "except within jurisdiction delegated to the agency and as authorized by law." Because the Presidential Directive was retaliatory and taken without due process, orders implementing it were not authorized by law. The court found final agency action by Treasury, FHFA, State, GSA, OPM, NRC, DHS and Energy, plus the Department of War acting on the Hegseth Directive and the designation, rejecting the argument that these agencies were "merely engaged in internal IT housekeeping, choosing amongst optional AI models." It found the administrative record insufficient to establish final agency action by HHS, Commerce, VA, SEC and NASA. Anthropic waived any objection to the argument that 12 U.S.C. § 4617(f) bars relief against FHFA acting as conservator for Fannie Mae and Freddie Mac.
The claim the government won
The ultra vires separation-of-powers challenge failed. Citing Dalton v. Specter for the proposition that "claims simply alleging that the President has exceeded his statutory authority are not 'constitutional' claims," the court held Anthropic's passing citation of four procurement statutes and Congress's power of the purse insufficient to carry its burden of showing the President clearly exceeded "any background constitutional authority" under Sierra Club v. Trump.
Harm and chilling effects
The opinion records that before the preliminary injunction, defense contractors using Claude-integrated APIs began assessing and in many cases seeking to terminate their reliance on Anthropic; that one partner with a multi-million-dollar annual contract switched to a competing model to service a Food and Drug Administration contract; and that Anthropic "received inquiries regarding the [Challenged Actions] from over one hundred enterprise customers expressing deep fear, confusion, and doubt." Anthropic's unrebutted evidence is that if the full restrictions were allowed to stand, defense-contractor and other Department-related client revenue would fall by "50–100 percent" and its "2026 revenue by multiple billions of dollars."
Two sets of amici are quoted. Trade associations representing government contractors described "contracts terminated, partnerships frozen, workflows thrown into disarray, and amici member companies facing a compliance crisis with no clear guidance," adding that "[t]hese harms affect the entire technology industry, not just Anthropic," and expressing members' fear that they too could be targeted without any prior "findings or process." Separately, 38 employees from major AI companies argued the actions threaten to "chill open deliberation" and "professional debate" among those best positioned to understand the technology and its potential for "catastrophic misuse."
Remedy analysis
The court rejected remand without vacatur, distinguishing NCRI, PMOI and Hesai, where the D.C. Circuit found only procedural errors: here the designation violated the substance of § 3252 and the Secretary lacked any authority for the secondary boycott. It granted permanent injunctive relief in addition to vacatur under the eBay four-factor test, reasoning that vacatur alone would not remedy the First Amendment and due-process violations arising from the Presidential Directive, would not prevent agencies resuming compliance with it, and would not guard against further retaliation. It noted the government "continue[s] to defend and ha[s] declined to stipulate to enjoin the Challenged Actions." The government's request for a seven-day administrative stay of the permanent injunction was denied for want of any showing of irreparable harm after more than five months of compliance with the preliminary injunction.
Procedural posture recorded in the opinion
The government appealed the preliminary injunction but did not seek an emergency stay. That appeal, Anthropic, PBC v. United States Department of War, No. 26-2011 (9th Cir.), was filed April 2, 2026 and has been stayed at the parties' mutual request pending a ruling from the D.C. Circuit in the related matter No. 26-1049.
The opinion's caption is Order on Cross Motions for Summary Judgment; Granting Motion to Supplement the Administrative Record. In the conclusion the court grants the Motion to Consider Evidence Outside the Administrative Record (Dkt. No. 169) and denies the alternative Motion to Complete the Administrative Record as moot.
Relationships
- contradicts: Anthropic PBC v. U.S. Department of War — D.C. Circuit Opinion, Nos. 26-1049 and 26-1162 (September 25, 2026) — the D.C. Circuit's September 25, 2026 opinion on the parallel § 4713 exclusion agrees with this opinion's reading of § 3252 but reaches the opposite conclusion on First Amendment causation and on post-deprivation process for the instrument before it; it also dates the Chief Information Officer's removal memorandum March 6 rather than March 5
- supports: Anthropic v. United States (Pentagon ban challenge), AI and the First Amendment, Government AI Procurement, Autonomous Weapons.
- supersedes: the news-reported account of the March 26, 2026 preliminary-injunction stage on dates and disposition.
- depends-on: Anthropic, Pete Hegseth, Emil Michael, Dario Amodei, DOD — Department of Defense (AI Deployer).
- related: Anthropic PBC v. U.S. Department of War — Order of Final Relief (N.D. Cal., August 27, 2026), Anthropic Claude Gov + Pentagon Dispute (2025–2026), Claude Mythos 5, Defense / Military — AI Deployment.