Pentagon designates Anthropic a supply-chain risk: Red lines labeled a supply-chain risk

An announcement, then a designation

On 27 February 2026, President Donald Trump directed every federal agency to stop using Anthropic's technology. A little over an hour later, Secretary of War Pete Hegseth announced that he was directing the Department of War (the name the administration now uses for the Department of Defense) to designate Anthropic a supply-chain risk to national security. The trigger was a contract dispute. The Department wanted to use Anthropic's Claude models for all lawful purposes, and Anthropic refused to drop two contractual exceptions, for lethal autonomous warfare and for mass surveillance of Americans. Both courts that later reviewed the episode describe that sequence ( D.C. Circuit opinion in Anthropic PBC v. Department of War; district court summary judgment order).

The date needs care. On 27 February the Secretary announced an intention; the formal written determinations came on 3 March, and Anthropic received the Secretary's letter on 4 March, according to both courts. The Department acted under two separate statutes, 10 U.S.C. section 3252 and 41 U.S.C. section 4713, and that choice sent the dispute to two different courts. On 27 August 2026 a federal district court in California held the section 3252 designation unlawful and permanently enjoined the challenged actions. On 25 September 2026 a divided panel of the U.S. Court of Appeals for the D.C. Circuit upheld the section 4713 actions. Anthropic asked for rehearing on 13 October, and on 26 October the government appealed the California judgment to the Ninth Circuit. As of 27 October 2026 the outcome remains unsettled, and this report treats the event as a contested executive action that the government defends as protecting military operations and Anthropic challenges as punishment for its speech.

How Claude came to run on defense systems

In 2024 the Department and the intelligence community began using standard commercial Claude models in their classified systems, working through contractors. The D.C. Circuit records that those models refused some appropriate national-security tasks, such as summarizing threat assessments. Anthropic responded with Claude Gov, released in March 2025 for national-security users, and with a government addendum to its usage policy that allowed uses it denied private customers. Over time it permitted the Department to use Claude to analyze foreign intelligence and to conduct offensive cyber operations ( D.C. Circuit opinion).

The district court recounts that the Defense Counterintelligence and Security Agency granted Anthropic a Top Secret facility clearance after an 18-month vetting process, that Claude received FedRAMP High authorization in June 2025, and that in August 2025 Anthropic and the General Services Administration agreed to offer Claude Gov to all three branches of government ( summary judgment order). In July 2025 the Pentagon's Chief Digital and Artificial Intelligence Office awarded Anthropic a two-year prototype agreement with a ceiling of 200 million dollars ( Anthropic's announcement).

Claude's behavior is shaped in three layers, and the litigation turned on how they relate. The first is training. Anthropic trains Claude against a written set of principles, a method its researchers described in 2022 as Constitutional AI: a model critiques and revises its own answers against listed rules, and a preference model trained on AI judgments then supplies the reward for reinforcement learning, which the authors call learning from AI feedback ( Bai and colleagues' paper). The second layer is runtime monitoring, which the district court found exists on Claude Gov only in a limited form that cannot intervene. The third is the contract itself. The district court found that Anthropic could not technologically enforce the Department-specific usage policy and had no direct visibility into how the Department used the model. The D.C. Circuit stressed the other side of the same facts: training itself enforces restrictions, so every new version Anthropic delivers carries its choices into Department systems.

Two exceptions and an "all lawful uses" clause

In the fall of 2025 the two sides began negotiating a direct relationship, which the district court ties to a planned deployment on the Department's GenAI.mil platform. The Department asked for permission to use Claude for all lawful uses. Anthropic agreed to drop most remaining restrictions but kept the two exceptions. From 4 December 2025 to 4 March 2026, Dario Amodei, Anthropic's chief executive, and Emil Michael, Under Secretary of War for Research and Engineering, exchanged emails trading draft contract language ( summary judgment order). On 9 January 2026 Hegseth issued an artificial intelligence strategy directing the Department to become an AI-first warfighting force, to use models "free from usage policy constraints that may limit lawful military applications," and to write standard "any lawful use" language into contracts for AI services ( D.C. Circuit opinion).

Two incidents figure in the government's case. In 2025, the Centers for Disease Control and Prevention, using a commercial version of Claude, had prompts about infectious-disease research refused; Anthropic says it resolved the problem with the agency, and the district court found nothing suggesting the agency thought the limits malicious. Around January 2026, an Anthropic executive questioned whether a contractor's use of Claude in a sensitive military operation abroad was proper. Michael's memorandum said the question alarmed the Department and the prime contractor and raised doubts about whether the software would keep working. Anthropic called it a misunderstanding and put into the record media reports tying it to the 3 January operation to capture Venezuela's president, Nicolás Maduro. The district court found it undisputed that Amodei told the Department, before any action was taken, that Anthropic had no objection to that use; the D.C. Circuit said it did not know exactly what had happened.

On 24 February Hegseth met Amodei. In the undisputed account of Anthropic's head of policy, Sarah Heck, the Secretary praised Claude's capabilities, said the Department had other vendors that had never raised such concerns, and warned that unless Anthropic accepted all lawful uses by 5 p.m. on 27 February the Department would designate it a supply-chain risk, or might instead invoke the Defense Production Act to compel service. On 26 February Amodei published a refusal. He argued that mass domestic surveillance is incompatible with democratic values and that today's frontier models are not reliable enough to power fully autonomous weapons, while accepting that the Department chooses its contractors and offering a smooth transition to another provider ( Amodei's statement). He called the two threatened measures inherently contradictory, since one labels the company a risk and the other treats Claude as essential to national security.

Twenty-seven February and the formal designations

At 3:47 p.m. on 27 February, Trump posted that every federal agency should immediately cease all use of Anthropic's technology, allowing a six-month phase-out for agencies such as the Department of War. Hegseth's post followed. He wrote that the Department must have full, unrestricted access to Anthropic's models for every lawful purpose, accused the company of seeking veto power over the military's operational decisions, and directed the designation. He added that, effective immediately, no contractor, supplier or partner doing business with the military could conduct commercial activity with Anthropic ( summary judgment order; TechCrunch).

According to the administrative record the district court reviewed, the General Services Administration suspended Anthropic models on its USAi platform, the Office of Personnel Management blocked access to Claude, and the Treasury announced on 2 March that it was ending all use. Anthropic said it would challenge any designation in court and argued that a designation under section 3252 could reach only Claude's use on Department contracts, not contractors' other business ( Anthropic's 27 February statement). The company also said the label had never before been publicly applied to an American company; TechCrunch described such designations as typically reserved for foreign adversaries. Within hours of the presidential post, OpenAI announced its own Pentagon agreement, saying it kept prohibitions on domestic surveillance and autonomous weapons, according to TechCrunch.

A four-page memorandum from Michael, dated 2 March, argued that AI models are vulnerable to manipulation and that Anthropic's risk had escalated during negotiations, citing its contract terms, its statements to the press and the questioned operation. On 3 March Hegseth signed determinations finding a supply-chain risk and finding that less intrusive measures were not reasonably available; under section 4713 he also found that an urgent national security interest justified acting before giving notice ( D.C. Circuit opinion). Anthropic received the letter on 4 March and said it saw no choice but to challenge it in court ( Anthropic's 5 March post). The Department's chief information officer then ordered Anthropic products removed from Department systems within 180 days and barred contractors from using them in Department work; the district court dates that memorandum 5 March and the D.C. Circuit 6 March. In a statement reported by NPR, the Pentagon said the military would not allow a vendor to insert itself into the chain of command by restricting lawful use of a critical capability.

Two statutes, one question about training

Section 3252 of Title 10, which the district court traces to a 2011 defense authorization act, lets the Secretary exclude a source from national security systems and defines supply-chain risk as the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert a covered system ( 10 U.S.C. section 3252). Section 4713 of Title 41, part of the Federal Acquisition Supply Chain Security Act of 2018, gives agency heads similar procurement powers, but its definition reaches the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate a covered article ( 41 U.S.C. section 4713). Congress channeled review of section 4713 actions exclusively to the D.C. Circuit, while the section 3252 designation was reviewable in district court under the Administrative Procedure Act. Anthropic therefore filed in both courts on 9 March.

Underneath the statutory words sat a technical question: can Anthropic change what Claude does once the Department has it? Anthropic's head of public sector, Thiyagu Ramasamy, declared that deployed models are static, cannot be updated like conventional software, are tested by cloud providers and the Department before approval, and cannot be accessed, altered or shut down by Anthropic after deployment. The district court treated that evidence as unrebutted. Anthropic had asked the Department on 17 April to rescind its actions. In denying reconsideration on 3 June, Hegseth said his determination did not depend on any real-time technical access after deployment. Anthropic then filed a second petition for review of both the March and the June decisions on 17 June, and the court consolidated it with the first a week later as No. 26-1162 ( D.C. Circuit opinion).

The D.C. Circuit located the risk upstream instead, in training. Each new model Anthropic delivers carries its constitutional training; a model's response can change with the exact wording of a prompt; and the Department cannot freeze itself on old models while capabilities keep advancing. The court cited a Department declaration estimating that the models have roughly 5 to 10 trillion parameters, which the declarant said made rigorous auditing of their outputs impossible. That is the mechanism the case finally turned on: whether a developer's decision to train values into a model counts as manipulating the model's design.

The district court: retaliation and a vacated designation

Judge Rita Lin of the Northern District of California granted a preliminary injunction on 26 March, writing that the measures appeared designed to punish Anthropic and calling the episode classic First Amendment retaliation, as NPR reported. The government appealed to the Ninth Circuit on 2 April without seeking an emergency stay, and that appeal was paused at the parties' mutual request to await the D.C. Circuit.

On 27 August Lin granted summary judgment to Anthropic on most claims ( summary judgment order). She described the administrative record as slim, built on a four-page memorandum written after two of the three challenged actions, and found that the government had backed away from its backdoor-access theory. On the First Amendment, she held that Anthropic's public advocacy was a substantial motivating factor and that the government had not shown it would have acted anyway. She pointed to the Defense Production Act threat days before the designation, to Michael's 4 March email telling Amodei the parties were very close, and to later government discussions about using Anthropic's Mythos model. She wrote that invoking national security is not a blank check to punish government critics.

On section 3252, Lin read the definition as aimed at covert sabotage by an adversary, not at open positions in a contract negotiation. She also found procedural defects: no reasoned analysis of less intrusive measures, and a risk assessment prepared by Michael, who was negotiating with Anthropic at the time, rather than by the Under Secretary of Defense for Intelligence as Department regulations require. The government conceded that no statute supported the sentence barring contractors from all commercial dealings with Anthropic. Lin did reject Anthropic's claim that the presidential directive was ultra vires.

The order of final relief declared the challenged actions unconstitutional, permanently enjoined most defendants from giving them effect, vacated the section 3252 designation and the contractor-boycott sentence, and set aside implementing orders at nine agencies. It also stated that the Department was not required to use Anthropic's products and remained free to move to other providers. An Anthropic spokesperson welcomed the ruling and said the company remained focused on working productively with the government, according to TechCrunch.

The D.C. Circuit: a broader statute, upheld 2 to 1

The D.C. Circuit denied Anthropic a stay on 8 April, heard argument on 19 May, and decided on 25 September. Judge Gregory Katsas, joined by Judge Neomi Rao, upheld the section 4713 actions; Judge Karen LeCraft Henderson dissented ( D.C. Circuit opinion). Applying deferential review, the majority held that the Department reasonably feared Anthropic might shape Claude to refuse functions the Department considered contractually authorized. It read "manipulate" in its ordinary sense of skillfully operating or controlling something, rejected Anthropic's argument that the definition requires malice, and said the statutory test turns on what Anthropic does, not why. It said it had no reason to doubt Anthropic's intentions and no quarrel with the district court's reading of section 3252 or its finding of no bad motive, but held that section 4713 is broader and that the California judgment did not bind it.

The majority also upheld the finding that less intrusive measures were not reasonably available, adding that Anthropic had not preserved an argument for a narrower exclusion. Even if the urgency finding was wrong, Anthropic suffered no prejudice, because it later received the underlying materials, responded in full, and the Secretary held his position in June. Post-deprivation process satisfied due process given the pace of AI development and of military events, including U.S. operations in Iran that began two days after Anthropic's refusal and, according to a Wall Street Journal report the court cited, used Claude. On the First Amendment, the majority accepted that Anthropic's advocacy was protected and the exclusion adverse, but found no causal link: the Department had worked with Anthropic for two years despite that advocacy and acted only when negotiations collapsed.

Henderson would have read "manipulate" in its narrower sense of devious or underhanded control, relying on canons that read a word by the company it keeps and on a Senate report describing threats from hostile nation states and other bad actors. She warned that under the majority's reading any replacement vendor faces the same choice: accept the Secretary's demands or risk designation. The majority closed by acknowledging both sides' fears, constrained models failing mid-operation and unconstrained models choosing wrong targets, and said that the President and the Secretary must balance them. A Pentagon spokesman said the ruling completely validated the Department's position, while Anthropic said it respectfully disagreed, according to the Associated Press.

What is still unresolved

On 13 October Anthropic asked the D.C. Circuit to rehear the case, arguing that the majority had turned a law aimed at hostile foreign actors into one that presumptively reaches every government contractor, as Reuters reported. Writing in Lawfare, Kevin Frazier argued that the statute's legislative history concerns covert compromise of government technology, while conceding that history cannot decide the case alone and setting out counterarguments the government could press; Lawfare discloses that Anthropic supports an unrelated Lawfare project with compute.

On 20 October outside groups filed in support of the petition, in both consolidated cases. Seventeen former national security officials from Republican and Democratic administrations, among them Avril Haines, Susan Rice and Jake Sullivan, argued that the designation was pretextual, announced before any statutory process began, and that the panel's reading would govern nationwide because review of section 4713 actions lies only in the D.C. Circuit ( former officials' amicus brief; DefenseScoop). The Foundation for Individual Rights and Expression, the Electronic Frontier Foundation, the Cato Institute, Chamber of Progress and the First Amendment Lawyers Association sought leave to argue that Anthropic's choices about Claude's outputs are protected expression and that the designation was retaliation ( coalition motion and brief). Pentagon spokespersons did not comment to DefenseScoop, and no ruling on the petition had been reported as of 27 October 2026.

Lawyers advising contractors read the two rulings as resting on different statutes rather than directly conflicting. A Taft bulletin notes that the section 3252 designation remains under a permanent injunction and says other AI providers that retain post-deployment control over their models could face similar designations. Miller and Chevalier reported that, as of 29 September, no order naming Anthropic had been posted to SAM.gov under the 2018 act, so existing contracts change only through modification. The firm also noted the government's 60-day window to appeal the California judgment and judged an appeal unlikely. That forecast did not hold: on 26 October, sixty days after the judgment, the government filed a notice of appeal to the Ninth Circuit from the summary judgment order, the order of final relief and the judgment.

Several questions remain open. The full D.C. Circuit may or may not rehear the case, the Ninth Circuit must now decide the government's appeal of the California judgment, and the Supreme Court could be asked to review either. The two courts reached opposite conclusions about retaliation on overlapping facts, though they reviewed different actions on different records. The financial stakes are disputed: Anthropic's declarations projected losses of multiple billions of dollars in 2026 revenue if the measures stood, while the D.C. Circuit majority noted reports of investment offers valuing the company above 900 billion dollars. Anthropic's registration statement for an initial public offering, filed on 26 October, puts government agency contracts at about 1% of its revenue in each period presented, while warning that the risks extend to customers that sell to the government ( Anthropic's Form S-1). Neither court decided whether the two exceptions were wise policy.

How to place the designation in AI history

The event's significance is provisional, because appellate review had not concluded as of 27 October 2026. What it already shows is that the limits a frontier developer writes into its usage policy and trains into its models became the subject of executive action, two federal judgments, a pending rehearing petition and a new appeal. Earlier fights over Anthropic's models, such as Bartz v. Anthropic, concerned what went into training. This one concerns what training puts into the model, and whether a developer's chosen refusals are a safety property or a security risk.

The episode also recasts Claude as defense infrastructure, deployed on classified systems before the dispute began. The district court treated the government's continued interest in Claude Mythos as evidence against the national-security rationale, while the D.C. Circuit treated rapid model turnover as a reason the Department could not rely on testing old versions. If the panel's reading of section 4713 stands, an AI vendor's openly disclosed, training-embedded restrictions can count as a supply-chain risk without any finding of bad motive. If the full court adopts Henderson's narrower reading, the episode may instead be remembered as a dispute about procedure and statutory scope. For now the record supports a narrow claim: the government labeled a company's red lines a supply-chain risk, one court called that unlawful retaliation, and another, deciding under a broader statute, upheld it.

References

• U.S. Court of Appeals for the D.C. Circuit (2026). Anthropic PBC v. U.S. Department of War, No. 26-1049, opinion and dissent.
• Rita F. Lin, U.S. District Court for the Northern District of California (2026). Order on Cross Motions for Summary Judgment, Anthropic PBC v. U.S. Department of War, No. 26-cv-01996-RFL.
• Rita F. Lin, U.S. District Court for the Northern District of California (2026). Order of Final Relief, Anthropic PBC v. U.S. Department of War.
• U.S. Department of Justice, Civil Division (2026). Notice of Appeal, Anthropic PBC v. U.S. Department of War, No. 3:26-cv-01996-RFL.
• Former Senior National Security Government Officials, counsel Yale Law School Rule of Law Clinic and Farella Braun + Martel (2026). Brief of Former Senior National Security Government Officials as Amici Curiae in Support of Rehearing, Anthropic PBC v. U.S. Department of War, Nos. 26-1049 and 26-1162.
• Foundation for Individual Rights and Expression, Electronic Frontier Foundation, Cato Institute, Chamber of Progress and First Amendment Lawyers Association (2026). Motion and Brief of Amici Curiae in Support of Petition for Rehearing En Banc, Anthropic PBC v. U.S. Department of War.
• Dario Amodei, Anthropic (2026). Dario Amodei on the Department of War discussions.
• Anthropic (2026). Statement on the comments from Secretary of War Pete Hegseth.
• Anthropic (2026). Where things stand with the Department of War.
• Anthropic PBC (2026). Form S-1 Registration Statement.
• Anthropic (2025). Anthropic awarded $200M DOD agreement for AI capabilities.
• Bai et al., Anthropic (2022). Constitutional AI: Harmlessness from AI Feedback.
• Russell Brandom, TechCrunch (2026). Pentagon moves to designate Anthropic as a supply-chain risk.
• Rebecca Bellan, TechCrunch (2026). It's official: The Pentagon has labeled Anthropic a supply-chain risk.
• Rebecca Bellan, TechCrunch (2026). Anthropic gets its first court win over the Pentagon's supply-chain risk label.
• John Ruwitch, NPR (2026). Judge temporarily blocks Trump administration's Anthropic ban.
• Kaitlyn Huamani, Associated Press via CP24 (2026). Federal court says Pentagon can label Anthropic a supply chain risk.
• Rishabh Jaiswal, Reuters via The Star (2026). Anthropic seeks rehearing of case over Pentagon's security risk branding.
• Kevin Frazier, Lawfare (2026). Why Anthropic Is Asking for a Rehearing En Banc.
• Brandi Vincent, DefenseScoop (2026). Former U.S. officials urge D.C. Circuit to reconsider decision in Anthropic-Pentagon fight.
• Suzanne Sumner, Zachary Heck and Christina Heidecker, Taft (2026). D.C. Circuit Rules Pentagon Can Exclude Anthropic from Supply Chain.
• Miller and Chevalier (2026). DC Circuit Upholds Anthropic Supply Chain Risk Designation: Takeaways for Government Contractors.
• Legal Information Institute, Cornell Law School (2018). 41 U.S. Code section 4713: Authorities relating to mitigating supply chain risks in the procurement of covered articles.
• Legal Information Institute, Cornell Law School (2011). 10 U.S. Code section 3252: Requirements for information relating to supply chain risk.