On September 25, the D.C. Circuit upheld the Pentagon’s decision to blacklist Anthropic after the company refused to let Claude be used for lethal autonomous warfare or mass surveillance of Americans. The designation blocks the military from using Claude and bars defense contractors from using it on Pentagon work, CNBC reported.
By upholding the blacklist, the court held that Anthropic’s deliberate control of its own model, even when exercised “with noble intentions”, can qualify as a statutory supply chain risk. Donald Trump and Defense Secretary Pete Hegseth now have a legal blueprint for punishing any AI company that puts safety conditions on military work: call the guardrail a threat, blacklist the vendor, and demand obedience from everyone watching.
The Pentagon demanded every lawful use
Anthropic had already given the military plenty. According to the court’s account of the record, the company built Claude Gov for classified systems and permitted Claude to help design weapons, analyze foreign intelligence, and conduct offensive cyber operations. It kept two contractual prohibitions: no lethal autonomous warfare and no mass surveillance of Americans.
In January, Hegseth ordered the Pentagon to become an “AI-first” fighting force and directed AI contracts to include “any lawful use” language. On February 24, he gave Anthropic CEO Dario Amodei three days to accept that term. Amodei refused, arguing that mass domestic surveillance was incompatible with democratic values and that AI was not reliable enough to select and engage targets without a human in the loop. The next day, Trump posted, “We don’t need it, we don’t want it, and will not do business with them again!” Hegseth started the exclusion process, and on March 3 he formally declared Claude a supply chain risk. The Associated Press documented the public threats, Anthropic’s two requested limits, and the blacklist.
That sequence matters. Anthropic had no access to alter a model after deployment. It stated its terms in public, offered to help the Pentagon move to another provider, and got branded a national security threat for refusing to erase two limits from a contract.
One verb swallowed the statute
The Federal Acquisition Supply Chain Security Act defines a supply chain risk as the danger that a person may “sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” covered technology. Anthropic argued that the final phrase must be read alongside the hostile acts that precede it. Training a model to follow disclosed limits is not sabotage.
Judge Gregory Katsas, joined by Judge Neomi Rao, chose a much broader reading. In the majority opinion, “manipulate” means to control or operate something. Intent does not matter. “The statutory definition of a ‘supply chain risk’ turns on what Anthropic does, not why Anthropic does it,” Katsas wrote.
Judge Karen LeCraft Henderson’s dissent explains the damage. Congress placed “otherwise manipulate” after sabotage, malicious insertion, and data extraction. Henderson argued that those neighboring words limit the phrase to deceptive or subversive conduct. The majority’s reading turns ordinary product design into a supply chain threat. Every software vendor controls how its product functions. That cannot be enough to put every contractor one disagreement away from a national security blacklist.
The government’s strongest argument deserves a fair hearing. The Pentagon cannot build military systems around a model that might refuse a lawful command in the middle of an operation. The record included earlier Claude refusals and a dispute over the model’s use in an overseas mission. That is a genuine procurement risk.
A genuine procurement risk can justify ending a contract. The Pentagon could stop buying Claude or move to a vendor willing to accept its terms. Anthropic itself offered a transition. Calling a public contract dispute a national security threat adds stigma and coercion that an ordinary termination does not. It tells every vendor that declining the government’s terms will be treated as disloyalty rather than a business decision.
The emergency came from the Pentagon’s dependence
The majority also accepted Hegseth’s claim that immediate action was necessary. Its evidence is revealing. Two days after Anthropic’s refusal, the United States began offensive operations in Iran and reportedly used Claude in the strikes. The Pentagon had also been using Claude under restrictions for more than a year, a fact the opinion acknowledges.
The timeline shows the Pentagon entered a war while depending on software whose contractual limits it already knew. Anthropic had not suddenly become dangerous. Hegseth turned his department’s reliance on one vendor into evidence against the vendor. National security deference then converted poor procurement planning into emergency authority.
A federal judge in California reached a different conclusion about a parallel blacklist under a different statute. Section 3252 applies to an “adversary” and requires bad motive, while the statute before the D.C. Circuit covers “any person”. That distinction is real, and the D.C. Circuit relied on it. But Judge Rita Lin’s factual findings about the government’s conduct are still devastating. Anthropic had no access to alter a model after deployment. The government conceded Claude was no riskier than another “black box” model. Officials kept negotiating with the company after calling it an unacceptable threat. Lin found that the broader campaign was unlawful retaliation meant to make an example of Anthropic for its “arrogance” in criticizing the government.
Commerce Secretary Howard Lutnick later said Anthropic was “back on the right side” with the Trump administration. That is political language, not a technical risk assessment. Software does not become safe because its maker gets back on a president’s good side.
Every AI vendor just saw the price of a red line
The hypocrisy was visible within hours. After Anthropic was punished, OpenAI CEO Sam Altman announced a classified military deal and said his agreement contained the same two protections: no domestic mass surveillance and human responsibility for lethal force. He also urged the Pentagon to offer those terms to every AI company. Those were Altman’s claims about his own contract, reported by the Associated Press, not an independent disclosure of the text. Even taken on those terms, the contradiction is glaring. One vendor says the Pentagon accepted the limits that another vendor was blacklisted for demanding.
Anthropic is no pacifist hero. It sells AI to the military, permits weapons design work, and supports offensive cyber operations. I oppose that work too. Its two remaining limits are worth defending even if the rest of its military business is not.
The D.C. Circuit’s closing paragraph admits the stakes. An overly constrained model might stop during an operation. An unconstrained model might hallucinate a target for lethal force. The majority handed that balance to Trump and Hegseth, then approved a reading of federal law that lets them punish a vendor for drawing the safer line.
This ruling will reach far beyond Anthropic. Every AI executive negotiating with the government now knows that a public safety condition can be recast as sabotage without anyone proving malice, deception, or secret access. Trump and Hegseth wanted unrestricted obedience. The court gave them a procurement statute broad enough to demand it.