The Pentagon Keeps Its Anthropic Blacklist After a 2-1 Ruling

A split federal appeals court ruled on September 25 that the Pentagon lawfully labeled Anthropic a supply-chain risk and barred Claude from military systems. The U.S. Court of Appeals for the District of Columbia Circuit, in a 51-page decision, said the Department of War had “ample support for its conclusion” that the company’s models could pose a national security risk.

Circuit Judge Gregory Katsas wrote for himself and Circuit Judge Neomi Rao. Circuit Judge Karen LeCraft Henderson dissented. The 2-1 panel did not disturb a separate August win for Anthropic in California. It did lock in the ban that actually controls Pentagon networks.

The D.C. Circuit Leaves the Blacklist Standing

The case is Anthropic PBC v. United States Department of War, No. 26-1049, consolidated with No. 26-1162. It was argued on May 19, 2026. The court denied Anthropic’s petitions for review of an exclusion issued under the Federal Acquisition Supply Chain Security Act of 2018, codified at 10 U.S.C. § 4713.

Katsas wrote that Anthropic can and does control how Claude answers, or refuses to answer, user prompts. “On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users,” he wrote. A later fight over an overseas operation, he added, left the department unsure whether Claude would “perform as needed and intended.”

The Department had ample support for its conclusion that the continued integration of Claude into the Department’s information systems, by the Department or its contractors, presented a statutorily covered national-security risk.

Gregory Katsas, Circuit Judge, D.C. Circuit opinion, September 25, 2026

Secretary of War Pete Hegseth treated the opinion as confirmation, not a close call.

Confirmed: @AnthropicAI = Supply Chain Risk.

The @DeptofWar does what is right for the Country and our Warriors. https://t.co/xERtGRh6Kc

— Pete Hegseth (@PeteHegseth) September 25, 2026

The clerk withheld the mandate the same day, which pauses the formal close of the case while Anthropic decides whether to seek rehearing. An Anthropic spokesperson said the company “respectfully disagree[s]” and is “considering all options, including further review.” Charlie Bullock of the Institute for Law and AI noted that FASCSA challenges skip a trial court and go to the D.C. Circuit, so the remaining paths are an en banc rehearing or a petition to the Supreme Court. Neither is automatic.

Two Statutes Produced Opposite Results

The administration did not hang the fight on one statute. It used two, and the courts split.

In California, U.S. District Judge Rita F. Lin of the Northern District of California entered final relief on August 27, 2026, in No. 3:26-cv-01996. Her 59-page opinion vacated a separate “supply chain risk” label issued under 10 U.S.C. § 3252. She also set aside a Hegseth directive that had told military contractors to cut all commercial activity with Anthropic, including work that had nothing to do with a Pentagon contract.

THE TWO BLACKLISTS

The practical result is messy on purpose. Lin’s order still blocks the wider punishment. The D.C. Circuit order still lets the Pentagon, and firms doing Pentagon work, keep Claude off those systems. A contractor can buy Claude for a civilian customer and still be unable to put it on a classified stack.

The Two Uses Anthropic Would Not Allow

The contract fight was narrow, and Anthropic said so in public. In late February it agreed to loosen a long list of limits on Department of War use. It kept two.

THE HOLDOUT TERMS

• Autonomous weapons: Anthropic said today’s frontier models are not reliable enough for fully autonomous weapons, and that allowing that use would endanger U.S. forces and civilians.
• Domestic surveillance: The company said mass domestic surveillance of Americans violates fundamental rights, and it would not write that use into the deal.

The Pentagon’s demand was “all lawful uses,” or “any lawful governmental purpose,” language later mirrored in classified-network deals with other labs. CEO Dario Amodei wrote on February 26 that “we cannot in good conscience accede to their request.” Hegseth had set a 5:01 p.m. deadline on February 27. President Donald Trump then told agencies to “IMMEDIATELY CEASE all use of Anthropic’s technology,” with a six-month phase-out for shops already on Claude. Hegseth issued the risk label the same day.

HOW THE SPLIT TRACK GOT BUILT

1. July 2025: The Chief Digital and Artificial Intelligence Office awards Anthropic, Google, OpenAI, and xAI agreements of up to $200 million each to speed frontier models onto national security work. Claude is the first frontier system on classified networks.
2. February 27, 2026: After the failed talks, Trump orders agencies off Anthropic and Hegseth tags the company a supply-chain risk. OpenAI’s classified-network modification is executed the same day.
3. March 9, 2026: Anthropic files two federal cases, one in San Francisco on the 3252 label and the contractor gag, and one in Washington on the FASCSA exclusion.
4. March 26, 2026: A preliminary injunction in California temporarily blocks the 3252 campaign and the presidential cease-use order. The General Services Administration puts Anthropic back on USAi.gov and the multiple-award schedule.
5. April 8, 2026: The D.C. Circuit denies a stay of the FASCSA label and expedites the merits. Hegseth denies reconsideration on June 3. Anthropic files a second petition on June 17. The court consolidates the petitions on June 24.
6. August 27, 2026: Lin grants Anthropic final relief on the 3252 track. September 25: the D.C. Circuit upholds the FASCSA track.

Amodei told customers the 3252 statute is narrow and cannot, by its own terms, police how a contractor uses Claude for other buyers. The FASCSA case was built to close that gap.

Henderson Says Congress Had Hostile States in Mind

The majority’s reading of FASCSA is the piece other labs will study. The statute defines supply-chain risk as the chance that a person may sabotage, maliciously add unwanted functions, extract data, or otherwise manipulate covered articles so as to surveil, deny, disrupt, or run them off-script. Katsas treated Claude’s built-in refusals, and the unresolved contract fight, as enough. No finding of a foreign owner, a back door, or a plan to poison the model was required.

Henderson would have read “or otherwise manipulate” as covering only intentionally subversive or deceptive conduct. She pointed to the 2018 Senate report on hostile states and other bad actors infiltrating federal technology. “I cannot agree that this is the scenario the Congress had in mind,” she wrote. In her view, a contractor’s “honest and upfront enforcement of restrictions” is not the kind of risk that supports a blacklist.

That is the second-order holding. Under 10 U.S.C. § 3252, a DoD-specific rule implemented in the defense acquisition regulation, supply-chain risk is framed as the chance an adversary may sabotage a covered system. Lin found no articulable basis to believe Anthropic would sabotage Claude, and she treated the national-security rhetoric as cover for a public example. Katsas said his court had no need to find a bad motive, because FASCSA as written does not require one. A usage policy that can halt a prompt in the middle of an operation is, on that reading, a supply-chain defect.

The First Amendment claim died on the same hinge. The panel said the department acted over a contract term it viewed as essential, not over Anthropic’s broader push for AI rules. Due process failed too: the company got notice and a chance to contest, the majority said, and it showed no prejudice from the speed of the cutoff.

Classified Networks Already Run Other Models

The legal fight is running behind the wiring. Under Secretary of War for Research and Engineering Emil Michael told reporters on September 11 that “about 90 percent” of classified work had already moved off Anthropic, with the rest on track for the end of that month. “All of the Maven Smart Systems or Palantir work has been transitioned months ago,” he said.

THE STACK THAT REPLACED CLAUDE

• The original four: Anthropic, Google, OpenAI, and xAI each held the July 2025 ceiling of up to $200 million. Claude was the only one on classified systems when the fight started.
• The lawful-use deals: OpenAI, xAI, and then Google signed classified-network terms that let the department use their models for any lawful governmental purpose, the phrasing Anthropic would not accept for the two carve-outs.
• The May expansion: The department added classified arrangements with Microsoft, Amazon Web Services, Nvidia, Reflection, and SpaceX, building a multi-model bench on purpose.
• The users’ verdict: Michael said Maven crews preferred newer ChatGPT builds to Anthropic, and found Grok “way faster than both of them,” with each model fitting different missions.

Michael also said the Pentagon should never have been “single-threaded” on one model. That argument now does double duty. It explains the rush to Google, OpenAI, and xAI, and it makes the FASCSA win less about one chatbot and more about a rule: if a lab will not promise all lawful uses, the department can tag the refusal as a supply-chain risk and shop elsewhere.

The money at stake inside the building was never Anthropic’s business. A Congressional Research Service brief in July put the company’s run-rate revenue at $14 billion as of February 12, 2026, and more than $47 billion by May, and noted a confidential Form S-1 filed June 1. The Pentagon ceiling was a rounding error next to that commercial engine and the company’s $30 trillion addressable-market pitch. The loss is access, references, and the classified default, not the consumer product.

What the Speech Win Does Not Restore

Lin’s August opinion remains the other half of the record. She found that the 3252 campaign and the contractor gag were “unlawful retaliation against Anthropic for constitutionally protected expressive activities.” She wrote that the government’s own words showed a wish to make a public example of the company for its “arrogance” in criticizing the department, “not based on any articulable basis to believe that Anthropic would actually sabotage its model.”

The empty invocation of national security is not a blank check to punish and retaliate against government critics.

Rita F. Lin, U.S. District Judge, Northern District of California, August 27, 2026

She also flagged the contradiction Hegseth never resolved. Days before the crackdown, he had floated using the Defense Production Act on Anthropic, a tool that treats a firm as essential rather than toxic. Talks about the company’s Mythos model in sensitive cyber work continued even after the risk label. None of that, Lin wrote, matches a genuine fear of a saboteur.

The D.C. Circuit did not reverse her. It decided a different statute. Anthropic’s spokesperson leaned on that fact after Friday’s loss: “Another federal court has already held the government’s parallel designation unlawful.” That is true, and it is also why the speech win does not put Claude back on Maven. The Pentagon can lose the retaliation case and still keep the FASCSA exclusion. Other labs watching the docket will price that split, not the California trophy.

Trump Hosts Amodei Two Days After the Loss

Trump told reporters on September 27, after landing at Joint Base Andrews, that he would sit down with Amodei at 10 p.m. at the White House. It was their first one-on-one. Amodei had missed a state dinner for Chinese President Xi Jinping last week that Sam Altman, Jeff Bezos, and Mark Zuckerberg attended. Trump then invited him personally, people familiar with the planning said. A broader session with House Speaker Mike Johnson and AI executives is set for September 29.

Trump said he is “about a year, maybe a year and a half up on China” and wants to keep that lead. Amodei has been arguing for a slower rise in model capability. Those are separate arguments from the contract clause that produced the blacklist. Nothing in the 51-page opinion turns on a dinner. Nothing in Lin’s order is enlarged by one either.

The template that survived September 25 is simpler than the politics around it. A U.S. lab can keep hard limits on autonomous weapons and domestic surveillance. The Department of War can call those limits a supply-chain risk under FASCSA, and a D.C. Circuit majority will defer. OpenAI, Google, and xAI already signed the broader terms. Claude is still for sale. It is no longer the model the Pentagon has to ask permission to run.