Court: Pentagon could blacklist Anthropic
The U.S. Department of Defense was entitled to blacklist Anthropic as a “supply chain risk.” That was the decision of the U.S. Court of Appeals for the D.C. Circuit on September 25, 2026, by a vote of 2 to 1. According to the judges, the Trump administration had that power because Anthropic withheld certain AI capabilities from military use, even though the company acted without malicious intent. Ars Technica (Jon Brodkin) and The Decoder reported the decision; CNBC and Courthouse News also covered it. On the surface, it is a case about contracts, but beneath that lies a much larger question: who decides what an AI model may refuse to do?
How it came to this
A brief timeline. In early March, Defense Secretary Pete Hegseth designated Anthropic as a “supply chain risk”; the department used two separate statutes to do so. Also in March, Anthropic sued, after the government had banned federal agencies from using Anthropic products and forbidden defense contractors from doing business with the company. Anthropic argues the government acted in retaliation: the company refused to lift the restrictions that prohibit using Claude for lethal autonomous weapons and for mass surveillance of Americans. In April, the same appellate court already rejected Anthropic’s emergency motion to suspend the blacklist.
What the judges now write reveals striking candor about the tension. The United States points to “the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail”: AI models so tightly constrained that they shut down unexpectedly and cause an important military operation to fail. Anthropic counters with “the deeply sobering prospect of unconstrained AI models hallucinating inappropriate targets for lethal military force”: unbound models that invent wrong targets for deadly force. The court does not decide which risk weighs heavier. It says the president and defense secretary “must determine how best to balance the competing risks”, and acknowledges that it comes down to “profoundly difficult questions about the appropriate military uses of an almost unimaginably powerful new technology”.
That second risk is not mere theory. Last week, CNN reported, citing unnamed sources, a near-incident at sea: a chatbot apparently misidentified a cargo load, and the U.S. military nearly boarded a Chinese vessel. It is exactly the kind of error Anthropic raises in court.
The court also points to concrete friction. According to the majority, Anthropic builds restrictions into Claude that have more than once blocked tasks for government users, and a recent dispute arose over whether contractual prohibitions barred Claude’s use in an ongoing military operation abroad. For an army relying on a tool, that is the kind of uncertainty it does not want.
Two courts, two verdicts
What makes the story confusing: another judge reached the opposite conclusion last month. District Judge Rita Lin of the Northern District of California, appointed by Biden, sided with Anthropic and ruled the blacklist unlawful and a violation of the First Amendment, the constitutional right to free speech. How is that possible? Because the Pentagon designated Anthropic under two different statutes, and each court tested a different one. The appeals court also rejected the constitutional objections: according to the majority, Anthropic was excluded because it refused a contractual condition the department deemed essential, not because it advocated stricter AI rules.
| Court | Judge(s) | Statute | Outcome | Bad motive required? |
|---|---|---|---|---|
| District Court, California | Rita Lin (appointed by Biden) | 10 U.S.C. § 3252 | Blacklist unlawful, violates First Amendment | Yes: sabotage or malicious undermining by an “adversary” |
| Court of Appeals, D.C. Circuit | Gregory Katsas (wrote the opinion) and Neomi Rao (majority, appointed by Trump); Karen Henderson (dissent) | 41 U.S.C. § 4713 | Blacklist upheld, 2 to 1 | No: “no such bad motive is required” |
The first statute describes a supply chain risk as one in which an “adversary,” a hostile party, commits sabotage or maliciously smuggles in unwanted functions. From that, the California judge inferred bad intent was required, and that Anthropic lacked it. The appeals court has “no quarrel” with either conclusion. The catch: for designations under the second statute, Congress gave exclusive jurisdiction to the D.C. Circuit, and that law is broader. It applies to “any person”, anyone at all, and contains the word “deny”: to refuse or prevent. A supplier that refuses certain capabilities fits that definition, the majority says. The court does not dispute that Anthropic acted without malicious intent. Under that statute, it simply does not matter.
The dissent: this is not what the law is for
Judge Karen Henderson, appointed by George H.W. Bush, did not agree. In her view, the statute targets hostile states and bad-faith actors, not a supplier that openly says what its product may not do.
“a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government”
Put plainly: a supplier’s honest and open enforcement of use restrictions on a product that the government dislikes. That ought not to be grounds, Henderson argues, to brand a company as a security risk. It is a sober observation, and it cuts to the core: Anthropic hid nothing, it stated its limits upfront.
What happens next?
Anthropic responded via CNBC: “We respectfully disagree with the court’s decision. Another federal court has already held the government’s parallel designation unlawful. We remain confident in our position and are considering all options, including further review.” So the company respectfully disagrees, points to the California ruling, and is weighing further steps. Possible paths include a rehearing by the full appeals court (en banc) or an appeal to the Supreme Court.
Yet there is a conciliatory note. Commerce Secretary Howard Lutnick recently said the government and Anthropic have repaired their relationship and are “in tune”, on the same wavelength. How that squares with a blacklist that remains legally intact is still unclear. For a company reportedly on its way to the largest IPO ever, such a label is hardly a minor detail: investors do not like to read “supply chain risk” in a prospectus.
Our take
Do not read this ruling as “Anthropic was wrong”. The court does not say that anywhere; it explicitly does not dispute that the company acted without malicious intent. What it does say is that the U.S. defense secretary, under this law, may exclude a supplier who can prevent its product from doing what the department sees as lawful and necessary. And that puts the core of the entire AI safety debate on the table in a single case: who sets the boundaries of an AI model, the maker or the customer?
Anthropic has made a trademark of drawing those boundaries itself and making them visible, as it also measures and publishes its own pace. This ruling shows the flip side: whoever draws boundaries can be punished for it by their biggest customer, even if they are fully transparent.
For Europe, in our view, that is both a warning and an opportunity. Legally, this case falls outside the AI Act: the regulation excludes AI for exclusively military, defense, or national security purposes. But the underlying question, whether a maker may set its own limits against customer wishes, applies here too. This American ruling says that a supplier enforcing such limits can be excluded. Our assessment: Europe ought to make clear that a maker who draws boundaries gets support, not punishment, for holding them.
Still, keep a cool head. Two courts, two outcomes, two different laws, and one dissenting judge. The case is not settled. The last word may come from the Supreme Court, or from a quiet settlement between Washington and Anthropic.
