Appeals court lets Pentagon bar Anthropic’s Claude, 2-1

A federal appeals court ruled 2-1 on Friday that the Pentagon, which the opinion calls the Department of War, can keep Anthropic’s Claude out of its information systems and out of its contractors’ work for the Pentagon under a federal supply-chain security law. According to the opinion, the Pentagon acted after Anthropic “refused to relax contractual prohibitions on the use of Claude for lethal autonomous warfare or domestic surveillance,” and the company “encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent” (slip op. at 4).

The U.S. Court of Appeals for the D.C. Circuit denied Anthropic’s petitions for review (Nos. 26-1049 and 26-1162). “The Department had ample support for its conclusion that the continued integration of Claude into the Department’s information systems, by the Department or its contractors, presented a statutorily covered national-security risk,” Judge Gregory Katsas wrote for the majority (slip op. at 4).

Judge Neomi Rao joined the majority opinion. Judge Karen LeCraft Henderson dissented. She wrote that Congress did not pass the law to punish “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government” (dissent at 8).

The ruling in plain English

The case turns on one word in a 2018 procurement law, the Federal Acquisition Supply Chain Security Act. The law lets an agency cut off a supplier that poses a “supply chain risk,” which it defines as the risk that someone may “sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” a technology product (slip op. at 5).

The majority gave “manipulate” its ordinary meaning, and it said Anthropic does exactly that to Claude through training. “Based on undisputed record evidence, there is not only a ‘risk’—but a certainty—that Anthropic will so manipulate the ‘design’ or ‘operation’ of Claude to deny it the ‘function’ of conducting lethal autonomous warfare or mass domestic surveillance,” Katsas wrote (slip op. at 24).

The majority held that motive does not matter under this law. “We have no reason to doubt that Anthropic manipulates Claude’s function, use and operation with noble intentions,” Katsas wrote, but the definition “turns on what Anthropic does, not why Anthropic does it” (slip op. at 28).

The court also rejected Anthropic’s constitutional claims. On due process, it said the Pentagon gave Anthropic notice and the underlying materials “just over two weeks” after its decision, and that Anthropic showed no harm from not getting an earlier chance to respond (slip op. at 35–38). On the First Amendment, it held that the Pentagon acted “because Anthropic refused to agree to a contract term the Department deemed essential to national security” (slip op. at 41).

Claude’s limits, in the opinion’s words

The opinion says Anthropic “employs three distinct kinds of restrictions” (slip op. at 7):

• In the model. Anthropic “seek[s] to embed safety considerations directly into the model itself.” The opinion says Anthropic “has disabled Claude from performing specific tasks such as making biological, chemical, nuclear, or radiological weapons” and “trains Claude to conform to a constitution developed for it by Anthropic.”
• On top of the model. It uses “technical measures that stack on top of the model itself,” including “monitoring systems to detect harmful activity and targeted interventions to prevent it.”
• In the contract. Its usage policy bars “unacceptable” uses, including “surveillance, compromising computer systems or networks, and designing weapons.”

Over time, the opinion says, “Anthropic came to permit the Department to use Claude to design more effective weapon systems, to analyze foreign intelligence, and to conduct offensive cyber operations. However, Anthropic retained contractual prohibitions on the use of Claude for ‘lethal autonomous warfare’ and for ‘mass surveillance of Americans’” (slip op. at 9). When the Pentagon asked for permission to use Claude for “all lawful uses,” Anthropic kept what it calls “two critical exceptions” (slip op. at 9).

The opinion quotes CEO Dario Amodei’s Feb. 26 statement. In it he called “mass domestic surveillance” “incompatible with democratic values.” He also said fully autonomous weapons “may prove critical for our national defense” but that AI was not yet “reliable enough” to power them (slip op. at 10–11).

What the Pentagon pointed to, according to the opinion

The majority relied on three things in the record (slip op. at 18–22):

• Refusals. Commercially available versions of Claude used in classified systems refused some national-security tasks, and Claude refused CDC queries about research on preventing the spread of infectious disease. Anthropic says these “glitches” were “resolved after Anthropic engineers worked with the relevant government stakeholders.” The court said the point was that “model training does effectively enforce contractual usage restrictions” (slip op. at 19).
• An overseas operation. Under Secretary Emil Michael wrote that an Anthropic executive “questioned the propriety” of using the company’s software “for a sensitive military operation abroad.” He said that “raised material doubts as to whether they would cause their software to stop working.” Anthropic suggested it was a misunderstanding. The opinion notes that Anthropic itself put into the record media reports tying its concerns to the Jan. 3 “military operation to capture Venezuela’s president, Nicolás Maduro” (slip op. at 10, 19).
• Upgrades. Anthropic said it has no “back door or remote ‘kill switch’” and that the Pentagon could test new models before accepting them. The court said testing is no cure. It noted that the contested limits are “hardly self-defining,” that Claude may answer differently depending on a request’s exact wording, and that Michael described models with “approximately 5 to 10 trillion” parameters. “The Department cannot utilize AI systems that remain trapped in amber,” Katsas wrote (slip op. at 20–22).

Defense Secretary Pete Hegseth made the formal determination on March 3. On March 6, according to the opinion, the Pentagon’s chief information officer ordered Anthropic products removed from its systems “as soon as practical,” and in any event within 180 days. The memo also barred contractors from using Anthropic products “in their work for the Department” (slip op. at 11–12).

The dissent

Henderson argued that “manipulate” should be read alongside its neighbors in the statute, and that in that context it means “intentionally subversive acts, carried out through deceptive means” (dissent at 2). “Because I believe that the context decidedly favors the narrower reading, I respectfully dissent,” she wrote (dissent at 2).

She also warned about what comes next. If the secretary makes the same demand of Anthropic’s replacement, she wrote, “that contractor will have a choice: Agree to the Secretary’s demands or risk being designated a national security threat under FASCSA” (dissent at 7). Congress passed the law, she wrote, to meet the threat of “[h]ostile nation state and other bad actors,” quoting a 2018 Senate report (dissent at 7).

The majority said the dissent’s arguments “have some force, but we are ultimately unpersuaded” (slip op. at 24).

The San Francisco case

A separate designation has already been struck down. On Aug. 27, U.S. District Judge Rita F. Lin of the Northern District of California, sitting in San Francisco, set aside the Pentagon’s designation of Anthropic as a supply chain risk under a different law, 10 U.S.C. § 3252 (order of final relief). She found that the actions were unlawful retaliation. “The empty invocation of national security is not a blank check to punish and retaliate against government critics,” she wrote (opinion at 2). Her order also vacated a directive that no contractor doing business with the U.S. military “may conduct any commercial activity with Anthropic.”

The D.C. Circuit took up that ruling directly. It said § 3252’s definition is “much narrower” because it covers the risk that “an adversary” may act and requires bad motive. “We have no quarrel with the Northern District’s conclusion that Anthropic has acted with no such bad motive,” Katsas wrote, but the 2018 law does not require one (slip op. at 30). The court rejected Anthropic’s argument that Lin’s decision bound it, noting that Congress gave the D.C. Circuit “exclusive jurisdiction” to review actions under the 2018 law (slip op. at 30–31 n.1).

As a result, two federal courts have now reached opposite outcomes on two separate designations. The one under § 3252 has been set aside, and the one under the 2018 law stands.

Who it binds

The ruling upholds the Pentagon’s actions under the 2018 law, which lets an agency bar its own contracts with a supplier and bar “subcontracts that use the supplier to perform work for the agency” (slip op. at 5). In practice, that means no Claude in Pentagon systems and no Claude in contractors’ Pentagon work (slip op. at 12). Congress routed review of these actions to the D.C. Circuit (slip op. at 6), so this reading of “manipulate” will carry weight in any future challenge under the law.

Who it exempts, and what it doesn’t decide

• Contractors’ other work. The opinion describes a ban on Anthropic products in contractors’ “work for the Department.” It does not address their commercial work outside that. Lin’s order vacated the broader “any commercial activity” directive.
• Civilian agencies. The opinion does not rule on the president’s directive for other agencies to stop using Anthropic. Lin’s order vacated steps that eight civilian agencies, including State, Treasury and the General Services Administration, took to carry out that directive.
• Whether Anthropic’s limits are wise. The court said “the point here is not that these model or usage restrictions were arbitrary” (slip op. at 19). It called both sides’ fears “deeply sobering” and said “it is the President and the Secretary of War who must determine how best to balance the competing risks” (slip op. at 43).
• Remand. The court denied the petitions outright and sent nothing back to the Pentagon.

What happens next

Anthropic can ask the full D.C. Circuit to rehear the case. Under the federal appellate rules, a rehearing petition is generally due within 45 days of judgment when a federal agency or officer is a party. It can also ask the Supreme Court to take the case. The Supreme Court’s rules generally allow 90 days from the judgment, or from the denial of a timely rehearing petition. These are the general deadlines under the rules; the court did not set dates in this case. Both courts grant few such requests.

According to Lin’s opinion, the government’s Ninth Circuit appeal of her earlier preliminary injunction was stayed at both sides’ request pending the D.C. Circuit’s ruling (N.D. Cal. opinion at 22).

On the record

“We respectfully disagree with the court’s decision. Another federal court has already held the government’s parallel designation unlawful,” Anthropic said in a statement reported by Breaking Defense and The Washington Times. “We remain confident in our position and are considering all options, including further review.” As of early Friday evening, Anthropic had not posted a statement on its newsroom or its X account.

“Today’s DC Circuit Court ruling completely validates the Department’s position,” Pentagon chief spokesman Sean Parnell posted on X at 1:02 p.m. CT.

What a founder, contractor or worker should do differently

Defense contractors and subcontractors. Treat Claude as barred from Pentagon work, including Claude built into other tools. The court noted that a model “layered into other applications” can “limit the functionality of that larger system” (slip op. at 33). Audit your stack and your subcontractors’ stacks.

Founders building on Claude. If you sell to the Pentagon, plan to swap models. If you don’t, this ruling does not reach you directly, though the California case covers the broader commercial ban.

Any AI vendor selling to the Pentagon. The Pentagon’s AI strategy calls for “‘any lawful use’ language” in AI contracts (slip op. at 10). Under this ruling, model-level refusals a customer can’t override can count as “manipulation,” whatever the motive, which is the scenario the dissent warned about for the next vendor. Put usage limits in writing, and get clear terms on what happens when a model refuses.

Workers. If your team uses Claude on a Pentagon contract, ask your contracts office what the removal order means for your work.

What’s next

• A petition for rehearing by the full D.C. Circuit.
• A Supreme Court petition, and whether the California and D.C. rulings come to be treated as a conflict.
• Whether the government presses its Ninth Circuit appeal now that this ruling is out.
• Whether the Pentagon demands “any lawful use” terms from other AI vendors, and whether any push back.

Sources: U.S. Court of Appeals for the D.C. Circuit, Anthropic PBC v. U.S. Department of War, No. 26-1049 (consolidated with 26-1162), Sept. 25, 2026 (PDF) · N.D. Cal., Anthropic PBC v. U.S. Department of War, No. 3:26-cv-01996-RFL, opinion, Aug. 27, 2026 (PDF) · Order of final relief, Aug. 27, 2026 (PDF) · Sean Parnell on X · Breaking Defense · The Washington Times