Appeals Court Lets the Pentagon Keep Anthropic Blacklisted

A divided federal appeals court upheld the Pentagon's blacklisting of Anthropic on September 25, 2026, handing the U.S. government a significant win in its months-long fight with one of the country's leading artificial intelligence developers and leaving the company's access to military work in doubt.

Related reading: UK Says Its AI Security Institute Is Testing Unreleased Gemini 4 Argon Before Launch · DOJ Tells Its Lawyers to Call AI 'Super Intelligence,' a Term It Has Not Defined.

The 2-1 ruling from the U.S. Court of Appeals for the District of Columbia Circuit rejected Anthropic's argument that the Department of Defense's ban on its Claude models was arbitrary, unauthorized and unconstitutional. The designation bars the U.S. military from using Anthropic's models and blocks defense contractors from using them in work performed for the department.

Judge Gregory Katsas wrote the majority opinion, joined by Judge Neomi Rao. Both were appointed by President Donald Trump. Judge Karen LeCraft Henderson, appointed by President George H. W. Bush, dissented.

"The Department had ample support for its conclusion that the continued integration of Claude into the Department's information systems, by the Department or its contractors, presented a statutorily covered national-security risk," Katsas wrote.

How the fight started

The dispute traces to negotiations that broke down in 2025. Anthropic had signed a $200 million contract with the Pentagon in July of that year, and talks began that September over deploying Claude on the department's GenAI.mil platform. The government wanted unfettered access to Anthropic's models across all lawful purposes. Anthropic wanted assurances that its technology would not be used for fully autonomous weapons or domestic mass surveillance.

The two sides could not agree, and in March 2026 the department labeled Anthropic a supply chain risk. Defense Secretary Pete Hegseth accused the company of attempting to "seize veto power over the operational decisions of the United States military." Anthropic sued in federal court in San Francisco and in the D.C. Circuit, seeking to reverse the designation.

The case split across two statutes. The government relied on two distinct designations to justify its action, which meant they had to be litigated in two separate courts. A district judge in California, Rita Lin, ruled in August that one designation was illegal because Anthropic did not meet the definition of a supply chain risk under 10 U.S.C. § 3252, which is limited to the risk that an adversary may sabotage or subvert a covered system. She also found that the blacklisting violated the First Amendment, writing that "the empty invocation of national security is not a blank check to punish and retaliate against government critics."

The D.C. Circuit reviewed the other designation, made under 41 U.S.C. § 4713, which Congress assigned to that court for exclusive review. That statute defines a supply chain risk more broadly, covering the risk that "any person" may sabotage, manipulate or deny the function of covered technology.

Why the two rulings diverged

The appeals court did not dispute the California court's central finding. In fact, it agreed with it. The majority wrote that it had "no quarrel" with the conclusion that the word "adversary" in § 3252 requires bad motive, nor with the conclusion that Anthropic acted without such motive.

But the court said bad motive is not required under § 4713. The use of "any person," the majority reasoned, shows the definition is not limited to adversaries or foreign entities. It also pointed to the word "deny," which it said applies to Anthropic preventing the government from using certain Claude features.

"In sum, we conclude that the Secretary's concern about Anthropic disabling Claude from performing lawful actions requested by the Department qualifies as a 'supply chain risk' within the meaning of section 4713," the majority wrote. It added that the department "reasonably feared that Anthropic might manipulate Claude's design to prevent it from performing national-security functions."

The panel framed the dispute as a choice between two dangers. The government, it said, "raises the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail." Anthropic, it said, "raises the deeply sobering prospect of unconstrained AI models hallucinating inappropriate targets for lethal military force."

"In our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks," Katsas wrote. "In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution."

The dissent

Henderson, the dissenting judge, read § 4713 more narrowly. She argued that, in context, the verbs in the definition are all aimed at deliberately impeding or eavesdropping on covered technology that has entered the federal supply chain. Congress, she wrote, enacted the statute in response to intelligence-community warnings about "hostile nation state and other bad actors" infiltrating government systems.

She said the definition should not be stretched to cover "a contractor's honest and upfront enforcement of restrictions on a covered article's use disfavored by the government." That objection goes to the heart of the case: whether a company's refusal to remove safety limits from its own product can itself be treated as a national-security threat.

Anthropic's response and next steps

Anthropic said it disagreed with the outcome. "We respectfully disagree with the court's decision," a spokesperson told CNBC. "Another federal court has already held the government's parallel designation unlawful. We remain confident in our position and are considering all options, including further review."

The panel delayed its decision from taking immediate effect, giving Anthropic time to petition the same panel for a rehearing or to seek an en banc rehearing before the full D.C. Circuit. The company could also ask the Supreme Court to take the case.

The ruling lands amid a broader and sometimes contradictory relationship between Anthropic and the administration. Trump has repeatedly criticized chief executive Dario Amodei, particularly after Amodei called for an industry-wide slowdown in frontier AI development. Amodei was not invited to the White House state dinner for Chinese President Xi Jinping in the days before the ruling. Yet Commerce Secretary Howard Lutnick said recently that the two sides had patched up their relationship and were "in tune."

What the ruling means for other AI labs

The decision is narrower than it first appears, but its logic travels. The court did not endorse every use of the supply chain authority; it held that under the broader procurement statute, a company's own safety limits can count against it when the government decides a tool may not behave as needed. That reasoning could apply to any AI developer whose models refuse or restrict tasks that a federal customer considers lawful and authorized.

For labs that sell to the government, the practical lesson is that contractual language and model behavior are now part of the same risk assessment. A restriction that a developer treats as a safety feature can be characterized as a refusal to perform, and the government has been given wide latitude to decide which risk it prefers. The dissent's objection, that the statute was meant to stop sabotage and espionage rather than the honest enforcement of a contract, marks the boundary the majority declined to draw.

The ruling also arrives as several AI companies negotiate their relationship with the administration on shifting terms. Anthropic's dispute has been unusually public, but the underlying issue, how much control a model maker keeps over how its product is used, is common to the entire industry. A clearer answer from Congress, or from a higher court, would settle it for everyone.

What the decision changes

For the Pentagon, the immediate effect is the ability to enforce a ban that has already shaped which models its contractors can use in defense work. For Anthropic, the practical cost is a closed door to a large and growing customer, at least until the litigation runs its course. The company's models remain widely used in the commercial market, and the blacklist applies to defense work rather than to its business as a whole.

The case also sets a marker for how far the government can go in treating an AI developer's own safety restrictions as a risk. That question is not confined to Anthropic. Any lab that encodes limits on how its models can be used now has a data point suggesting those limits can be weighed against it in procurement decisions, at least under the broader of the two statutes at issue.

The deeper tension is unresolved. The court accepted that both sides were worried about catastrophic outcomes, then deferred to the executive branch to decide which risk to accept. Congress could revisit the definitions that produced two opposite rulings in two courts, and Anthropic's remaining appeals will test whether the broader statute can carry the weight the majority placed on it.

Cover image: an aerial view of the Pentagon. Photo by U.S. Air Force Staff Sgt. Brittany A. Chase, Department of Defense (public domain).