Anthropic v. Pentagon: why the court upheld the ban

Imagine your company sells software to the government and states clearly that it will not do two things. The government insists. You maintain the refusal. Weeks later, your company receives a national security threat label created for spies and saboteurs.

That is roughly what happened in the Anthropic v. Pentagon case. On September 25, 2026, a federal appeals court in the United States decided, by a 2-to-1 vote, that the Department of Defense could treat Anthropic, creator of Claude (the AI assistant competing with ChatGPT), as a "supply chain risk." It is the label that removes a supplier from government procurement.

The detail that confuses everyone: a month earlier, another federal court had struck down a twin punishment applied for the same reason. This article explains how the two decisions coexist, what remains prohibited, what has not changed, and what this fight teaches those who depend on AI at work.

Quick summary: the answer in 30 seconds. The Washington appeals court upheld, 2 to 1, the exclusion of Claude from Pentagon systems and from the work of contractors on defense contracts. Anthropic refused to release Claude for mass surveillance of Americans and fully autonomous weapons. Another court, in California, struck down a similar punishment applied under a different law. For the ordinary user, nothing changes. Anthropic can still appeal.

Table of Contents

• What the court decided, in a few lines
• Anthropic v. Pentagon: how the fight began
• What is "supply chain risk"?
• Two courts, two answers: how is this possible?
• The winning argument: an AI that can say "no"
• The dissent: "this is not what Congress imagined"
• What changes now for Anthropic and Claude?
• Can Anthropic appeal?
• What this teaches those who use AI
• Frequently asked questions

What the court decided, in a few lines

The Court of Appeals for the District of Columbia Circuit, in Washington, denied Anthropic's requests and upheld Secretary Pete Hegseth's decision to remove Claude from the Department of Defense's supplier chain. The vote was 2 to 1, and the company lost on all three arguments it brought.

Judge Gregory Katsas wrote the majority opinion, joined by Judge Neomi Rao. Judge Karen Henderson dissented. It is all in the decision of September 25, 2026, a 51-page document published by the court itself.

The majority rejected three claims. The first said the measure was arbitrary. The second, that the law did not authorize that use. The third, that the government violated the Constitution by punishing the company for its views and without giving it a chance to defend itself.

A note about names: the Trump administration began calling the Department of Defense the Department of War, and that is how it appears in the case. In this text, "Pentagon," "Department of Defense," and "Department of War" refer to the same agency.

In one sentence: the court did not say Anthropic acted in bad faith, but rather that the law used by the Pentagon does not require bad faith to exclude a supplier.

Anthropic v. Pentagon: how the fight began

The fight began in a contract negotiation. The Pentagon wanted to use Claude for "all lawful uses," without exception. Anthropic agreed to expand almost everything but maintained two prohibitions: mass surveillance of Americans and fully autonomous weapons. Neither side yielded, and the impasse became punishment in February 2026.

The relationship went back further. According to the decision, the Pentagon and intelligence services have used Claude in classified systems since 2024, through contracted companies. In July 2025, Anthropic entered into an AI contract with a ceiling of $200 million. That is the maximum amount provided for, not what was paid, and the company itself announced it as a two-year agreement.

Anthropic's two red lines

The company never accepted two uses, and explained why in a statement by Dario Amodei, its president, published on February 26.

The first is mass domestic surveillance. Today, the U.S. government can purchase location and browsing data on citizens without a warrant. Alone, this data says little. With a powerful AI, it becomes a complete portrait of any person's life, assembled automatically. For Anthropic, this is incompatible with democratic values.

The second is fully autonomous weapons: systems that choose the target and fire without any person in the process. The company does not say this is wrong forever. It says current technology is not reliable enough, and that it will not deliver a product that puts military personnel and civilians at risk.

Anthropic supports partially autonomous weapons, where a person still decides, and claims to have offered the Pentagon joint research to make systems more reliable. According to the statement, the offer was not accepted.

What the Pentagon wanted

The Pentagon wanted a simple rule: whoever decides how to use a military tool is the government, not the manufacturer. On January 9, 2026, Hegseth published an AI strategy mandating the inclusion of an "any lawful use" clause in all contracts and the use of models free from use policies—the manufacturer's rules about what the product can or cannot do—when they limit military applications.

The final deadline was short. Hegseth met with Amodei on February 24 and gave until the 27th for the company to accept. On the 26th, Anthropic refused publicly. On the 27th, Trump and Hegseth attacked the company on social media, as Ars Technica reported, and the exclusion process began.

What remains is to explain what the label that caused all this actually is.

What is "supply chain risk"?

"Supply chain risk" is a legal label that allows the U.S. government to exclude a technology supplier for national security reasons. Whoever receives the label is removed from the agency's systems, and contracted companies are prohibited from using the product in the service they provide to it.

A supply chain is the set of companies behind a product. Think of a restaurant: the dish depends on the butcher, the produce supplier, the gas distributor. If one of them fails, or acts in bad faith, the problem reaches the table. The government worries about the same thing in the computers it uses.

The classic example is network equipment manufactured by a company linked to a rival government, which could hide a backdoor for spies. The rule was created for cases like this. According to Anthropic, the label was reserved for adversaries of the United States and had never been publicly applied to an American company.

Why does this matter to you? Because the label has just gained a new use. It has ceased to serve only against hidden sabotage and now applies against a supplier that openly states what its product will not do.

Two courts, two answers: how is this possible?

It is possible because the government used two different laws to punish Anthropic, and each law is judged in a different court. Both use the same expression, "supply chain risk," but with different definitions. One requires an adversary acting in bad faith. The other speaks of "any person." The company won on the first and lost on the second.

This is the point the headlines left out. There was no court overruling the other. There were two courts reading two texts.

The California law: only applies against "adversary"

The first law is section 3252 of Title 10 of the U.S. code, which deals with the Armed Forces. It defines the risk as the possibility of an adversary sabotaging, maliciously introducing an unwanted function, or subverting a system.

On August 27, 2026, the federal court for the Northern District of California struck down the label based on this law. The reasoning: the word "adversary," combined with verbs like "sabotage" and "subvert," requires malicious intent. And Anthropic did not act with malicious intent in negotiating with the Pentagon.

According to Ars Technica's coverage, the California decision went further and considered the measure retaliation against the company for publicly defending its positions.

The Washington law: applies against "any person"

The second law is section 4713 of Title 41, created in 2018. It is the Federal Acquisition Supply Chain Security Act, known by the acronym FASCSA. It defines the risk as the possibility of any person sabotaging, introducing a malicious function, extracting data "or otherwise manipulating" a product, so as to surveil, deny, disrupt, or manipulate its operation.

Two words decided the case. "Any person" is not limited to foreign enemies. And to "deny" the use of a product, for the majority, does not presuppose malice. An AI that refuses to execute a task requested by the government is denying a function, with or without good intention.

Congress also determined that only the Washington court can review measures taken under section 4713. That is why Anthropic had to file two lawsuits, one in each place.

The two decisions side by side

The most curious thing: the Washington court agreed with California. The majority accepted both of California's conclusions: that law requires bad faith, and Anthropic did not have bad faith. But under the broader law, that is not necessary.

In one sentence: Anthropic was found innocent of sabotage in both courts, and even so remains excluded from the Pentagon, because one of the laws does not require sabotage.

The winning argument: an AI that can say "no"

The winning argument is that Anthropic controls Claude's behavior through training, and uses that control to prevent tasks it disapproves of. For the Pentagon, this creates uncertainty: a defense system relying on Claude could stop responding at a critical moment. The majority considered this concern reasonable.

Here a technical term comes in. Training is the process by which an AI model learns patterns from enormous volumes of text. It is like the education of a professional: after graduating, they carry values and habits to any job. Anthropic trains Claude to follow a set of principles, which the company calls a constitution. It is an internal document, unrelated to the country's Constitution.

This matters because the restrictions are not only in the contract. They are inside the model. An Anthropic director stated in the case that training is the primary mechanism by which the company influences the models used by the Department.

The decision cites three concrete episodes:

1. Refusals in classified systems. In 2024, standard versions of Claude refused to summarize threat assessments, process classified documents, and translate intercepted material describing violence. Anthropic responded by creating a specific model, Claude Gov.
2. The overseas operation. An Anthropic executive questioned the use of Claude by a contractor in a sensitive military operation. The Pentagon does not say which one. Reports attached by the company itself point to the January 3 operation that captured Nicolás Maduro in Venezuela.
3. The CDC case. Claude refused to answer questions from the Centers for Disease Control and Prevention, the country's public health agency, about sensitive infection prevention research. For the Pentagon, it was further proof that training makes the model deny requests from the government itself.

One point weighs in Anthropic's favor and the decision acknowledges it. The company cannot access or alter a model already delivered to the government. In June, the secretary himself clarified that the determination did not depend on Anthropic being able to modify an already delivered model. The risk identified is in the training of current models and future versions.

The conclusion of the opinion summarizes the dilemma. On one side, overly restricted models that stop in the middle of an operation. On the other, unrestricted models that invent targets for an attack. Both scenarios are concerning, the majority wrote, but who weighs these risks is the president and the secretary, not a court and not a supplier.

The dissent: "this is not what Congress imagined"

Judge Karen Henderson voted in favor of Anthropic. For her, the 2018 law was written to deter hostile groups that infiltrate government systems, not to punish a supplier that honestly and openly applies its own product's restrictions. The majority's reading, in her view, stretched the text too far.

The argument is one of reading a list. When the law strings together "sabotage," "introduce a malicious function," and "extract data," and then says "or otherwise manipulate," the last verb inherits the meaning of the previous ones. A word is understood by the company it keeps. And the company there is all deliberate and deceptive acts.

A comparison helps. If a sign prohibits "breaking in, stealing, or otherwise entering" a building, no one concludes that the doorman is prohibited from opening the door. The context shows the rule targets those who enter wrongfully.

Henderson also sketched the consequence. Suppose the secretary demands that the company replacing Anthropic change its rules, under penalty of receiving the same label. Under the decision, that supplier will have to choose between accepting the demands or being treated as a national security threat.

"I cannot agree that this is the scenario Congress had in mind," the judge wrote. It is the most quoted passage of the dissent, and the one likely to appear in any appeal.

What changes now for Anthropic and Claude?

In practice, Claude remains excluded from Department of Defense systems, and contracted companies cannot use Anthropic products in the work they do for the agency. Everything else remains the same: ordinary customers, private companies, and the use of Claude by these same contractors on projects unrelated to the Pentagon.

This corrects a common exaggeration. In February, Hegseth announced that no company doing business with the military could have any commercial relationship with Anthropic. The company responded the same day that the law does not give that reach, and that access for individual and commercial customers would not be affected.

And the California victory, what did it free up? According to Ars Technica, that decision struck down the broader measures: the order for all federal agencies to stop using Anthropic products and the ban on any business between the company and military suppliers. It does not require the Pentagon to use Claude.

The Pentagon, for its part, moved to supply itself elsewhere. The decision records that the agency rapidly expanded its contract with OpenAI, owner of ChatGPT. Amodei wrote to employees that, in his opinion, this new arrangement lacked adequate safety protocols.

The financial cost to Anthropic is not public. Wired reported that the company reported revenue loss shortly after the labels and has not updated the figures since.

If you follow U.S. AI policy, this case is the other side of a dispute we covered in Trump, Nvidia, OpenAI and Anthropic in the fight over regulation.

Can Anthropic appeal?

It can, by two paths. The first is to ask that all judges of the same court reexamine the case, what Americans call an en banc hearing (with the full court). The second is to take the question to the Supreme Court. The company has not yet said which it will choose.

In a statement sent to the press and reproduced by Ars Technica, Anthropic said it disagrees with the decision, noted that another federal court found the parallel label illegal, and stated it is evaluating all options, including further appeal.

Do not expect a quick answer. The case took more than six months between the initial request in March and the September decision, even proceeding on an expedited basis. Until an appeal is accepted and decided, the exclusion stands.

There is also a way out outside the courts: negotiation. The Washington law leaves the decision in the secretary's hands, and what one secretary signs, he or his successor can revoke. The majority opinion insists on this point in saying the dispute is, at bottom, contractual.

What this teaches those who use AI

For those who use AI anywhere in the world, the decision does not change access to Claude, but it leaves a practical lesson: every AI you contract comes with the manufacturer's values and limits built in, and they can weigh more than the contract. It is worth knowing these limits before building an entire process on top of a single model.

This is the part of the case that applies outside the United States. The Pentagon discovered, on a military scale, what many companies discover in daily work: the model sometimes refuses, and the reason is in the training, not in a setting you can turn off.

An opinion, labeled as opinion: both sides have a point. An army cannot operate with a tool that might freeze. And a company that finds its own technology unreliable for killing without human supervision has a duty to say so. The discomfort is in the remedy chosen, a label designed for spies.

If the subject interests you, our artificial intelligence page gathers other articles about the companies and rules shaping this technology.

Frequently asked questions

Was Claude banned in the United States?

No. The exclusion applies to Department of Defense systems and to the work contracted companies do for it. Individuals and private companies continue using Claude normally, including Pentagon contractors on projects unrelated to the agency.

Does the decision affect those who use Claude outside the United States?

It does not. The measure concerns U.S. government procurement in defense. Subscriptions, use through the API (the access point for programmers), and commercial contracts remain the same, as Anthropic itself informed customers in February.

Why did Anthropic win in one court and lose in another?

Because each court analyzed a different law. The law judged in California only permits the label against an adversary acting in bad faith, and the company did not act that way. The law judged in Washington speaks of "any person" and, according to the majority, does not require bad faith.

What did Anthropic refuse to do?

It refused to release Claude for two uses: mass surveillance of American citizens and fully autonomous weapons, which choose the target and fire without human participation. The company states it supports other lawful uses of AI in national security, including overseas espionage and partially autonomous weapons.

What are fully autonomous weapons?

They are systems that identify a target, decide to attack, and execute the shot without any person approving the action. Anthropic says current AI still makes too many mistakes to assume that responsibility alone, and therefore does not provide Claude for that purpose.

Is the decision final?

Not yet. Anthropic can request a new hearing with all judges of the Washington court or appeal to the Supreme Court. Until then, the exclusion continues to apply, and the favorable California decision also stands.

The case began as a contract clause and ended up defining who has the final word on what an AI can refuse. For now, in the United States, that word belongs to the government. The next chapter is the appeal.