Pentagon blacklisting of Anthropic survived its most important legal test on Friday 25 September 2026. A three-judge panel of the US Court of Appeals for the District of Columbia Circuit denied Anthropic’s petitions for review and upheld the Department of War’s decision to exclude Claude from its supply chain as a national security risk. The vote was 2-1. Judge Gregory Katsas wrote for the court, joined by Judge Neomi Rao. Judge Karen LeCraft Henderson dissented.
Reuters’ first headline said the court “declined to block” the Pentagon blacklisting order, which undersells what happened. This was not a refusal to pause the Pentagon blacklisting while the case continued. The court heard the case in full, ruled on the merits, and entered judgment against Anthropic. The 43-page majority opinion rejects every argument the company made: that the Pentagon blacklisting was arbitrary, that the statute did not authorise it, that it denied due process, and that it punished protected speech.
The ruling also sits awkwardly beside a decision from a month ago. On 27 August a federal judge in California set aside a second designation of Anthropic under a different law, calling the government’s measures “illegal and baseless”. Both rulings now stand, and they point in opposite directions. This article explains what the D.C. Circuit decided, why the two courts reached different results, what Judge Henderson warned about, and what the Pentagon blacklisting now means for defence contractors, for Anthropic’s planned IPO and for any AI company that sells to government.
Table of contents
- What the D.C. Circuit Decided on the Pentagon Blacklisting
- How the Pentagon Blacklisting Began
- Two Statutes, Two Courts and Two Results
- Why the Majority Upheld the Pentagon Blacklisting
- Judge Henderson’s Dissent From the Pentagon Blacklisting Ruling
- What the Pentagon Blacklisting Means for Contractors
- The Pentagon Blacklisting and Anthropic’s IPO
- What Happens Next in the Pentagon Blacklisting Fight
- Frequently Asked Questions About the Pentagon Blacklisting
- References
What the D.C. Circuit Decided on the Pentagon Blacklisting
The judgment itself is one sentence long. “ORDERED and ADJUDGED that the petitions for review be denied, in accordance with the opinion of the court filed herein this date.” It covers two consolidated cases, Nos. 26-1049 and 26-1162, both titled Anthropic PBC v. United States Department of War. The first challenged the original determination of 3 March. The second challenged the Secretary’s 3 June refusal to reconsider it.
A merits loss on the Pentagon blacklisting, not a stay decision
The difference matters for anyone following the Pentagon blacklisting. In April the same panel refused Anthropic’s request for an emergency stay, a preliminary step that left the Pentagon blacklisting in force while the court heard the case. Friday’s decision on the Pentagon blacklisting is the final word from the panel after full briefing, oral argument on 19 May and two rounds of supplemental briefs. Anthropic can still ask the full D.C. Circuit to rehear the case or ask the Supreme Court to take it, but it no longer has a live challenge in front of this panel.
What the court actually held
Judge Katsas summarised the Pentagon blacklisting holding in his opening paragraphs. “The Department had ample support for its conclusion that the continued integration of Claude into the Department’s information systems, by the Department or its contractors, presented a statutorily covered national-security risk,” he wrote. Anthropic’s constitutional claims were “also without merit”. The due process claim failed because the Department notified Anthropic promptly and then gave it a fair chance to respond. The First Amendment claim failed because the Pentagon blacklisting rested on a contract dispute, not on Anthropic’s advocacy.
Who argued the Pentagon blacklisting case
Kelly Dunbar argued for Anthropic and Sharon Swingle of the Justice Department argued for the government. The case drew an unusual crowd of friends of the court. Supporting Anthropic were former Secretary of Defense Leon Panetta, 149 former judges, former service secretaries and retired senior officers, employees of OpenAI and Google writing in a personal capacity, the ACLU, the Electronic Frontier Foundation and four technology trade associations. One amicus brief supported the government, from a senior fellow at the America First Policy Institute.
How the Pentagon Blacklisting Began
The opinion sets out the history of the Pentagon blacklisting in more detail than any earlier filing that was publicly summarised. It starts with a product decision. In 2024 the Department and intelligence agencies began using commercial Claude models on classified systems through contractors. Those models refused some tasks that were appropriate in a national security setting, such as summarising threat assessments or translating intercepted material describing violence. Anthropic responded by building a separate Claude Gov model, released in March 2025, and a government addendum to its usage policy.
The two red lines
Over time Anthropic allowed the Department to use Claude to design weapon systems, analyse foreign intelligence and run offensive cyber operations. It kept two prohibitions: no use for lethal autonomous warfare and no mass surveillance of Americans. When the two sides began negotiating a direct contract in autumn 2025, the Department asked for permission to use Claude for “all lawful uses”. Anthropic relaxed most restrictions but refused to drop those two, which it called “two critical exceptions”.
The “all lawful uses” ultimatum
On 9 January 2026 Secretary of War Pete Hegseth issued a strategy memo directing the Department to become an “AI-first” warfighting force and to write “any lawful use” language into AI contracts. Around the same time, an Anthropic executive questioned whether a contractor’s use of Claude in a sensitive military operation abroad was allowed. Media reports in the record linked that to the 3 January operation to capture Venezuela’s president, Nicolás Maduro. On 24 February Hegseth gave Dario Amodei a deadline of 27 February. Anthropic refused publicly on 26 February.
| Date (2026) | Event | Source |
|---|---|---|
| 3 January | Military operation to capture Nicolás Maduro, later linked in media reports to an Anthropic query | Opinion, App. 171 |
| 9 January | Hegseth strategy memo demands “any lawful use” terms | Opinion, App. 202-206 |
| 26 February | Anthropic publicly refuses the “all lawful uses” term | Opinion, App. 146-147 |
| 27 February | Trump and Hegseth denounce Anthropic on social media | Opinion, App. 77 |
| 3 March | Formal determination under 41 U.S.C. § 4713 | Opinion, App. 177 |
| 6 March | Department memo orders removal within 180 days | Opinion, App. 80 |
| 9 March | Anthropic files its first petition in the D.C. Circuit | Docket 26-1049 |
| 8 April | D.C. Circuit denies a stay, expedites the case | 2026 WL 1042493 |
| 19 May | Oral argument before Henderson, Katsas and Rao | Docket 26-1049 |
| 3 June | Secretary denies reconsideration | Opinion, Suppl. Add. 1 |
| 27 August | California court vacates the separate § 3252 designation | N.D. Cal. 26-cv-01996 |
| 25 September | D.C. Circuit denies both petitions, 2-1 | Judgment, Nos. 26-1049 and 26-1162 |
The determination that started the Pentagon blacklisting
On 3 March Hegseth signed the formal determination. He found that Claude “presents a significant supply chain risk”, that removing it was “necessary to protect national security”, that no “less intrusive measures” were reasonably available, and that an “urgent national security interest” justified acting before giving Anthropic a chance to respond. On 6 March the Department’s Chief Information Officer ordered Anthropic products removed “as soon as practical” and within 180 days at most, and barred contractors from using them on Department work. The Pentagon blacklisting was in force from that point.
Two Statutes, Two Courts and Two Results
The confusing part of the Pentagon blacklisting dispute is that the Department used two separate legal powers against Anthropic, and Congress sends challenges to each of them to a different court. That is why a judge in San Francisco and a panel in Washington have reached opposite outcomes within a month without either one being overruled.
The California ruling on § 3252
The first power is 10 U.S.C. § 3252, a Defense Department supply chain authority. Anthropic challenged it in the Northern District of California. Judge Rita Lin granted a preliminary injunction on 26 March and final relief on 27 August. Her order declared that the challenged actions violated the First Amendment and the Due Process Clause, vacated the § 3252 designation, and vacated the part of Hegseth’s directive that told any company doing business with the military not to conduct “any commercial activity with Anthropic”. It also set aside steps taken by nine agencies to carry out the President’s directive to stop using Anthropic.
The D.C. Circuit ruling on § 4713
The second power is the Federal Acquisition Supply Chain Security Act of 2018, codified at 41 U.S.C. § 4713. That statute routes challenges exclusively to the D.C. Circuit and bars other courts from reviewing “any action taken under” it. Friday’s decision concerns only this part of the Pentagon blacklisting, which is the one Under Secretary Emil Michael meant on 3 September when he wrote that “Anthropic is still a designated Supply Chain Risk” at the Department “and for the Defense Industrial Base”.
| Question | § 3252 designation | § 4713 (FASCSA) designation |
|---|---|---|
| Who can be a risk | “an adversary” | “any person” |
| Catch-all verb | “or otherwise subvert” | “or otherwise manipulate” |
| Court with jurisdiction | Federal district court (N.D. Cal.) | D.C. Circuit only |
| Result so far | Vacated on 27 August | Upheld on 25 September |
| Does bad motive matter | Yes, according to both courts | No, according to the majority |
| Contract clauses that enforce it | DFARS 252.239-7017 and -7018 | FAR 52.204-28, -29 and -30 |
Why the majority said California does not control
Anthropic argued that Judge Lin’s ruling should bind the D.C. Circuit. The majority disagreed in a footnote. It said it had “no quarrel” with the California court’s reading of § 3252 or with its finding that Anthropic acted without bad motive. But § 3252 turns on an “adversary” and on verbs with a “sinister connotation”, while § 4713 covers “any person” and the neutral verb “manipulate”. Because Congress gave the D.C. Circuit exclusive jurisdiction over § 4713, the court said it would be inappropriate to constrain its review based on another court’s judgment.
Why the Majority Upheld the Pentagon Blacklisting
The core of the opinion is a reading of the statutory definition of “supply chain risk”. It means the risk that “any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity” or “operation” of a covered product “so as to surveil, deny, disrupt, or otherwise manipulate” its function or use. Everything in the Pentagon blacklisting case depended on the word “manipulate”.
Model training counts as manipulation
The majority read “manipulate” in its ordinary sense: to operate or control something skilfully. On that reading, Anthropic’s own evidence settled the question. Its chief science officer said the company embeds safety considerations “directly into the model itself”. Its public-sector head said model training is “the primary mechanism” through which Anthropic influences models used by the Department. So, the court said, there is “not only a ‘risk’—but a certainty” that Anthropic will shape Claude’s design to deny it the function of autonomous warfare or mass domestic surveillance.
Motive does not matter under this statute
The line most likely to be quoted from the opinion is about intent. “We have no reason to doubt that Anthropic manipulates Claude’s function, use and operation with noble intentions,” Judge Katsas wrote, “whether a principled commitment to personal privacy or a genuine concern about AI safety. But at least as applied here, the statutory definition of a ‘supply chain risk’ turns on what Anthropic does, not why Anthropic does it.” That is the single sentence on which the Pentagon blacklisting now rests.
Why model testing did not defeat the Pentagon blacklisting
Anthropic’s main factual defence was that it has no “back door or remote ‘kill switch'” once a model reaches a classified system, so the Department could test each new model and refuse any that misbehaved. The majority gave three reasons for rejecting that. The contested restrictions are “hardly self-defining”. The Department said Claude’s models have “approximately 5 to 10 trillion” parameters, making full auditing impossible. And Claude can answer similar prompts differently depending on wording, so one official’s test result may not predict the next official’s request.
AI that cannot be “trapped in amber”
The court also rejected the idea that the Department could simply keep using an older model it had approved. Anthropic released three new versions of Claude Gov in 2025 alone, and both sides agreed the technology was improving at “unprecedented velocity”. “Quite obviously, the Department cannot utilize AI systems that remain trapped in amber,” the majority wrote. A buyer that must refuse every upgrade to stay safe, it reasoned, does not have a workable alternative to the Pentagon blacklisting.
Less intrusive measures and urgency
On the requirement that no less intrusive measures were available, the court noted that Anthropic all but accepted the Department could have ended its subcontracts anyway. The company’s real complaint was the stigma of being branded a national security threat. The court doubted any harm, observing that Anthropic had reportedly received investment offers valuing it at more than $900 billion since the determination. On urgency, the court found any error harmless because Anthropic had received the full record by 19 March and its later submissions did not change the Secretary’s mind.
The First Amendment claim failed on causation
The majority accepted that Anthropic’s advocacy on AI safety is protected speech and that exclusion is a materially adverse action. It found no causal link between the two. Anthropic had advocated for safety limits since its founding, yet the Department included it in a $200 million AI contract in July 2025 and kept negotiating after Amodei published a long essay in January 2026. The Department acted only after Anthropic refused the contract term. Hegseth’s post calling Anthropic’s position “sanctimonious rhetoric” and “virtue-signaling” did not change that, the court said, because the same post was about access “for every lawful purpose”.
Judge Henderson's Dissent From the Pentagon Blacklisting Ruling
Judge Henderson’s eight-page dissent turns on the same word. She argued that “manipulate”, read in the company of “sabotage”, “maliciously introduce unwanted function” and “extract data”, means to “manage, control, or influence in a subtle, devious, or underhand manner”. Under that reading, an AI company that enforces openly declared usage limits does not pose a supply chain risk at all.
The library sign
She illustrated the point with a hypothetical library rule: “Do not shout, loudly talk on the phone, play music, or otherwise disturb others.” Most readers, she said, would understand that the rule bans a boom-box at full volume but not music on headphones at a modest level, because “loudly” carries across the list. In the same way, “maliciously” should limit “extract data” as well as “introduce unwanted function”, which would make the whole definition about hostile acts.
The warning about the next vendor
The most pointed passage looks ahead. Under the majority’s reading, Henderson wrote, a contractor is a supply chain risk if it is “willing and able to enforce contractual restrictions” the Department considers too tight, even restrictions the Department previously agreed to, and even if they stop uses that would be unlawful. “Suppose the Secretary tells Anthropic’s presumed replacement to change its AI-use policies,” she wrote. That contractor would then face a choice: agree, or risk being designated a national security threat.
What Congress had in mind
Henderson also relied on the history of the 2018 Act. The Senate committee report described threats from “hostile nation state and other bad actors” infiltrating federal systems through supply chains, and intelligence officials had warned about companies “beholden to foreign governments”. That history, she said, refutes the idea that “manipulation” covers “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government”. The majority declined to use legislative history to read the verbs.
What the Pentagon Blacklisting Means for Contractors
For companies that hold Department of War contracts, Friday’s ruling on the Pentagon blacklisting removes the main uncertainty. The § 4713 designation, which is the one that binds defence work, has been upheld. The March memo gave the Department up to 180 days to remove Anthropic products, a window that ran out in early September, and Under Secretary Michael told staff on 29 August that removal from all Department systems would be finished by the end of September, according to Tech Times.
Which contracts the Pentagon blacklisting affects
According to Mayer Brown’s government contracts team, the FASCSA designation is enforced through FAR clauses 52.204-28, -29 and -30. Those clauses require monitoring, reasonable inquiry, reporting within three business days when covered use is found, and mitigation. As invoked against Anthropic, the firm says, the designation currently applies only to Department of War contracts, and the government has acknowledged in court that it does not bar commercial use of Anthropic outside covered Department work.
What changed in California still matters
The California ruling means the broader measures remain off the table. The order vacated Hegseth’s instruction that no company doing business with the military may conduct any commercial activity with Anthropic. It also set aside the steps taken by the Departments of State, Treasury, Homeland Security and Energy, and by OPM, the NRC, the FHFA and the GSA, to implement the President’s directive. So the Pentagon blacklisting now bites on defence contract performance, not on a company’s general use of Claude.
| Situation | What applies after 25 September | Practical step |
|---|---|---|
| Performing a Department of War contract with Claude inside the deliverable | § 4713 designation in force | Remove, report under the contract clause, document cost impact |
| Using Claude in internal business systems that support defence work | Depends on the clause and the request received | Check the contract for FAR 52.204-29 and -30 before certifying |
| Using Claude only for commercial, non-federal work | Not barred by either designation as now applied | Record the separation between federal and commercial use |
| Civilian agency contracts | Presidential-directive actions vacated by N.D. Cal. for nine agencies | Follow the contracting officer’s current written guidance |
| Subcontractor receiving a prime’s own certification form | Scope may exceed the actual clause | Answer precisely and avoid certifying more than was verified |
How to answer a certification request
Mayer Brown reported in July that agencies and prime contractors were sending materially different certification requests, some ending with warnings under the False Statements Act. Its advice was to identify the source of each request, check which clauses are actually in the contract, inventory Anthropic use by category, avoid over-broad certifications and preserve rights to cost and schedule relief. That advice is more relevant now that the Pentagon blacklisting has been upheld, not less. Organisations reviewing this should treat it as an IT governance and compliance question, not only a procurement one.
The Pentagon Blacklisting and Anthropic's IPO
Reuters reported that Anthropic says the Pentagon blacklisting has cost it billions of dollars in lost business and damaged its reputation ahead of a highly anticipated initial public offering. That is the commercial stake behind the legal one. Anthropic has been preparing for a listing, and it recently sought 50.1% voting control for its co-founders, a structure we examined in our piece on Anthropic’s founder voting control.
The Pentagon blacklisting as an IPO risk factor
Before Friday, the D.C. Circuit case was an open question that an offering document could describe as pending. It is now a loss at the appellate level, with further review possible but uncertain. Any prospectus will need to explain that one federal court has called the government’s measures unlawful retaliation while another has upheld a Pentagon blacklisting of the same company on the same facts. Investors will read that as a lasting constraint on defence revenue, whatever happens to the civilian market.
Commercial momentum continues regardless
The dispute has not stopped Anthropic’s commercial expansion. Its $11.6 billion cloud deal with Akamai, announced the day before the ruling, is covered in our analysis of the Akamai Anthropic deal. Commerce Secretary Howard Lutnick said on 2 September that Anthropic was “back on the right side”, and the government has worked with Anthropic’s Mythos model on cybersecurity. The relationship with the civilian government is warmer than the relationship with the Department of War.
What Happens Next in the Pentagon Blacklisting Fight
Anthropic has not yet said publicly whether it will seek further review, and at the time of writing no statement on the ruling had been reported. The clerk entered a routine order withholding the court’s mandate, which gives the parties time to file for rehearing before the judgment formally takes effect.
Rehearing the Pentagon blacklisting case by the full court
Anthropic can ask all active D.C. Circuit judges to rehear the case. Under the federal appellate rules, when the United States is a party, a petition for rehearing is due within 45 days of the judgment. Full-court rehearing is rarely granted, but a split panel, a novel statute and a dissent that frames the stakes clearly are the conditions in which it is most often considered. A request would keep the Pentagon blacklisting case open into November at least.
The Supreme Court
A petition for certiorari is due within 90 days of the judgment, or of any order denying rehearing. The case would give the Court its first chance to decide how much deference national security procurement decisions receive when they collide with a vendor’s stated values. The majority opinion leans heavily on Trump v. Hawaii and Holder v. Humanitarian Law Project, both decisions that deferred to executive judgments on national security.
The California appeal and Congress
The government may still appeal Judge Lin’s ruling to the Ninth Circuit. The Washington Examiner reported on 3 September that no appeal had yet been filed, and Mayer Brown noted in July that an earlier appeal of her preliminary injunction had been stayed. Congress could also act. Henderson’s reading of the 2018 Act, as a law aimed at hostile foreign actors, would be simple to write into the statute if lawmakers wanted to narrow it.
| Path | Deadline or timing | What it could change |
|---|---|---|
| Petition for rehearing en banc | 45 days from 25 September | Full D.C. Circuit could vacate the panel ruling |
| Petition for certiorari | 90 days from judgment or rehearing denial | Supreme Court could decide the meaning of “manipulate” |
| Government appeal of N.D. Cal. ruling | Not filed as of early September | Ninth Circuit could restore the § 3252 designation |
| Department rescinds the designation | Any time | Would end the dispute without a court ruling |
| Congress amends § 4713 | No bill reported | Could require bad intent or a foreign link |
What the Pentagon blacklisting teaches other AI vendors
The ruling applies to one company, but its logic reaches every AI provider that sells to the US military. A vendor that trains refusals into its models, and says so in court, has told the government that it can shape how the product behaves. Under this reading of § 4713, that alone can support a Pentagon blacklisting if the Department decides it needs uses the vendor will not allow. Companies weighing defence work should build that into their AI strategy before signing, not after.
Frequently Asked Questions About the Pentagon Blacklisting
Did the appeals court block the Pentagon blacklisting of Anthropic?
No. The D.C. Circuit denied Anthropic’s petitions for review on the merits, 2-1, and upheld the Department of War’s decision under 41 U.S.C. § 4713 to exclude Claude from its supply chain.
Does the Pentagon blacklisting ruling overturn the California decision?
No. Judge Lin’s 27 August ruling concerned a different designation under 10 U.S.C. § 3252. The D.C. Circuit said it did not disagree with that ruling, but that § 4713 is broader and does not require bad motive.
Can private companies still use Claude?
Yes. Neither part of the Pentagon blacklisting, as now applied, bars commercial use of Claude outside Department of War contract performance. The instruction banning all commercial activity with Anthropic by military suppliers was vacated in August.
Who dissented, and why?
Judge Karen LeCraft Henderson argued that “manipulate” in the statute means covert or devious interference, so openly enforced usage limits are not a supply chain risk.
What can Anthropic do about the Pentagon blacklisting now?
It can seek rehearing by the full D.C. Circuit within 45 days or petition the Supreme Court within 90 days. The Department could also withdraw the Pentagon blacklisting at any time.
How does this affect Anthropic’s other government relationships?
Civilian agencies were covered by the California ruling, and Commerce Secretary Lutnick has described the relationship as repaired. The Department of War designation is separate and remains in force. Our earlier piece on Anthropic and the Trump administration traces how that relationship developed.
References
Anthropic PBC v. United States Department of War, No. 26-1049 (D.C. Cir.), docket
D.C. Circuit opinion, 25 September 2026 (Katsas, J.; Henderson, J., dissenting)
Anthropic PBC v. U.S. Department of War, No. 26-cv-01996 (N.D. Cal.), order of final relief
41 U.S.C. § 4713: Authorities relating to mitigating supply chain risks
10 U.S.C. § 3252: Requirements for information relating to supply chain risk
FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders
CNBC: U.S. appeals court upholds Pentagon designation of Anthropic as supply chain risk
Mayer Brown: DoW’s Anthropic ban goes live, a confusing patchwork of certification demands
TechCrunch: Anthropic gets its first court win over the Pentagon’s supply-chain risk label
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.
