Anthropic lost an important court fight with the Pentagon on Friday, but the dispute is much bigger than whether one AI company can sell Claude to the military.
At the center of the case is a question that governments, AI companies and enterprise customers are going to confront more often as artificial intelligence moves deeper into critical infrastructure:
Who gets the final say over what an AI system is allowed to do after it has been deployed?
A divided U.S. appeals court upheld the Pentagon’s decision to exclude Anthropic from its supply chain after the company refused to remove two contractual restrictions from Claude.
Anthropic would not permit the model to be used for lethal autonomous warfare or mass domestic surveillance.
The Pentagon wanted contractual authority to use Claude for any lawful purpose.
That disagreement eventually moved from contract negotiations to a national-security supply-chain designation, federal litigation and now a 2-1 appellate ruling.
The court sided with the Pentagon under the Federal Acquisition Supply Chain Security Act, concluding that the department could reasonably view Anthropic’s ability to technically and contractually restrict Claude as a risk to military operations.
But one judge dissented, arguing that the statute was designed to address hostile or deceptive interference in government supply chains rather than openly disclosed restrictions imposed by a technology provider.
That disagreement is what makes this case important beyond Anthropic.
AI safety is increasingly becoming a question of operational control.
And operational control becomes much harder to define when the software itself can decide, refuse, classify, recommend or act.
- A 2-1 U.S. appeals court decision upheld the Pentagon’s exclusion of Anthropic under a federal supply-chain security law.
- The dispute began after Anthropic refused to permit Claude to be used for lethal autonomous warfare or mass domestic surveillance.
- The Pentagon wanted permission for all lawful military uses of the model.
- The court majority concluded that Anthropic’s ability to restrict Claude could create operational uncertainty for military users.
- The dissent argued that the supply-chain law was meant to address hostile or deceptive interference, not transparent contractual safeguards.
- A separate California ruling against a parallel Pentagon designation involved a different statute and remains legally distinct.
- Anthropic says it disagrees with the appellate decision and is considering further review.
- The broader question is whether frontier AI vendors can retain control over model safeguards after their systems enter critical government or enterprise infrastructure.
What Did the Court Decide in the Anthropic Pentagon Case?
The U.S. Court of Appeals for the District of Columbia Circuit denied Anthropic’s challenge to the Pentagon’s exclusion of Claude from its supply chain.
The September 25 decision was issued by a three-judge panel in a 2-1 ruling.
The case centered on the Federal Acquisition Supply Chain Security Act of 2018.
That law allows federal agencies to restrict certain technology suppliers when an agency determines that their products create a qualifying national-security supply-chain risk.
In the court’s published opinion, the majority concluded that the Pentagon had sufficient grounds to treat Anthropic’s restrictions as such a risk.
The key issue was not whether Claude had been hacked or secretly compromised.
The Pentagon’s argument was that Anthropic retained the ability to limit what Claude could do after the model had been incorporated into military systems.
The court accepted the department’s concern that a model could become unavailable for an operational use if Anthropic’s restrictions conflicted with what the Pentagon considered necessary and lawful.
That is an unusual interpretation of supply-chain risk.
Traditionally, the phrase may make readers think about malicious chips, compromised software, foreign espionage or hidden backdoors.
Here, the alleged risk came from restrictions that Anthropic openly acknowledged.
Why Did the Pentagon Blacklist Anthropic?
The confrontation grew out of negotiations over how Claude could be used by the military.
The court record shows that Anthropic had already substantially expanded the national-security uses it permitted.
Claude could support areas including weapons-system design, foreign-intelligence analysis and offensive cyber operations.
But Anthropic continued to maintain two major restrictions.
It would not authorize Claude for:
- lethal autonomous warfare; or
- mass surveillance of Americans.
The Pentagon wanted Anthropic to replace those restrictions with contractual permission for all lawful uses.
Anthropic refused.
CEO Dario Amodei publicly explained the company’s position in February, saying Anthropic believed the technology was not sufficiently reliable for fully autonomous lethal weapons and that mass domestic surveillance raised fundamental civil-liberties concerns.
Anthropic’s public statement on the Pentagon negotiations also said it was prepared to continue supporting national-security work while retaining those two safeguards.
The Pentagon saw the issue differently.
Its position was that a private contractor should not retain a technical or contractual veto over lawful military decisions once its technology becomes embedded inside defense systems.
That disagreement eventually became the foundation for the supply-chain exclusion.
What Does the Anthropic Blacklist Actually Do?
The word blacklist can make the ruling sound broader than it is.
The legal mechanism at issue allows the Pentagon to exclude Claude from relevant government procurement and to restrict contractors from using Anthropic technology when performing certain work for the department.
It does not mean Claude has suddenly become illegal for American businesses or ordinary consumers.
Nor does this appellate decision independently ban Anthropic from every federal government relationship.
The ruling concerns a specific Pentagon supply-chain action under a specific federal statute.
That distinction is important because Reuters reported that Anthropic has faced multiple government actions arising from the same dispute.
Some overlap.
Legally, they are not identical.
Why Did the Court Treat AI Guardrails as a Supply-Chain Risk?
This is the most consequential part of the decision.
The majority focused on the fact that Anthropic does not merely publish policies telling customers what not to do.
The company can encode restrictions into Claude itself.
In other words, the model can sometimes refuse requests or limit functionality based on safeguards implemented by Anthropic.
The court said the record showed that these restrictions had previously prevented Claude from carrying out certain government-requested tasks.
The Pentagon therefore argued that if Claude became deeply integrated into a military system, an unexpected refusal or restriction could affect an operation.
The majority accepted that concern as falling within the statutory concept of manipulating, denying or disrupting the function of covered technology.
This is where the dispute moves beyond ordinary software licensing.
A conventional contractor can promise that a software feature will remain available.
A frontier AI system behaves less deterministically.
Its responses can depend on model behavior, safety classifiers, system prompts, policy layers, model updates and vendor-controlled infrastructure.
The Crypto Encounter has explored a similar control problem from a different angle in our analysis of autonomous AI agents. Once software receives authority to make decisions or take actions, the central security question shifts from what the software knows to what the software is permitted to do.
Why Did One Judge Dissent?
Judge Karen LeCraft Henderson disagreed with the majority’s interpretation of the supply-chain statute.
Her dissent focused heavily on what Congress meant by a supply-chain risk.
The law lists conduct such as sabotage, malicious introduction of unwanted functionality, extraction of data, surveillance, denial and disruption.
The dissent argued that those words should be read together as describing intentionally hostile, deceptive or subversive conduct.
Anthropic’s safeguards, by contrast, were disclosed openly.
The company was not accused of secretly inserting a backdoor into Claude and pretending the restriction did not exist.
It explicitly told the Pentagon which uses it would not permit.
The dissent therefore argued that transparent enforcement of contractual limitations should not automatically be treated the same way as malicious interference with a government technology supply chain.
This disagreement matters because the majority’s interpretation potentially gives government agencies considerable discretion when a technology provider retains control over how a product operates after deployment.
The ruling does not automatically resolve how far that principle reaches beyond this case.
Why Did Another Court Previously Rule for Anthropic?
The legal picture is more complicated than a single win or loss.
A federal judge in California previously struck down a parallel Pentagon designation involving Anthropic under a different law.
That court also blocked broader government restrictions affecting the company.
The D.C. Circuit addressed that earlier ruling directly.
It concluded that the California decision did not control the current case because the Pentagon had invoked a different statutory authority and Congress had given the D.C. Circuit specific jurisdiction over challenges under the Federal Acquisition Supply Chain Security Act.
So two things can be true at the same time.
Anthropic can prevail against one government action while losing against another.
That is why saying simply that “the courts approved the Anthropic blacklist” would be too broad.
The better description is that the appeals court upheld one specific supply-chain designation under one specific procurement law.
Reuters provides a useful overview of the September 25 ruling and the parallel litigation.
Can the Pentagon Still Use Claude?
The practical answer depends on the contract, system and procurement relationship involved.
The supply-chain exclusion gives the Pentagon authority to remove Anthropic technology from covered procurement arrangements and to prevent certain contractors from using Claude to perform department work.
That does not mean every Claude deployment vanishes from every government system instantly.
Technology transitions can involve contractors, existing systems, migration periods and operational dependencies.
Anthropic itself previously said that if the Pentagon chose to move away from Claude, it was prepared to support an orderly transition rather than disrupt ongoing military work.
The more important long-term effect is procurement.
If the designation remains in place, defense contractors may have strong incentives to standardize on other AI providers for Pentagon-linked systems rather than build around Claude.
That can influence technical architecture long after the original legal dispute ends.
Does the Ruling Mean Anthropic’s AI Safeguards Were Wrong?
No.
The court did not rule that autonomous weapons safeguards or restrictions on domestic surveillance are bad policy.
Nor did it rule that Anthropic’s safety concerns are scientifically unfounded.
The majority explicitly recognized serious risks on both sides.
The Pentagon argued that an AI model that refuses or stops operating during a military mission could create operational danger.
Anthropic argued that an unreliable AI system making decisions involving lethal force could create another kind of danger.
The court’s decision was primarily about who has legal authority to make that trade-off within this federal procurement relationship.
That is a crucial distinction.
The case resolves a statutory challenge.
It does not settle the technical debate over whether present-day frontier models are reliable enough for particular military applications.
Why This Case Matters for Every Frontier AI Company?
Anthropic may be the company in court, but the underlying problem is industry-wide.
Frontier AI providers increasingly control systems through several layers at once:
- model weights;
- system instructions;
- safety classifiers;
- usage policies;
- cloud access;
- API permissions;
- model updates; and
- account enforcement.
A customer can therefore pay for access to an AI system without possessing complete control over how that system behaves.
That arrangement is normal for many cloud products.
It becomes more complicated when the customer is a military, intelligence service, hospital, bank, utility or other institution that considers uninterrupted control operationally essential.
The same distinction between a secure product and a dependable operating system appears throughout digital finance.
Our analysis of why a crypto app can look safer than the infrastructure behind it makes a related point: the user interface is only one layer. Control often sits elsewhere.
What Does the Anthropic Case Say About AI Vendor Lock-In?
The ruling also highlights a procurement problem that will become more important as AI gets embedded deeper into enterprise systems.
An organization may begin by treating an AI model as a replaceable software tool.
That assumption becomes less realistic once the model is integrated into:
- internal workflows;
- decision-support systems;
- security operations;
- data pipelines;
- custom agents;
- proprietary applications; and
- mission-critical processes.
The deeper the integration, the more costly a provider change becomes.
That means procurement teams need to ask about safety-policy control before deployment, not after an operational disagreement emerges.
Who controls policy updates?
Can the provider disable functionality?
Can safeguards change without customer approval?
Can an organization run the system independently if the commercial relationship breaks down?
What happens to dependent applications when the underlying model changes?
Those are architecture questions as much as legal ones.
The Crypto Encounter has seen the same principle in decentralized finance, where a decentralized protocol can still depend on a centralized interface. Removing one dependency does not mean the whole system has become independent.
Why AI Safety Is Becoming an Infrastructure Question?
Much of the public discussion around AI safety still sounds like a debate over rules.
Should a model answer this request?
Should a company permit that use?
But once AI controls tools, workflows or physical systems, safeguards become part of the infrastructure itself.
A safeguard can stop an unsafe action.
It can also stop an action that the operator considers necessary.
That is not unique to military systems.
Banks may want AI systems that cannot transfer money outside predefined limits.
Crypto users may want autonomous agents that cannot empty entire wallets.
Businesses may want models prevented from exposing confidential information.
Governments may want systems that continue functioning in conditions the vendor did not anticipate.
The underlying problem is permission design.
The Crypto Encounter’s coverage of AI agents and delegated permissions shows why increased autonomy makes access control more important rather than less important.
Likewise, AI scam automation illustrates how quickly capable systems can scale harmful behavior when humans lose effective oversight.
Why Anthropic’s Own Security Research Makes the Dispute More Complicated?
Anthropic has continued publishing evidence that frontier models can be misused in sensitive domains.
Its September threat-intelligence work described attempts to use Claude for cyber operations, surveillance and conventional-weapons development.
The company says it disrupted identified misuse, banned accounts and strengthened safeguards.
That evidence supports Anthropic’s argument that powerful models require controls.
At the same time, it also strengthens the Pentagon’s concern that advanced AI is becoming operationally important enough that military users may resist depending on controls ultimately administered by an outside vendor.
Those positions are not exact opposites.
They arise from the same fact:
AI systems are becoming capable enough that access controls now have real operational consequences.
This pattern also appears in the broader digital-security ecosystem.
As our analysis of regulated crypto platforms explains, rules and safeguards can reduce risk without eliminating the underlying operational dependencies.
What Could the Ruling Mean for Anthropic’s Business?
Anthropic has argued that the supply-chain designation damaged its reputation and cost the company business.
Reuters reported that Anthropic says the dispute has resulted in billions of dollars in lost opportunities.
The company is also widely expected to pursue an eventual public listing, increasing the importance of questions around federal contracts, enterprise adoption and reputational risk.
At the same time, the court noted that Anthropic’s private valuation had continued rising even after the designation.
That means the commercial consequences are not simple.
A company can lose access to one strategically important customer while continuing to grow rapidly elsewhere.
The larger question may be whether defense contractors and highly regulated industries become more cautious about building critical systems around models whose policies remain partly controlled by the provider.
That issue will affect more than Anthropic.
Could Other AI Companies Face the Same Problem?
Potentially.
The decision does not automatically designate other AI providers as supply-chain risks.
But the legal reasoning is likely to be studied closely by companies selling AI into government systems.
If an AI provider retains the technical ability to restrict functions that a government agency considers necessary, procurement officials may ask whether that creates an operational dependency.
AI providers will have their own concerns.
If signing a government contract requires giving up every provider-level restriction on lawful use, companies may have to decide whether they are willing to accept uses they consider too risky even if those uses are legal.
That tension could shape future contracts through more precise use definitions, customer-specific models, isolated deployments, negotiated safety controls or systems where responsibility is distributed differently.
This is similar to a broader regulatory lesson visible in crypto.
As MiCA implementation has shown in Europe, once technology becomes institutional infrastructure, legal classification begins influencing architecture, operations and market access.
What Happens Next for Anthropic?
Anthropic told Reuters that it respectfully disagreed with the ruling and was evaluating its options.
The company specifically said it could seek review by the full D.C. Circuit rather than the three-judge panel that decided the case.
That means the litigation may not be over.
The parallel legal disputes also remain important because the September ruling concerns the Pentagon’s authority under one particular supply-chain law.
Meanwhile, the commercial relationship between Anthropic and the federal government has not followed a simple straight line.
Reuters has reported that some government agencies continued using Anthropic technology even while the Pentagon dispute remained active.
The story should therefore be watched across three separate tracks:
| Track | What to Watch |
|---|---|
| Legal | Whether Anthropic seeks full-court review and how parallel litigation develops |
| Procurement | Whether Pentagon contractors remove Claude or restructure how they use it |
| AI Governance | Whether future government contracts give customers greater control over model safeguards |
The Crypto Encounter View: The Real Battle Is Over the Kill Switch
The easiest way to describe this story is that Anthropic wanted safety rules and the Pentagon wanted fewer restrictions.
That framing is too simple.
The harder issue is control.
Anthropic built Claude.
It designed the safeguards.
It operates much of the infrastructure behind the model.
The Pentagon wanted to use that technology without allowing the vendor to retain final authority over lawful military applications.
Both sides therefore saw dependency in opposite directions.
Anthropic worried about giving a powerful customer access to uses the company believed the technology was not ready to perform safely.
The Pentagon worried about depending on a powerful vendor that could determine when an embedded AI system should refuse.
That is the part of the case that will survive even if future courts change the legal outcome.
Frontier AI is moving from an application layer into infrastructure.
Once that happens, safety controls stop being merely product features.
They become authority.
The same issue appears whenever technology mediates access to money, data or critical systems.
Cold storage does not solve every exchange dependency.
A secure-looking financial interface does not eliminate platform control.
Powerful AI does not eliminate the need for human verification.
And an AI safeguard is not simply a line of policy text when the system can enforce it itself.
The Anthropic case therefore points toward one of the hardest governance questions of the AI era:
When software becomes critical infrastructure, who gets to hold the final switch?
Frequently Asked Questions About the Anthropic Pentagon Blacklist
Why Did the Pentagon Blacklist Anthropic?
The Pentagon designated Anthropic as a supply-chain risk after the company refused to remove restrictions preventing Claude from being used for lethal autonomous warfare and mass domestic surveillance. The Pentagon wanted contractual permission for all lawful military uses.
Did Anthropic Lose Its Court Case Against the Pentagon?
Anthropic lost this specific D.C. Circuit challenge. A 2-1 panel upheld the Pentagon’s exclusion under the Federal Acquisition Supply Chain Security Act. Other litigation involving parallel government actions has involved different statutes and outcomes.
Is Claude Banned Across the Entire U.S. Government?
No. The September appellate ruling concerns a specific Pentagon procurement action under a federal supply-chain law. It should not be interpreted as a blanket legal ban on Claude for every government agency or commercial user.
Can Private Companies Put Safety Restrictions on AI Used by the Government?
Companies can negotiate contractual and technical restrictions, but this case shows that a government agency may reject those restrictions when it considers them incompatible with operational or national-security requirements. The legal outcome can depend on the governing contract and statute.
What AI Uses Did Anthropic Refuse to Allow?
Anthropic retained two disputed restrictions: lethal autonomous warfare and mass surveillance of Americans. The company had already permitted many other national-security uses of Claude.
Why Did the Appeals Court Call Anthropic a Supply-Chain Risk?
The majority concluded that Anthropic’s ability to technically restrict Claude could deny or disrupt functions the Pentagon might lawfully require. It therefore found that the department’s interpretation fell within the relevant supply-chain statute.
Why Did One Judge Disagree With the Ruling?
The dissent argued that Congress designed the supply-chain law to address hostile, deceptive or malicious interference, not openly disclosed contractual restrictions imposed by a supplier.
Did Another Court Previously Rule in Anthropic’s Favor?
Yes. A federal judge in California previously struck down a parallel designation and blocked broader government restrictions. The D.C. Circuit said that ruling involved different statutory authority and did not control the case before it.
Can Anthropic Appeal Again?
Anthropic said it is considering its options, including asking the full D.C. Circuit to review the three-judge panel’s decision.
Does the Ruling Prove Claude Is Safe for Autonomous Weapons?
No. The court did not determine that Claude or other frontier AI models are technically safe for autonomous lethal applications. The ruling addressed the Pentagon’s statutory authority to exclude Anthropic from its supply chain.
Why Does the Case Matter Outside the Military?
The dispute raises a broader enterprise question about who controls AI behavior after deployment. Banks, hospitals, infrastructure operators and other organizations may face similar tensions when vendor-controlled safeguards affect mission-critical systems.
What Should Businesses Learn From the Anthropic Case?
Organizations adopting frontier AI should define governance before deep integration. Contracts should address model updates, safety controls, service continuity, provider restrictions, fallback systems, data access and what happens if the customer and AI provider disagree about permitted use.
Disclaimer
This article is for informational and educational purposes only. It does not constitute legal, investment, financial, national-security or policy advice. The Anthropic litigation remains active and legal outcomes may change through further review or related proceedings. Readers should consult official court records and qualified professionals for legal interpretation.