Anthropic Won Its Pentagon Blacklist Case. So Why Is It Still a “Supply Chain Risk”?

Anthropic won a final federal-court judgment on August 27, 2026, striking down one Pentagon supply-chain designation and the broader government measures built around it. But Anthropic is not entirely off the Pentagon’s blacklist.

The apparent contradiction has a surprisingly straightforward explanation: there are two different supply-chain actions under two different federal statutes.

U.S. District Judge Rita F. Lin ruled that the government’s designation of Anthropic under 10 U.S.C. §3252, along with a sweeping contractor boycott and related agency actions, violated the First Amendment, denied Anthropic required Fifth Amendment process, exceeded the statute and was arbitrary and capricious. Her final order vacated that designation. (Justia Dockets & Filings)

But a separate Pentagon determination under 41 U.S.C. §4713, part of the federal acquisition supply-chain-security framework, remains before the U.S. Court of Appeals for the D.C. Circuit. On September 3, the government expressly argued that Judge Lin’s ruling did not erase that second designation because it involved a different law, scope and administrative process. Pentagon Under Secretary Emil Michael likewise said Anthropic remained a designated supply-chain risk. (Law360)

So the most accurate short version is:

Anthropic won the California blacklist case, but it has not yet won the entire legal fight over whether the Pentagon may exclude it as a supply-chain risk.

The ruling is also narrower—and in some respects more important—than saying Anthropic won a right to dictate how the military uses artificial intelligence. Judge Lin expressly said the Pentagon remains free to choose another AI vendor. What it could not do, on the record before her, was turn a contracting dispute and protected public criticism into the sweeping punitive measures the government imposed.

Two designations, two statutes and two courts

The easiest way to understand the current status is to separate the two legal tracks.

Section 3252 defines a supply-chain risk in unusually specific terms: a risk that an adversary may sabotage a covered system, maliciously introduce unwanted functions or otherwise subvert it. (Legal Information Institute)

Section 4713 is a different federal procurement law. It expressly reaches information technology, software and cloud services and establishes its own procedures for findings of significant supply-chain risk. Congress also provided a special review mechanism: challenges to §4713 covered procurement actions go directly to the D.C. Circuit. (Legal Information Institute)

That legal split is why headlines saying “Anthropic’s blacklist was overturned” and later reports saying “Anthropic is still a supply-chain risk” can both contain an element of truth.

What did Judge Rita Lin actually rule?

The August 27 decision is important because it is not another preliminary ruling.

In March, Judge Lin had issued preliminary relief while the lawsuit proceeded. By August, the government had compiled its administrative record, both sides moved for summary judgment, and the court resolved the central claims on the merits. Final judgment and an order of permanent relief followed the same day. (Justia Dockets & Filings)

Judge Lin ruled for Anthropic on four major fronts.

The government unlawfully retaliated against Anthropic’s protected speech

The court concluded that Anthropic’s public statements about limits on government use of frontier AI addressed matters of public concern and were protected by the First Amendment.

The relevant distinction is important. The court did not hold that Anthropic has a constitutional right to force the Pentagon to accept its preferred contract terms.

Instead, Judge Lin found that the measures challenged in the case went well beyond an ordinary purchasing decision. They included a government-wide effort to stop using Anthropic, a national-security designation and an order purporting to prevent companies doing business with the military from conducting any commercial activity with Anthropic.

The court emphasized that the government was acting not merely as a customer managing a contract but using broader sovereign authority with consequences outside the immediate Anthropic-Pentagon relationship. (Justia Dockets & Filings)

The record also tied the punitive measures directly to Anthropic’s public criticism. Judge Lin concluded that the government had not shown it would have imposed the same sweeping actions independently of that speech. (Justia Dockets & Filings)

Anthropic did not receive adequate Fifth Amendment process

Judge Lin separately held that Anthropic had a constitutionally protected liberty interest at stake.

This was not simply a company losing one government contract.

The government publicly branded Anthropic a national-security supply-chain risk while simultaneously restricting its ability to compete for government business and, under the broader directive, threatening commercial relationships with defense contractors.

The court applied the “stigma-plus” doctrine: reputational damage combined with a tangible loss of legal or economic status can trigger due-process protections.

Anthropic received no meaningful advance notice of the factual basis for the designation and no opportunity to rebut it before the restrictions took effect. The court found that especially significant because one of the government’s central technical assumptions turned out to be wrong. (Justia Dockets & Filings)

What was Anthropic actually refusing to let the Pentagon do?

This part of the dispute is frequently oversimplified.

Anthropic was not refusing military use of Claude generally.

The court record says the government-specific Claude policy already permitted sensitive activities including foreign-intelligence analysis, offensive cyber operations and certain intelligence collection.

During negotiations over deployment on the Pentagon’s GenAI.mil platform, Anthropic agreed to remove most remaining restrictions. It retained two contractual restrictions:

• mass surveillance of Americans
• lethal autonomous warfare

Anthropic said those restrictions reflected both technical concerns about what current models could safely and reliably do and the company’s own values. It also repeatedly offered to assist the government in moving to another vendor if the Pentagon concluded Anthropic’s terms were unacceptable. (Justia Dockets & Filings)

That makes a common summary—“Anthropic refused to let the Pentagon use Claude for warfare”—too broad.

The disagreement was over whether the Pentagon would receive contractual authorization for all lawful uses, including those two categories.

Could Anthropic remotely shut down Claude during a military operation?

According to the developed court record, not in the manner initially suggested by the government’s risk assessment.

This became one of the most important factual findings in the case.

The Pentagon’s administrative rationale had raised the possibility that Anthropic could disable or change Claude in the middle of a military operation, leaving the government dependent on a “black box” controlled by a hostile vendor.

But Anthropic submitted technical evidence explaining that once a model was deployed in the relevant national-security environment, the deployed model was static. Anthropic could not remotely access, alter, shut down or otherwise control it. New models had to be separately tested and approved before replacing old ones. (Justia Dockets & Filings)

The government did not produce evidence establishing that Anthropic had the ability to interfere with an already deployed model during an operation. By summary judgment, the government’s argument instead focused more heavily on the theoretical possibility that a future model or update could contain unwanted behavior. (Justia Dockets & Filings)

That distinction matters enormously.

A vendor being capable of supplying a future software update is not the same thing as the vendor having a secret remote kill switch into an already deployed military system.

Why did the §3252 supply-chain theory fail?

Section 3252 was a poor fit for the facts Judge Lin found in the record.

The statute defines “supply chain risk” around an adversary sabotaging, maliciously modifying or otherwise subverting a covered system. (Legal Information Institute)

The Pentagon’s memorandum argued, in substance, that Anthropic’s insistence on restrictive contract terms and its deteriorating relationship with the government created a risk that it might later act against the Pentagon.

Judge Lin found the inferential leap unsupported.

The government did not identify evidence that Anthropic had tried to sabotage a military system, planned to do so or had a technological capability uniquely enabling it to interfere with already deployed models.

The court summarized the problem bluntly: disagreement, questioning and hard bargaining do not by themselves transform an IT supplier into a potential adversary contemplated by §3252. (Justia Dockets & Filings)

The government had also failed to satisfy important procedural requirements.

Section 3252 required a written determination that less intrusive measures were not reasonably available, along with information to Congress explaining what alternatives had been considered. Judge Lin found boilerplate assertions that alternatives were unavailable, but no substantive analysis in the record showing the required consideration actually occurred. (Justia Dockets & Filings)

The court also found that the risk assessment did not come from the official specified in the governing regulation.

Taken together, the court held that the designation failed both substantively and procedurally.

Why did the court call the government’s decision arbitrary and capricious?

The administrative record was unusually thin.

Judge Lin noted that the government’s substantive rationale rested on a four-page memorandum written after two of the three challenged actions had already been announced. She also found that the government’s explanation shifted during the litigation. (Justia Dockets & Filings)

The chronology created additional problems.

Before the blacklist

At a February 24 meeting, Secretary Pete Hegseth raised the possibility of using the Defense Production Act if Anthropic did not accept unrestricted lawful use.

That theory treated Anthropic’s technology as important enough to national security that the government might compel its continued availability.

Immediately after the designation

Pentagon Under Secretary Emil Michael continued attempting to reach a deal with Anthropic and said the parties were “very close.”

Later

The record before Judge Lin showed that government officials were discussing possible collaboration involving Anthropic’s newer Mythos model in sensitive contexts.

Judge Lin found those actions difficult to reconcile with the proposition that government officials genuinely believed Anthropic was an adversarial supplier likely to poison or sabotage military systems. (Justia Dockets & Filings)

The distinction between verified fact and inference is important here.

Verified: those negotiations and discussions occurred according to the record accepted by the court.

Court’s conclusion: the inconsistent conduct reinforced the finding that the stated security rationale was pretextual and that retaliation better explained the challenged actions.

The court was not simply substituting its preferred military policy for the Pentagon’s. It was testing whether the government’s stated explanation fit its own record.

What exactly did the August 27 order eliminate?

Judge Lin’s final-relief order was broad.

It permanently enjoined participating defendants from implementing the challenged measures, ordered implementing guidance rescinded and vacated the §3252 supply-chain designation.

It also vacated the part of Hegseth’s directive stating that no contractor, supplier or partner doing business with the military could conduct any commercial activity with Anthropic.

That provision went well beyond excluding Anthropic from a Pentagon subcontract. On its face, it attempted to affect unrelated commercial relationships between Anthropic and companies that happened to do business with the military. The government ultimately conceded there was no statutory basis for such a sweeping restriction. (Justia Dockets & Filings)

The court also invalidated specified agency actions taken to implement the broader federal directive.

But there is an equally important limitation.

The Pentagon does not have to use Claude

Judge Lin’s final order says this explicitly.

The government may still take lawful actions that were available before the challenged measures. The order specifically states that it does not require the Department of War to use Anthropic’s products or services and does not prevent the department from moving to another AI provider, provided it complies with applicable law.

That is probably the single most important limitation on the ruling.

The case does not establish:

Anthropic gets to impose its preferred military AI policy on the United States.

It establishes, at the district-court level:

The government cannot use the particular retaliatory, exclusionary and supply-chain powers challenged here without satisfying the Constitution and the statutes authorizing those powers.

If the Pentagon believes another model better meets its operational requirements, it can choose the other model.

So why does the Pentagon still say Anthropic is a supply-chain risk?

Because Judge Lin was not deciding the separate designation under 41 U.S.C. §4713.

On September 3, Under Secretary Emil Michael publicly stated that Anthropic remained a designated supply-chain risk for the department and defense industrial base. Reuters and other outlets reported the statement. (Investing.com)

At first glance, that can look as if the Pentagon is ignoring the August 27 court order.

The available legal record points to a different explanation.

In a September 3 filing, the government told the D.C. Circuit that Anthropic was improperly equating the §3252 action struck down by Judge Lin with the separate §4713 action still before the appellate court. The government emphasized that the two involved different statutory authorities, scopes and agency processes. (Law360)

On the present evidence, therefore, describing the Pentagon’s statement as defiance of Judge Lin’s order would be misleading.

The surviving designation is legally distinct from the designation she vacated.

Why §4713 is not just §3252 with a different case number

The two statutes overlap in subject matter but are not interchangeable.

Section 3252

The statute Judge Lin interpreted is Defense-specific and focuses on risks to covered national-security systems.

Its definition centers on the danger that an adversary might sabotage, maliciously alter or subvert the system. (Legal Information Institute)

Section 4713

The Federal Acquisition Supply Chain Security framework is broader in several respects.

It covers federal procurement of information technology, including software and cloud services, and allows executive-agency heads to take specified procurement actions when statutory requirements concerning significant supply-chain risk are satisfied.

The ordinary process includes recommendations, notice and an opportunity for the source to submit information. The statute also provides modified procedures when an urgent national-security interest exists. (Legal Information Institute)

Section 1327

Congress also dictated where disputes over §4713 actions are reviewed.

A company challenging a covered procurement action may petition the U.S. Court of Appeals for the D.C. Circuit, which has exclusive jurisdiction over such claims subject to eventual Supreme Court review. (Legal Information Institute)

This matters because Judge Lin’s conclusion that Anthropic did not satisfy the narrower §3252 definition does not automatically decide whether the Pentagon’s separate action satisfies §4713.

The factual findings about Anthropic’s technology, retaliatory motive and procedural history may matter enormously. But the D.C. Circuit is applying a different statute.

Didn’t the D.C. Circuit already side with the Pentagon?

No.

The D.C. Circuit denied Anthropic’s request for an emergency stay in April, but the court expressly said it was not deciding the merits.

The panel described the case as presenting “novel and difficult questions,” including what qualifies as a supply-chain risk under §4713 and what constitutes an urgent national-security interest allowing truncated procedures.

The court also directed the parties to address three specific subjects:

1. whether the court had jurisdiction under §1327;
2. whether the government had actually taken a reviewable covered procurement action;
3. whether and how Anthropic could affect its AI models before or after delivery to the Pentagon.

The panel denied the emergency stay largely after weighing the immediate equities, including the government’s interest in not being forced to continue relying on a vendor it no longer wanted during military operations. It then expedited the case.

That is not the same thing as holding the blacklist lawful.

Where does the D.C. Circuit case stand now?

The D.C. Circuit heard oral argument on May 19 in case No. 26-1049 before Judges Karen Henderson, Gregory Katsas and Neomi Rao. (D.C. Circuit Court)

After the Pentagon reconsidered and reaffirmed its determination in June, Anthropic filed a second protective petition, No. 26-1162. The court consolidated that proceeding with No. 26-1049 and ordered supplemental briefing. Anthropic filed its supplemental reply on August 3. (Justia Dockets & Filings)

After Judge Lin issued her August 27 merits decision, Anthropic brought that development to the D.C. Circuit’s attention. The government responded on September 3 that the California judgment did not resolve the separate §4713 designation. (Law360)

As of September 4, 2026, the D.C. Circuit’s official list of opinions for the month does not show a merits decision in 26-1049 or 26-1162. (D.C. Circuit Court)

So the surviving blacklist dispute remains open.

What about the Ninth Circuit appeal?

There is also a Ninth Circuit case, but it is easy to describe incorrectly.

The government’s existing Ninth Circuit appeal, No. 26-2011, concerns Judge Lin’s earlier preliminary injunction, not a new appeal of her August 27 final judgment.

The Ninth Circuit stayed that proceeding in April while the D.C. Circuit case is resolved. Its order requires the parties to seek appropriate relief after the D.C. Circuit proceeding ends if the stay remains in place. (Justia Dockets & Filings)

The district-court docket reviewed for this article shows the August 27 final judgment and termination of the case but, in its most recently retrieved public entries, no separate notice of appeal from that final judgment. (Justia Dockets & Filings)

That could change. The government still has procedural options, and this article should be updated if a new appeal or stay request is filed.

Does this ruling mean AI companies can veto military uses of their technology?

No.

There are several separate legal questions that are often collapsed into one.

An AI company can propose contractual restrictions.

The Pentagon can decide those restrictions make the company’s product unsuitable and choose a different supplier.

Congress can authorize national-security or procurement measures against risky suppliers when statutory conditions are satisfied.

And courts can review whether government officials crossed constitutional or statutory limits when using those powers.

Judge Lin’s ruling principally concerns the last point.

Her opinion distinguished the government’s contractual power from its sovereign power. Simply declining to renew a contract or refusing to award future business is one kind of government action. Publicly branding a company a national-security adversary and attempting to impose broader legal or commercial consequences is another. (Justia Dockets & Filings)

That distinction makes the case potentially important beyond Anthropic.

Is this now binding precedent for every AI company?

Not in the strongest sense of the word.

Judge Lin’s ruling is a final district-court merits judgment, which makes it considerably more significant than her earlier preliminary assessment. It determines the rights of the parties in that case unless altered through later proceedings.

But a single federal district judge does not establish a binding nationwide rule for every other federal court.

The opinion can be persuasive in future cases, particularly because it addresses a relatively new intersection of AI procurement, national security, contractor speech and due process.

The more durable appellate precedent may come from what happens next in the D.C. Circuit—or from a later appeal of Judge Lin’s final judgment.

So “a federal court has now held that these measures were unlawful” is accurate.

“A federal court has permanently settled how the government may treat every AI vendor” is not.

What the Anthropic ruling actually establishes

The strongest supported conclusion is narrower than either side’s political shorthand.

It does not establish that Anthropic gets to decide military policy.

It does establish that, in Judge Lin’s court and on the developed record, the government could not transform Anthropic’s contract disagreement and protected public criticism into a sweeping national-security designation and broad commercial punishment without evidence fitting the law and constitutionally adequate process.

The distinction is between the government saying:

We cannot agree to your terms, so we are buying someone else’s AI.

and using sovereign powers to say, in effect:

Because you publicly opposed our terms, you are a national-security supply-chain threat and other government agencies and contractors must treat you accordingly.

Judge Lin held that the second course of action, as carried out here, crossed multiple legal lines. (Justia Dockets & Filings)

The Pentagon’s ordinary procurement power survived.

The §3252 blacklist did not.

And the separate §4713 dispute is still waiting for the D.C. Circuit to decide what the law permits.

Status checked September 4, 2026. Because the appellate proceedings are active, the legal status described here may change with a new court order or filing.

References and Further Reading

Primary court records

Judge Rita F. Lin’s August 27, 2026 summary-judgment opinion — Anthropic PBC v. U.S. Department of War, Dkt. 250 The central 59-page merits decision. It contains the court’s findings on First Amendment retaliation, Fifth Amendment due process, §3252, arbitrary-and-capricious review and the developed technical record concerning Claude deployments.

Order of Final Relief, August 27, 2026 — Dkt. 251 The operative order vacating the §3252 supply-chain designation and contractor boycott, permanently enjoining the challenged measures and explicitly preserving the Pentagon’s lawful authority to choose another AI vendor.

Northern District of California docket — Anthropic PBC v. U.S. Department of War Confirms entry of Dkt. 250, the final-relief order, judgment and termination of the district-court case.

D.C. Circuit April 8, 2026 order in Anthropic PBC v. U.S. Department of War, No. 26-1049 Primary appellate order denying an emergency stay without resolving the merits, expediting the case and identifying the statutory and technical questions the parties were required to address.

D.C. Circuit docket for Anthropic’s second §4713 petition, No. 26-1162 Documents the June petition, consolidation with No. 26-1049 and supplemental briefing.

D.C. Circuit September 2026 opinions list Used to verify that no Anthropic merits opinion had been posted as of September 4, 2026.

Ninth Circuit docket, No. 26-2011 Shows that the existing Ninth Circuit appeal concerns the preliminary injunction and remains stayed pending resolution of the D.C. Circuit proceeding.

Statutory authorities

10 U.S.C. §3252 — Requirements for information relating to supply-chain risk The Defense-specific provision applied by Judge Lin, including its definition of supply-chain risk and requirements concerning less intrusive alternatives.

41 U.S.C. §4713 — Federal procurement supply-chain authorities The separate statutory authority underlying the still-pending Pentagon designation reviewed by the D.C. Circuit.

41 U.S.C. §1327 — Judicial review procedures Explains why challenges to covered §4713 procurement actions go directly to the D.C. Circuit.

Current-status reporting

Reuters: Anthropic still flagged as a risk to the defense industrial base, September 3, 2026 Reports Under Secretary Emil Michael’s statement that Anthropic remains designated a supply-chain risk despite the California ruling.

MLex: U.S. government says Anthropic’s court win does not overturn separate risk designation Reports the government’s September 3 D.C. Circuit filing distinguishing the invalidated §3252 action from the separate §4713 designation.

Editorial currency note: This article describes the litigation as of September 4, 2026. The D.C. Circuit proceedings remain active, and a later appellate decision, notice of appeal, stay request or change to the §4713 designation could alter the current status.