Appeals Court Backs Pentagon’s Power to Label Anthropic a Supply Chain Risk

A divided federal appeals court in Washington has upheld the Pentagon’s authority to designate Anthropic a supply chain risk, allowing the Defense Department to restrict the company’s role in military systems. The ruling gives the Trump administration a major victory in its dispute with the AI company over Claude’s built-in limits on certain uses.

The appeals court did not directly reject a California district judge’s conclusion that Anthropic did not fit the statutory definition of a supply chain risk. Instead, the panel said the lower court was reviewing the decision under one legal framework while the appeals court had exclusive jurisdiction over another. That distinction allowed the designation to stand while separate litigation continues.

The Pentagon argued that Claude’s restrictions created a national-security risk because the department and its contractors rely on the model inside information systems. The majority said the government had ample support for concluding that continued integration presented a covered risk, pointing to Anthropic’s ability to encode limits that prevent Claude from performing tasks the company rejects.

The dispute centers on Anthropic’s refusal to permit some military applications, including uses the company considered unacceptable. The administration treated those limits as a control over a system used by the government, while Anthropic argued that the designation punished the company for exercising its rights and for setting safety boundaries around its technology. The legal fight therefore reaches beyond one procurement decision: it tests how much control an AI developer retains after its models enter national-security infrastructure.

The appellate decision does not erase the separate ruling from the Northern District of California, where a judge found the blacklisting unlawful. That court held that the statutory meaning of supply chain risk is limited to threats such as adversarial sabotage, malicious introduction of unwanted functions, or other subversion of a covered system.

The DC Circuit focused on jurisdiction and the scope of its review rather than adopting the district court’s core interpretation. That procedural split has produced two important results at once: Anthropic has a favorable finding from one federal court, while the Pentagon retains an operative designation backed by the appeals court. The conflicting rulings leave the legal boundary unsettled and create a path for further appeals or additional challenges.

The case puts model safeguards at the center of a government contracting dispute. Anthropic’s position treats restrictions on Claude as part of the company’s safety design and corporate judgment. The Pentagon’s position treats those same restrictions as a source of operational uncertainty when the model is embedded in systems that support military work.

That conflict gives the ruling significance beyond Anthropic. AI developers selling to public agencies will face closer scrutiny over who controls model behavior after deployment, especially when providers refuse particular uses. Government buyers, meanwhile, gain a stronger argument for treating provider-imposed limits as procurement and security concerns rather than ordinary product features. The decision does not establish that every restriction creates a supply chain risk, but it validates the Pentagon’s authority to make that determination in this case.

The designation can affect Anthropic’s access to Defense Department work and to contractors operating within military information systems. It also raises the cost of adopting Claude across agencies that require stable capabilities, predictable controls, and continuity of service. Competitors stand to benefit if procurement officials shift contracts toward models whose providers accept broader government requirements.

The case also gives AI companies a sharper strategic choice. Firms can preserve strict limits on military applications and risk losing government business, or negotiate more flexible deployment terms and face pressure from employees, customers, and safety advocates. Microsoft, Google, OpenAI, and other providers compete in the same public-sector market, so the court’s treatment of provider restrictions will shape contract negotiations well beyond Anthropic.

Anthropic’s legal challenge remains active because the California ruling and the DC Circuit decision address different aspects of the government’s action. The company can seek further review, while the administration can continue enforcing the designation under the appeals court’s ruling. The Supreme Court’s involvement would depend on future petitions and the courts’ treatment of the jurisdictional conflict.

For now, the Pentagon has judicial backing to classify Anthropic as a supply chain risk, while the definition of that risk remains contested. The outcome leaves federal agencies with greater leverage over AI vendors and leaves developers facing a basic question about deployment: whether model behavior is a safety feature, a contractual term, or a national-security vulnerability.