Government’s Real Intent in Blacklisting Anthropic Questioned

A federal appeals court ruling upholding the Trump administration’s blacklisting of Anthropic raises uncomfortable questions about whether national security concerns are masking an attempt to force AI companies into compliance with government demands.

The US Court of Appeals for the District of Columbia Circuit handed the Trump administration a significant victory this week, ruling 2-1 that the government had legal authority to blacklist Anthropic from federal contracts. The decision stems from Anthropic’s refusal to remove built-in restrictions preventing its Claude AI model from being used for lethal autonomous warfare and mass surveillance of Americans. What started as a dispute over AI ethics has evolved into a legal battle that exposes deeper tensions about government power, corporate autonomy, and the true meaning of national security threats.

The timeline tells a revealing story. In February 2026, President Trump and Defense Secretary Pete Hegseth ordered federal agencies to immediately stop using Anthropic’s technology and banned defense contractors from working with the company. The administration designated Anthropic as a supply chain risk, a label typically reserved for foreign adversaries attempting to compromise American systems. This wasn’t a case of hidden malware or covert data exfiltration. Anthropic, a San Francisco-based AI company and trusted defense partner, had simply refused to disable safety features the company views as essential ethical guardrails.

The conflicting court rulings highlight how much the legal justification matters. Judge Rita Lin of the US District Court for the Northern District of California ruled in August that the blacklisting violated the law. She examined the government’s actions under 10 U.S.C. Section 3252, which defines supply chain risks as threats from adversaries who might sabotage systems or maliciously introduce unwanted functions. Lin found that Anthropic doesn’t fit this definition because the company acted openly and with no malicious intent. She also determined the action violated the First Amendment, writing that “the empty invocation of national security is not a blank check to punish and retaliate against government critics.”

The DC Circuit Court took a different approach. Rather than reviewing the designation under Section 3252, the appeals court examined it under 41 U.S.C. Section 4713, which contains a broader definition of supply chain risk. This statute doesn’t require bad motives or adversarial intent. It simply requires that “any person” might manipulate covered technology in ways that could “deny, disrupt, or otherwise manipulate” its function. The court focused on the word “deny,” arguing that Anthropic preventing the military from using certain Claude features qualified as a supply chain risk under this more permissive framework.

Judges Gregory Katsas and Neomi Rao formed the majority. Both were appointed by Trump and served in his first administration. Katsas previously worked as deputy counsel to the president, while Rao served in the Office of Management and Budget. Their ruling acknowledged the “profoundly difficult questions about the appropriate military uses of an almost unimaginably powerful new technology” but ultimately deferred to executive branch judgment. They wrote that Trump and Hegseth “must determine how best to balance the competing risks” between overly constrained AI models that might fail during military operations and unconstrained models that might hallucinate inappropriate targets for lethal force.

A 2-1 D.C. Circuit ruling upheld the Trump administration’s authority to blacklist Anthropic from federal contracts after the company refused to remove Claude safeguards limiting autonomous lethal warfare and mass surveillance. The decision conflicts with a California judge’s finding that the designation was unlawful and retaliatory, and it raises broader questions about whether supply chain security laws are being used to address genuine security threats or to punish a domestic contractor for refusing government demands.

Judge Karen Henderson, appointed by George H.W. Bush, dissented sharply. She argued the majority misread Section 4713 by ignoring its context and purpose. Congress enacted the supply chain security framework in response to threats from “hostile nation state and other bad actors” infiltrating federal information systems, Henderson noted. The verbs in the statute-sabotage, maliciously introduce, extract data, manipulate-all suggest deliberate attempts to compromise systems after they enter the supply chain.

Henderson’s interpretation raises a critical point. If a contractor honestly enforces restrictions on product use that it disclosed upfront, does that really constitute a supply chain risk? Anthropic encoded its limitations directly into Claude’s design and made these restrictions clear in its contracts. The company didn’t secretly disable features or introduce backdoors. It refused to remove safety measures it views as fundamental to responsible AI deployment. Treating this as equivalent to foreign adversaries planting malware stretches the statute’s language beyond recognition.

The appeals court’s reasoning creates troubling possibilities. Under this interpretation, any technology company that refuses a government demand to modify its product could potentially be designated a supply chain risk. The government need only claim that the refusal “denies” it access to desired functionality. That’s a remarkably expansive reading of procurement law, one that transforms it from a shield against malicious actors into a cudgel for enforcing compliance.

The specifics matter here. Anthropic built restrictions into Claude that prevent the model from performing tasks the company considers dangerous or unethical. These safeguards have occasionally stopped Claude from completing requests from government users. More recently, a dispute arose over whether contractual prohibitions barred Claude’s use in an ongoing overseas military operation, leaving the Defense Department uncertain whether the system would perform as intended.

The appeals court framed this as a reliability problem. The government “reasonably feared that Anthropic might manipulate Claude’s design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary,” the majority wrote. But this characterization sidesteps the actual disagreement. Anthropic maintains these restrictions aren’t arbitrary obstacles but necessary limitations on AI systems that could otherwise cause significant harm through autonomous lethal targeting or mass surveillance without oversight.

The Trump administration’s public statements suggested the real issue wasn’t technical reliability but corporate defiance. Trump and Hegseth denounced Anthropic’s position on social media, with Hegseth calling the company’s stance a threat to American lives and national security. This rhetoric doesn’t match the technical nature of supply chain security laws. It sounds more like punishment for refusing orders.

If refusing to remove safety guardrails is a national security risk, then procurement law has become a pressure tactic for forcing companies to obey.

The ruling’s broad interpretation could make any technology provider vulnerable to blacklisting whenever it declines to deliver unrestricted functionality. That changes the government’s relationship with contractors from negotiated partnership to compelled compliance.

Judge Lin’s ruling in California addressed constitutional concerns that the appeals court largely avoided. Lin found the blacklisting violated the First Amendment because it amounted to retaliation for constitutionally protected speech. Anthropic’s public advocacy for AI safety standards and its refusal to compromise on ethical boundaries constitute expression on matters of public concern. Punishing a company for taking these positions crosses constitutional lines.

The DC Circuit didn’t directly address this First Amendment issue, focusing instead on whether the procurement statutes authorized the blacklisting. That narrow approach leaves significant constitutional questions unresolved. Can the government use procurement authority to effectively silence corporate criticism or force companies to abandon publicly stated ethical positions? The appeals court’s deference to executive discretion suggests it thinks these concerns take a back seat to national security decision-making.

The core tension in this case revolves around what actually constitutes a national security threat. Traditional supply chain risks involve adversaries compromising systems in ways users can’t detect or prevent. A Chinese manufacturer might install hidden backdoors in telecommunications equipment. A Russian software company might embed data exfiltration capabilities in enterprise applications. These scenarios involve deception, malicious intent, and hidden manipulation.

Anthropic’s situation bears no resemblance to these threats. The company operates transparently within the United States. It disclosed its restrictions upfront. It offered to work with the Defense Department on applications that fell within its ethical boundaries. The only “risk” Anthropic poses is the possibility it won’t do everything the military wants exactly when the military wants it done. That’s not a security vulnerability. That’s a disagreement between a contractor and a customer.

The government’s argument essentially boils down to: Anthropic might enforce the limitations it clearly stated it would enforce, and this could inconvenience military operations. Framing contractual disputes as national security emergencies represents a troubling expansion of government authority. If this logic holds, virtually any private sector partner that doesn’t provide unlimited, unrestricted access to its technology could be labeled a security risk.

Anthropic indicated it’s considering further appeals, either requesting an en banc review with all DC Circuit judges or petitioning the Supreme Court. An Anthropic spokesperson told CNBC the company “respectfully disagrees with the court’s decision” and remains “confident in our position.” The company noted that another federal court already found the designation unlawful, referring to Judge Lin’s California ruling.

Interestingly, Commerce Secretary Howard Lutnick recently suggested the Trump administration and Anthropic have “patched up their relationship” and are “in tune.” That comment raises its own questions. If the relationship has improved, what changed? Did Anthropic agree to modify its restrictions? Did the government soften its demands? Or is this simply political rhetoric meant to defuse the controversy while legal battles continue?

The procedural complexity adds another layer. The DC Circuit has exclusive jurisdiction over procurement decisions made under Section 4713, which is why that court’s interpretation carries significant weight. But Judge Lin’s analysis under Section 3252 and her First Amendment findings remain valid within her jurisdiction. Two federal courts have now issued contradictory rulings on the legality of the same government action, examined under different legal frameworks. This kind of conflict typically attracts Supreme Court attention.

The implications extend far beyond Anthropic. Other AI companies watching this case now understand the government can designate them as supply chain risks if they refuse to remove safety features or modify their products to meet military specifications. The threat of being cut off from all federal contracts and defense work creates enormous pressure to comply with government demands, regardless of a company’s ethical concerns or the public interest implications.

This dynamic fundamentally alters the relationship between the technology sector and government. Companies developing powerful AI systems face a choice: build products according to their own ethical frameworks and risk retaliation, or accede to whatever capabilities the government demands. The appeals court’s ruling suggests the latter approach is legally safer, even if it means abandoning restrictions designed to prevent autonomous weapons from making life-or-death decisions or AI systems from conducting mass surveillance on American citizens.

The case also reveals how easily national security justifications can be stretched to serve other purposes. The Trump administration didn’t identify any actual security vulnerability in Anthropic’s technology. It didn’t present evidence of compromised systems or malicious code. It simply didn’t like being told no. Wrapping that preference in national security language gave it legal cover under procurement statutes that were never designed for this purpose.

Judge Henderson’s dissent captured this problem precisely. She noted that Congress enacted supply chain security laws to address hostile actors infiltrating government systems, not to resolve disputes with cooperative American contractors enforcing disclosed limitations on product use. The majority’s interpretation transforms these laws from defensive measures into offensive weapons the government can deploy against companies that don’t fully cooperate.

The question that remains is whether the courts will ultimately impose meaningful limits on this power. Judge Lin’s First Amendment analysis suggests constitutional boundaries exist, even if the DC Circuit preferred to avoid addressing them directly. If the Supreme Court takes the case, it could clarify whether procurement authority includes the power to effectively compel private companies to abandon ethical restrictions on their technology. Until then, the conflicting rulings leave AI companies and government contractors navigating deeply uncertain legal terrain, never quite sure when a principled refusal might transform them into designated security threats.