A federal judge ruled this week that the Pentagon’s blacklisting of Anthropic was unlawful, ordered the government to rescind the directives it issued against the company, and barred it from giving them effect.
U.S. District Judge Rita Lin of the Northern District of California found that officials had retaliated against the AI company in violation of the First Amendment, and had stripped it of liberty interests without adequate notice or a meaningful chance to respond, in violation of the Fifth Amendment’s due process clause. She set aside the national-security supply-chain-risk designation that Defense Secretary Pete Hegseth had placed on the company and issued a permanent injunction. The opinion runs 59 pages.
An “empty invocation of national security,” Lin wrote, “is not a blank check.”
What the fight was actually about
The dispute is a contract dispute wearing national-security clothing. Anthropic held a $200 million agreement with the Pentagon, and as of February its Claude models were the only large language models cleared for the military’s classified systems.
The company pushed for contractual limits barring the use of its models in fully autonomous lethal weapons systems and in domestic mass surveillance of Americans. The Defense Department rejected that position on the grounds that a corporate contractor has no authority to write military operating rules. In February, the administration designated the company a supply chain risk.
Anthropic argued the designation was retaliation for refusing to drop those restrictions. The court agreed.
Our take: The interesting part is not that a company won a procurement fight. It is which clause the court protected. Anthropic’s acceptable-use terms were treated as expression — a position the company took, not merely a product specification it shipped. That reframes every usage policy at every frontier lab from a legal liability into a defensible one. Until Friday, writing a hard restriction into a federal contract was a commercial risk with no floor under it. There is now a floor. Expect the terms sheets to get more specific, not less.
Why it lands beyond one company
Model providers have spent two years discovering that their real leverage over how their systems get used is contractual, not technical. Weights can be fine-tuned; access can be resold; guardrails can be stripped by a determined customer with enough compute. The clause is the control surface.
That control surface only works if the vendor can hold it without being removed from the market for doing so. A designation like the one at issue here does not require a finding of wrongdoing to be devastating — it travels to every other agency, every prime contractor, and every risk committee that reads a federal list. The due-process half of the ruling matters as much as the speech half: the court’s objection was partly that the company never got a real chance to answer.
It also arrives into a market where capital is flooding into AI infrastructure and where the question of who can sell what to whom — including across borders — is being settled case by case rather than by statute.
What to watch
- An appeal. A permanent injunction against a cabinet department is a candidate for the Ninth Circuit. Nothing here is final until that clock runs.
- Procurement language. The cleanest government response is not to re-blacklist anyone; it is to rewrite solicitations so that accepting the contract means waiving the restriction up front.
- Whether rivals harden or soften. Labs competing for the same classified work now know the downside of holding a line has a legal backstop. Watch whether anyone’s published usage policy gets more specific in the next quarter.
- The classified-systems slot itself. Being the only cleared model was the leverage on both sides. Whether that stays a one-vendor position is the commercial story underneath the constitutional one.