---

Discussion

Red Velhouse:

Sofia, start with the posture. What did the three-judge panel decide, and what exactly is Anthropic asking the full court to revisit?

Sofia Jadler:

The September panel ruled two to one against Anthropic, with Judge Karen LeCraft Henderson dissenting. It allowed the Pentagon to remove Claude from its systems and to exclude Anthropic products from Department-related contractor work, but it did not impose a government-wide ban. Anthropic’s rehearing petition argues that the panel read the supply-chain statute too broadly and treated a disagreement over safety terms as a security risk and unconstitutional retaliation.

Ann Tofado:

And that framing is politically important. The administration wants the dispute understood as a question of government control: elected officials and military leaders, not a private provider, decide what lawful missions require. Anthropic wants it understood as coercion—use procurement power to remove the company’s limits, or lose access to a major government market.

Omar Seidren:

The technical disagreement gives both sides a plausible concern. A model that can refuse or interrupt a critical workflow creates operational dependence on its provider. But removing safeguards can increase the chance of unreliable analysis or unsafe autonomous action. The difficult part is that both risks involve the same system; there is no magic setting labeled “safe, but only when convenient.”

Red Velhouse:

That brings us to the statute. How did Anthropic’s safety limits become a possible supply-chain risk?

Sofia Jadler:

The majority focused on effect rather than motive. Section 4713 covers a product or supplier presenting a significant national-security risk, including the ability to manipulate the function, use, or operation of information technology. The court reasoned that a provider can manipulate a product by embedding restrictions that prevent it from performing certain lawful military tasks, even without intending sabotage.

Sofia Jadler:

Judge Henderson’s dissent supplies Anthropic’s strongest counterargument. She read the surrounding references to sabotage, malicious functions, data extraction, and comparable subversion as pointing toward hostile or covert conduct. On that reading, an honest provider enforcing publicly disclosed safety limits is not naturally a supply-chain attacker. That is the statutory question Anthropic wants the full court to answer differently.

Ann Tofado:

Sofia, your distinction also explains the administration’s strategy. If intent were required, officials would have to prove something like malicious compromise. By emphasizing operational effect, the majority gives the Pentagon a more usable procurement theory. But politically, that makes the government look as if it has converted a policy disagreement into a security designation.

Sofia Jadler:

Exactly. The majority’s approach is legally efficient, but its breadth is the vulnerability. If any provider-imposed limitation counts as manipulation, then many software and cloud vendors could become supply-chain risks whenever they decline to do everything a government customer requests. The panel did not fully define that stopping point.

Sofia Jadler:

There is also a strategic reason the court’s wording matters. The majority preserved substantial room for national-security deference on the government’s factual judgment, while treating the meaning of the statute as a question judges can decide independently. Anthropic therefore needs to persuade the full court that this is not merely a disagreement about classified facts; it is a boundary question about what Congress authorized. That lets the company challenge the legal framework without asking judges to run a military procurement program themselves.

Red Velhouse:

Omar, can engineering controls answer that concern, or is the Pentagon right that provider control remains a permanent dependency?

Omar Seidren:

Controls can reduce the dependency, though they cannot erase it by declaration. A government-held model copy, locked versions, mission-specific testing, isolation from provider updates, and human authorization for high-risk actions would all help. But model behavior is not just a file; configuration, tools, prompts, and surrounding software matter too. Freeze the model and the rest of the stack can still wander off wearing a different hat.

Omar Seidren:

In a classified environment, I would want reproducible evaluations before deployment and again after every material change. The system should log refusals, tool calls, uncertainty signals, and human overrides, so officials can distinguish a deliberate safety boundary from a software failure or a bad prompt. Even then, testing cannot prove that every future situation is safe. It can create evidence, accountability, and a defined rollback plan, which is much more useful than promising that an opaque model will behave forever.

Sofia Jadler:

And that is where the legal and technical arguments meet. If the government can identify a concrete failure mode and address it with version controls, audits, or isolation, its case looks more like ordinary procurement management. If it demands the removal of broad safety conditions without specifying the operational problem, Anthropic has a stronger argument that procurement is being used to change public policy.

Ann Tofado:

But the administration has an incentive to keep the demand broad. A narrow exception for one mission solves one contract. An “all lawful uses” principle establishes a rule for every frontier provider. That is why this is larger than Claude: other companies are watching whether safety commitments preserve bargaining power or become grounds for exclusion.

Ann Tofado:

There is an economic signal here as well. The disputed contract was described as worth up to two hundred million dollars, but the larger concern is access to the contractor ecosystem. A designation can make prime contractors and classified-system integrators cautious even outside this particular procurement. So the pressure on Anthropic is not only the immediate loss of a customer; it is the possibility that other buyers conclude the company is institutionally difficult to use.

Red Velhouse:

The First Amendment is part of that larger fight. Why did the retaliation claim fail at this stage?

Sofia Jadler:

The majority accepted that Anthropic’s safety advocacy was protected speech and that exclusion from the market was materially adverse. It nevertheless found an insufficient causal connection. In the court’s account, the Pentagon acted because Anthropic refused an “all lawful uses” contract term, not because it publicly advocated safeguards. Anthropic would need evidence that procurement authority was used to punish the advocacy itself.

Sofia Jadler:

That distinction is narrow but important. A government may generally choose a contractor whose product meets its requirements, yet it may not disguise punishment for protected expression as a neutral purchasing decision. The unresolved evidence question is what actually drove the decision: the operational characteristics of Claude, the refusal to change those characteristics, the public campaign around them, or some combination. The rehearing petition will likely press the court to examine timing and statements more skeptically.

Ann Tofado:

That is where the California ruling complicates the political narrative. A federal judge there found a parallel designation unlawful and improperly retaliatory. The administration can cite the D.C. Circuit’s procurement ruling, while Anthropic can cite California as evidence of a broader effort to make an example of the company.

Sofia Jadler:

The cases are not formally contradictory on the same statutory question. California involved Section 3252, with a narrower, more adversary-oriented definition. The D.C. Circuit case concerns procurement exclusion under Section 4713 and the Federal Acquisition Supply Chain Security Act. The different statutes explain the different results, but they do not eliminate the practical uncertainty.

Omar Seidren:

And the public record still does not tell us how often Anthropic’s restrictions actually blocked missions, how they behaved in classified deployments, or whether technical isolation would have solved the Pentagon’s concern. So the argument is being driven partly by competing failure scenarios rather than a demonstrated mission breakdown.

Red Velhouse:

If you were designing a settlement or a procurement rule, what would address both sides without simply repeating “trust us”?

Omar Seidren:

I would use mission-specific contracts, government-controlled copies for sensitive work, independent testing, documented update procedures, and mandatory human authorization for lethal action. Anthropic could retain narrow prohibitions on fully autonomous weapons and domestic mass surveillance, while the government received predictable performance guarantees for defined tasks. That is more complicated than one universal switch, but complex systems usually punish universal switches.

Sofia Jadler:

Specificity also improves the legal position. A contract can identify missions, versions, audit rights, update procedures, and remedies. That makes it easier to show a concrete operational rationale and harder to portray the government’s demand as an effort to compel a change in public policy. Congress may ultimately need to decide whether openly imposed AI-safety limits belong within the concept of supply-chain risk at all.

Ann Tofado:

The political obstacle is that both sides benefit from maximalist language. The administration says military policy cannot be outsourced. Anthropic says safety cannot be compelled out of existence. A compromise would reduce both sides’ leverage, so the incentive to negotiate may be weaker than the incentive to win the narrative.

Red Velhouse:

Before we close, what should viewers watch next?

Sofia Jadler:

First, whether the full D.C. Circuit grants rehearing. If it does not, Anthropic could seek Supreme Court review, although neither step is guaranteed. Watch whether the judges focus on the meaning of “otherwise manipulate,” the First Amendment theory, or the scope of national-security deference. Those choices would show which part of the panel’s reasoning is most vulnerable.

Omar Seidren:

Also watch procurement practice. If agencies begin demanding locked government copies, independent evaluations, or unrestricted-use clauses from frontier providers, companies will adapt their architectures and contracts. The important question is whether those controls create measurable reliability—or simply relocate uncertainty to a less visible part of the system.

Ann Tofado:

And watch the interaction between the California case and Congress. The executive branch can claim appellate validation while Anthropic points to a separate ruling finding broader conduct retaliatory. That tension could produce legislation, new procurement rules, or a sharper debate over whether AI companies are merely vendors or also policy actors with enforceable limits.

Red Velhouse:

The unresolved issue is whether a company’s openly declared safety limits can count as a national-security supply-chain risk when they constrain military use, even without sabotage or malicious intent. The answer could shape procurement law, AI contracting, and the balance between government authority and provider control. Watch for the D.C. Circuit’s rehearing decision, developments in the California case, possible Supreme Court review, and whether defense agencies pursue technical compromises instead of blanket demands. Sources and references for this discussion are available with the episode at Factolio.com.

---

Sources and References

These sources supported the factual material used in this discussion. Factolio’s panel discussion is AI-generated from researched evidence and is written in original language.

1. Reuters — Anthropic seeks rehearing of case over Pentagon’s security risk branding (NEWS)
2. U.S. Court of Appeals for the D.C. Circuit — Anthropic PBC v. United States Department of War, No. 26-1049, opinion and dissent, September 25, 2026 (PRIMARY)
3. Associated Press — Federal appeals court lets Pentagon keep Anthropic’s label as supply chain risk (NEWS)
4. Anthropic — Statement on the comments from Secretary of War Pete Hegseth (PRIMARY)
5. Anthropic — Statement from Dario Amodei on our discussions with the Department of War (PRIMARY)
6. U.S. District Court filing — Anthropic PBC v. United States Department of War, complaint for declaratory and injunctive relief, March 9, 2026 (PRIMARY)
7. The Washington Post — Federal judge overturns Pentagon ban on Claude chatbot maker Anthropic (NEWS)
8. Civil Rights Litigation Clearinghouse — Anthropic PBC v. United States Department of War, D.C. Circuit docket (OTHER)
9. Associated Press — Hegseth warns Anthropic to let the military use the company’s AI tech as it sees fit (NEWS)