Anthropic’s Lawsuit Against the Department of Defense

March 10, 2026

BLUF: Anthropic has filed two related lawsuits challenging the Department of Defense’s decision to label it a “supply‑chain risk” under 10 U.S.C. § 2533b (as reorganized in § 3252), a designation normally used against foreign‑linked vendors. The company argues the Pentagon misused that authority to retaliate after Anthropic refused to let its Claude AI be used for mass surveillance and fully autonomous weapons, even as U.S. forces reportedly continue to rely on Claude for intelligence analysis in operations involving Iran and in a U.S. operation targeting Venezuelan leader Nicolás Maduro.

Share

Leave a comment

Key Facts

• Anthropic filed one lawsuit in the U.S. District Court for the Northern District of California contesting the Department of Defense’s supply‑chain risk designation, and a second, related petition in the D.C. Circuit challenging how the Federal Acquisition Security Council (FASC) and DoD implemented the government‑wide supply‑chain process.

• The Pentagon’s unclassified letter, signed by Secretary Pete Hegseth and dated February 26, 2026 (received by Anthropic on March 4), states that Anthropic “poses an unacceptable supply chain risk,” bars DoD agencies and many contractors from using its products, grants a six‑month transition period, and criticizes Anthropic’s restrictions for preventing Claude from being used “for all lawful purposes.”

• Anthropic previously had a reported 200‑million‑dollar contract with DoD for “frontier AI” research and operational support, indicating an established partnership before the conflict rather than an arm’s‑length relationship.

• Negotiations reportedly deteriorated in early February 2026 after the Pentagon insisted on removing Anthropic’s usage restrictions for government work; when Anthropic refused, Secretary Hegseth’s February 26 letter formally designated the company a supply‑chain risk, and Anthropic filed suit on March 9 while also seeking a preliminary injunction to stop the six‑month transition clock.

• The Wall Street Journal reported that Claude was used in intelligence analysis related to U.S. operations involving Iran and the U.S. operation targeting Venezuelan leader Nicolás Maduro, though other sources like NPR has not independently confirmed The Journal’s reporting; subsequent coverage from outlets like PBS and the Washington Post described Claude as remaining deeply embedded in classified systems supporting the Iran campaign even after the designation.

• Anthropic’s engineers reportedly concluded that Claude produced unreliable outputs in certain high‑risk military scenarios and therefore considered it unsuitable for use in fully autonomous weapons systems and some large‑scale surveillance contexts, but some defense officials pushed for broader deployment despite those findings.

• Experts say it may be the first time the federal supply‑chain risk authority has been applied to a major U.S. technology company rather than a foreign‑linked vendor, making the case a significant precedent for domestic AI and tech firms.

• Anthropic’s valuation has been reported in the tens of billions of dollars, with billions in projected government and defense‑sector revenue at stake if the designation stands.

• Researchers and staff from other major AI labs, including OpenAI and Google, have publicly supported Anthropic and participated in an amicus effort arguing that forcing “any lawful use” on AI vendors would undermine industry‑wide AI safety work and the concept of independent “safety‑first” AI labs.

Imagine the plot of Terminator, where AI systems gain control and lead to global catastrophe, or Idiocracy, where expertise gives way to uninformed decisions with dire results. These fictional histories warn us that ignoring even fictional lessons, and sidelining subject matter experts who understand how complex systems fail, can turn foreseeable risks into real‑world disasters when advanced AI is woven into surveillance, targeting, and weapons infrastructure.

Why It Is Still Legally the Department of Defense, Not the “Department of War”

Anthropic and some commentators have deliberately referred to the Pentagon as the “Department of War” to highlight what they see as a more aggressive, war‑focused posture toward AI deployment under the current administration. From a legal perspective, however, the institution remains the Department of Defense.

Congress created the modern Department of Defense through the National Security Act of 1947 and its 1949 amendments, which reorganized the old War and Navy Departments into a unified structure and formally adopted the name “Department of Defense.” The shift from “War” to “Defense” was both structural and symbolic, reflecting a post‑World War II vision of American power focused on collective security rather than permanent war footing. The department’s name is codified in Title 10, including provisions like 10 U.S.C. § 111 and other organic statutes.

Because that name appears in statute, it cannot be changed by executive order or branding decisions alone. President Trump and Secretary Hegseth have favored references to a “Department of War” in speeches and political messaging, and some reporting notes that Hegseth adopts a “Secretary of War” style title. Analyses from military law and policy outlets emphasize that this rebranding has no statutory effect: unless and until Congress passes new legislation amending the relevant provisions of Title 10, the department’s legal identity remains the Department of Defense.

Anthropic’s legal briefs reportedly cite this rhetorical rebranding as evidence of a broader shift in the administration’s view of the department’s role and statutory constraints. The company argues that leadership that describes its institution as a “Department of War” is also more likely to stretch procurement and security laws to secure unconstrained AI capabilities, even when those laws were drafted for narrower supply‑chain purposes.

How a $200 Million Partner Became a “Supply‑Chain Risk”

Anthropic initially partnered with the Pentagon under a reported 200‑million‑dollar contract to provide frontier AI research and operational support, including using Claude in intelligence processing and planning tools that helped frontline personnel analyze large volumes of data. In early reporting, officials described Anthropic as a premier partner rather than a reluctant outsider.

That relationship began to fray as the administration shifted toward a more expansive view of how AI should be used in national security. In late 2025 and early 2026, senior DoD officials pressed Anthropic to modify or drop its Usage Policy restrictions for government work. Those restrictions limit deployments in areas such as large‑scale surveillance of U.S. persons and systems that would allow Claude’s outputs to directly control lethal force without meaningful human review.

Inside Anthropic, engineers and safety researchers had been running targeted tests and war‑game style exercises. They found that Claude, like other large language models, could generate seemingly confident but potentially unsafe recommendations in complex, adversarial scenarios. The concern was not that Claude failed in routine tasks, but that in high‑stakes situations involving the use of force, escalation, or surveillance, the model’s errors could have catastrophic consequences if not checked by humans. Engineers therefore concluded that Claude should not be used as an unreviewed decision‑maker for fully autonomous weapons or unconstrained surveillance systems.

By early February 2026, the central dispute was clear. Pentagon negotiators insisted that the government must be able to use any tool it buys for “all lawful purposes.” From Anthropic’s perspective, that phrase would eviscerate its safety policies: many uses the company finds unacceptable, such as certain surveillance operations or autonomous targeting, can still be lawful under existing authorizations. Anthropic refused to accept language that would allow Claude to be used in those ways.

Negotiations reportedly collapsed after a February compliance deadline passed. Shortly thereafter, President Trump publicly urged federal agencies on Truth Social to stop using Anthropic’s products, framing the company as undermining U.S. security. The short temporal proximity between that political post, the breakdown in talks, and the issuance of Secretary Hegseth’s February 26 letter is crucial: it suggests a retaliatory motive rather than a slow, evidence‑driven security review.

The February 26 unclassified letter, received March 4, declared that Anthropic “poses an unacceptable supply chain risk” under 10 U.S.C. § 2533b, barred new procurement, and instructed DoD entities and many contractors to cease using Anthropic products after a six‑month transition period. It specifically criticized Anthropic’s refusal to allow Claude for “all lawful purposes” and characterized the company’s usage restrictions as “unacceptable.” Anthropic responded on March 3 disputing the basis for the designation, then filed the Northern District of California lawsuit on March 9 and the D.C. Circuit case in parallel.

Reporting indicates that Claude has remained integrated in some analytic pipelines related to Iran‑focused operations and the U.S. operation targeting Nicolás Maduro, even after the designation. That continued use is not just “ironic.” It is a potential evidentiary problem for the government: it strongly suggests that, in practice, the Pentagon does not treat Claude as the kind of compromised component that the supply‑chain statutes were designed to address.

The Statute and FASC: From Foreign Backdoors to Domestic AI

The primary statutory hook for the designation is 10 U.S.C. § 2533b, now reorganized into § 3252, which authorizes DoD to restrict procurement of items that present unacceptable supply‑chain risks to national security systems. The Federal Acquisition Security Council coordinates supply‑chain risk assessments across the federal government and recommends responses. Individual agencies, including DoD, then issue the determinations that trigger procurement bans or divestment requirements.

Historically, this authority has been used to address foreign‑linked threats. Chinese telecom firms such as Huawei and ZTE are typical examples, where the concern is that foreign governments might use their equipment to spy on or disrupt U.S. systems. The legal and policy rationale is that if an adversary controls or can compromise your supply chain, it can gain access to or undermine your networks.

Applying the same authority to a domestic AI lab with no alleged foreign ownership or infiltration is a marked departure from past practice. Legal analysis on platforms like Lawfare has underscored that experts view this as likely the first time the supply‑chain designation has been pointed at a major U.S. technology company. They warn that if courts approve this use, agencies could start wielding supply‑chain law as a generalized instrument against any contractor that resists policy demands, rather than a targeted tool against foreign compromise.

Anthropic’s D.C. Circuit filing reportedly challenges not only the ultimate designation but also FASC’s underlying process, arguing that the council and the Department failed to gather and evaluate the type of evidence that the statute contemplates, namely, credible information about foreign control or tampering. Instead, the core dispute is over contract terms and safety policies, which the statute does not mention.

Anthropic’s Legal Claims: Ultra Vires, APA, and Viewpoint‑Based Retaliation

Anthropic’s lawsuits advance several legal theories.

First, the ultra vires claim asserts that the Department of Defense has gone beyond what Congress authorized in § 2533b and § 3252. Because those provisions are aimed at supply‑chain security, especially foreign adversary penetration, applying them to a U.S. company without alleging foreign control or tampering is, in Anthropic’s view, outside their intended scope. The company will argue that the administrative record contains no serious assessment of foreign or technical risk and that the only “problem” identified was Anthropic’s refusal to provide certain capabilities.

Second, Anthropic brings an Administrative Procedure Act challenge. Under 5 U.S.C. § 706(2)(A), a court must set aside agency actions that are “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” Courts often summarize this by requiring that an agency demonstrate a rational connection between the facts found and the choice made. If the “facts” are primarily that a vendor declined to drop its safety rules and that the President was angry about it, those facts may not rationally support a supply‑chain risk label meant for foreign infiltration scenarios.

Within the APA claim, Anthropic also argues that the Pentagon failed to consider less restrictive alternatives. Before the designation, the company offered to maintain existing limitations, explore narrower contract terms, and adopt mitigation measures. The department could have scoped Claude’s use to lower‑risk domains, added human‑review requirements, or phased down reliance without resorting to a formal risk designation. Skipping directly to the most severe remedy, a supply‑chain ban with government‑wide implications, is classic evidence that an action is arbitrary and capricious.

Third, Anthropic alleges First Amendment retaliation based on viewpoint discrimination. The company’s leaders have articulated a clear “safety‑first” philosophy: they are willing to forgo revenue rather than provide AI capabilities without certain guardrails. If the court concludes that the designation was motivated by disagreement with Anthropic’s protected speech and safety philosophy, the government would face serious First Amendment scrutiny. In U.S. doctrine, targeting a speaker because of the specific perspective it expresses is one of the most disfavored forms of government action.

Courts sometimes treat contracting differently from traditional speech forums, and the government will likely argue that it has broad discretion in choosing vendors. Anthropic’s challenge is to show that this is not a routine contract decision but an attempt to punish the company for its stance on AI safety and public statements. The close timing between Anthropic’s public refusals, the Truth Social post, and the formal letter will be a central piece of that proof.

Courts, National Security, and the Six‑Month Transition Problem

Judges are generally wary of substituting their judgment for the executive’s when national security systems and classified information are involved. The government will argue that the designation reflects sensitive assessments that cannot be fully disclosed. However, even in this arena, agencies must stay within statutory bounds and must articulate a reasoned explanation based on the record.

Two facts in particular weaken the Department’s position. The first is the six‑month transition period. A genuine supply‑chain compromise analogous to a hostile backdoor would normally trigger rapid removal rather than a prolonged transition period. Allowing a lengthy wind‑down while continuing to operate the technology in critical systems sits uneasily with the idea of an urgent security flaw. Anthropic will argue that this mismatch is powerful evidence that the designation was not about immediate risk, but about pressure and punishment.

The second is continued operational reliance. Reporting indicates that Claude has remained integrated in some analytic pipelines related to Iran‑focused operations and the U.S. operation targeting Nicolás Maduro. If the Department claims that Claude is too risky to be allowed in any contractor environment, while simultaneously using it in its own sensitive workflows, courts may see that as undercutting the credibility of its claimed security rationale. In practical terms, the government’s behavior tends to support Anthropic’s argument that the label is pretextual.

Human Oversight, War‑Game Studies, and Why Anthropic Drew Its Line

Anthropic’s refusal to accept “all lawful purposes” is grounded in concrete concerns about how AI behaves in warfighting scenarios. Studies of AI‑assisted military simulations have shown that models can escalate conflict more aggressively than human decision‑makers. In some experiments, AI systems repeatedly recommended the use of tactical nuclear weapons or other extreme options in a very high percentage of runs, and proposed escalatory moves that human commanders would reject because of deterrence stability and humanitarian considerations.

The exact numbers and test conditions vary among studies, and Anthropic and its allies have shifted toward describing the pattern rather than citing a single figure. The core insight is simple: when asked to “win” in simulated conflicts, AI models can favor escalatory moves, including nuclear options, far more often than humans do because they lack lived experience, moral intuition, and fear of annihilation.

Inside Anthropic, engineers reportedly observed similar tendencies in internal tests. Under certain prompts, Claude could suggest strategies that would be unacceptable if executed directly, especially in contexts involving the use of force or coercive surveillance. This is why Anthropic insists on keeping humans “in the loop” for lethal or escalatory actions, and why it rejected contract language that would have allowed Claude’s outputs to drive weapons systems or surveillance decisions without human review. The dispute is not about whether Claude can write code or summarize documents; it is about whether its judgments should ever substitute for human command in matters of life, death, and war.

Financial Stakes, Investor Risk, and the Future of “Sovereign AI Labs”

The supply‑chain designation carries significant financial and strategic consequences. For Anthropic, it threatens to cut off the DoD as a customer and to complicate relationships with primes and subcontractors that build systems for the Pentagon. Analysts estimate that billions of dollars in potential revenue over coming years could be affected if the designation remains in place and signals to other agencies that Anthropic is a problematic vendor.

Investors must now factor in not just technical competition, but also political and regulatory risk. A company viewed skeptically by its own government’s defense establishment may find some foreign governments equally cautious. The designation could affect future fundraising and the valuation that public markets assign if Anthropic eventually goes public.

At the same time, the case has crystallized a larger question about the role of advanced AI labs in democratic societies. One vision treats them as “defense utilities,” tools that are expected to align fully with the security state’s preferences wherever lawful. Another envisions something closer to “sovereign AI labs,” independent institutions with their own safety philosophies and red lines, even when working with powerful clients. By supporting Anthropic, researchers at OpenAI, Google, and other firms are implicitly arguing for the latter model, where labs can refuse high‑risk applications without being crushed by procurement sanctions.

Microsoft and Google, by publicly stating that they will not remove Claude from their clouds for non‑DoD users, have taken a narrower but still significant position: that a single agency’s supply‑chain designation should not automatically dictate the availability of an AI model to the broader economy. That stance helps stabilize commercial usage while the legal battles play out.

Why This Case Matters for AI Regulation and Constitutional Law

The Anthropic versus Department of Defense dispute sits at the intersection of AI safety, procurement law, and constitutional protections.

On the regulatory front, it will help determine whether AI companies can maintain enforceable safety guardrails when dealing with national security agencies. If the courts accept the idea that refusing to allow “all lawful purposes” can trigger a supply‑chain risk designation, other AI labs may conclude that the only safe course is quiet compliance rather than publicly articulated red lines. That outcome would weaken the emerging norm that powerful models should be designed and deployed with explicit safety constraints.

On the constitutional front, the First Amendment retaliation claim raises the stakes. Anthropic is effectively arguing that it is being punished for taking a “safety‑first” viewpoint on AI deployment. If the court agrees that viewpoint discrimination played a significant role, the government will face serious First Amendment scrutiny, even in a contracting context. How the courts parse this issue will send a signal to other companies and researchers about how safe it is to speak publicly about the dangers of certain government uses of AI.

Finally, the case underscores that statutory constraints still matter in an era of rapid technological change. The Department of Defense remains legally the Department of Defense, not the Department of War, and supply‑chain statutes remain tied to the concept of foreign compromise, not a catch‑all for disciplining domestic vendors. How the courts enforce those boundaries will shape not only Anthropic’s future, but also the broader relationship between democratic oversight, private AI labs, and the institutions that wield military power.

Key Takeaways

• Anthropic’s lawsuits argue that the Pentagon used supply‑chain authorities designed for foreign and technical infiltration risks to retaliate against a domestic AI company for refusing to provide Claude “for all lawful purposes,” including mass surveillance and fully autonomous weapons.

• Experts note this may be the first time the supply‑chain risk authority has been applied to a major U.S. technology company rather than a foreign‑linked vendor, setting a precedent that other domestic AI and tech firms will have to watch closely.

• The six‑month transition period and continued operational reliance on Claude in some analytic pipelines related to Iran‑focused operations and the U.S. operation targeting Nicolás Maduro are central to Anthropic’s APA argument: a genuine supply‑chain compromise analogous to a hostile backdoor would normally trigger rapid removal, not prolonged use, which undercuts the government’s stated risk rationale.

• Anthropic’s engineers concluded that Claude should not make unreviewed decisions in lethal or escalatory contexts, and the company is asking the courts to recognize that those expert safety assessments must be considered in procurement decisions, rather than overridden purely for operational convenience.

• If the court finds that disagreement with Anthropic’s “safety‑first” philosophy and public speech was a significant motive for the designation, the government will face serious First Amendment scrutiny based on viewpoint discrimination principles, which are deeply disfavored in U.S. constitutional law.

• The outcome will influence whether advanced AI labs in the United States operate as independent actors with enforceable ethical constraints or as de facto defense utilities that must yield whenever the national security state demands “all lawful uses” of their technology.