A federal appeals court has let the Pentagon keep Claude out of its supply chain. On September 25, 2026 a three-judge panel of the U.S. Court of Appeals for the D.C. Circuit denied Anthropic’s petitions for review, 2 to 1, and upheld the Department of War’s decision to exclude Claude under the Federal Acquisition Supply Chain Security Act of 2018. “Accordingly, we deny the petitions for review,” Judge Gregory Katsas wrote for the majority. Judge Karen LeCraft Henderson dissented.
The ruling does not end the fight. A federal judge in San Francisco set aside a parallel designation under a different statute on August 27, and Anthropic says it is weighing further review. This page is the dated record: what the court held, the two contract lines at the center of it, how the two rulings fit together, and who is actually affected. Quotes are from the 51-page opinion or from statements carried by CNBC and Breaking Defense.
On this page · 13 sectionsOpen
On September 25, 2026 the U.S. Court of Appeals for the D.C. Circuit denied Anthropic’s petitions and upheld the Department of War’s decision to exclude Claude from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018. The vote was 2 to 1: Judge Gregory Katsas wrote for himself and Judge Neomi Rao, and Judge Karen LeCraft Henderson dissented.
The dispute came down to two contract lines. Anthropic had relaxed most of its use restrictions for the military but kept two: no lethal autonomous warfare and no mass surveillance of Americans. The Department wanted a term allowing all lawful uses; Anthropic refused on February 26 and the exclusion was ordered on March 3.
The majority held the Department had ample support: Anthropic trains restrictions into Claude and can change its guardrails with each model it delivers, which the court accepted as a risk the statute covers. It rejected the statutory, APA, First Amendment and due-process claims.
Two courts, two statutes. On August 27 a federal judge in San Francisco set aside a separate designation under 10 U.S.C. 3252, whose definition speaks of an adversary. The D.C. Circuit upheld the action under 41 U.S.C. 4713, whose definition speaks of any person. Both rulings stand for now.
Henderson read the statute to require hostile or subversive conduct and warned that the Department’s reading reaches good-faith safety restrictions. Anthropic says it respectfully disagrees and is considering all options, including further review.
Who it affects: Department of War systems and contractors doing Department work. It is not a ban on commercial use of Claude. For everyone else the lesson is portability: a buyer’s policy can take a model away, and the work built on it should not have to stop.
§ 01What the court held
| Item | Detail |
|---|---|
| Court | U.S. Court of Appeals for the D.C. Circuit |
| Case | Anthropic PBC v. United States Department of War, Nos. 26-1049 and 26-1162, consolidated |
| Argued, decided | May 19, 2026; September 25, 2026 |
| Panel | Henderson, Katsas, Rao |
| Vote | 2 to 1; opinion by Katsas, dissent by Henderson |
| Statute | Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 4713 |
| Holding | Petitions denied; the exclusion stands |
| Claims rejected | Statutory, APA, First Amendment, due process |
The majority found “ample support for its conclusion that the continued integration of Claude” into the Department’s systems, by the Department or its contractors, was a risk the statute covers. The reasoning turns on how Claude is built. Anthropic trains usage restrictions into the model, and the Department’s case, drawn from a memo by Under Secretary Emil Michael, rested partly on Anthropic’s ability to “alter system guardrails and model weights” with each model it delivers.
The court leaned on the record of Claude refusing government work. Early commercial versions, the opinion recounts, declined tasks such as “summarizing threat assessments, processing classified documents, or translating intercepted materials describing violence,” which is why Anthropic built a separate Claude Gov model, released in March 2025. The majority’s closing line: “In doing so here, the Secretary did not transgress any limits on his authority under the Supply Chain Security Act or the Constitution.”
§ 02Two contract lines
The fight was never about whether the military could use Claude. According to the opinion, “Anthropic agreed to substantially relax the prior use restrictions,” permitting weapons design, foreign intelligence analysis and offensive cyber operations. It kept prohibitions on “lethal autonomous warfare” and “mass surveillance of Americans,” which it called “two critical exceptions.”
The Department wanted a term allowing all lawful uses. Secretary Pete Hegseth met Anthropic CEO Dario Amodei on February 24 and set a February 27 deadline. Anthropic refused publicly on February 26. On March 3 the Secretary made the formal determination, and on March 6 the Department’s Chief Information Officer ordered Anthropic products removed “as soon as practical” and barred contractors from using them in their Department work. The opinion also notes that “The Department quickly moved to expand its contractual relationship with OpenAI.”
§ 03The chain, dated
| Date | Event | Source |
|---|---|---|
| Mar 2025 | Anthropic releases Claude Gov for national-security agencies | Opinion |
| Fall 2025 | Direct-contract talks begin; the Department asks for all lawful uses | Opinion |
| Jan 9, 2026 | Hegseth issues the Department’s AI strategy | Opinion |
| Feb 24 | Amodei meets Hegseth; deadline set for Feb 27 | Opinion |
| Feb 26 | Anthropic refuses the all-lawful-uses term | Opinion |
| Mar 3 | Formal determination under 41 U.S.C. 4713 | Opinion |
| Mar 6 | Removal memo; contractors barred on Department work | Opinion |
| Mar 9 | Anthropic petitions the D.C. Circuit | Opinion |
| May 19 | Oral argument | Opinion |
| Jun 3 | Reconsideration denied | Opinion |
| Jun 17 and Jun 24 | Second petition filed; cases consolidated | Opinion |
| Aug 27 | California court sets aside the separate 10 U.S.C. 3252 designation | Opinion |
| Sep 25 | D.C. Circuit denies both petitions, 2 to 1 | Opinion |
| Step | Days |
|---|---|
| Refusal to exclusion, Feb 26 to Mar 3 | 5 |
| Petition to argument, Mar 9 to May 19 | 71 |
| Argument to ruling, May 19 to Sep 25 | 129 |
Five days separated the refusal from the exclusion. The court took 129 days after argument to rule.
§ 04Two courts, two statutes
| Item | Northern District of California | D.C. Circuit |
|---|---|---|
| Date | August 27, 2026 | September 25, 2026 |
| Statute | 10 U.S.C. 3252 | 41 U.S.C. 4713 |
| Whose risk the definition names | An adversary | Any person |
| Outcome | Designation set aside | Exclusion upheld |
| Scope, per Breaking Defense | Broader federal action | Department of War only |
The difference is one noun. Section 3252 defines supply chain risk as “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system. Section 4713 defines it as “the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” a covered product. The majority called the first definition much narrower and said the California decision did not control this one. Breaking Defense put the practical line plainly: the D.C. ruling “only covers the Defense Department ban.”
§ 05The dissent
“Because I believe that the context decidedly favors the narrower reading, I respectfully dissent,” Henderson wrote. Read next to sabotage and malicious introduction, she argued, the definition requires hostile or subversive conduct, and a vendor’s safety policy is neither. She pressed the consequence: under the Department’s reading, it is “immaterial if the contractor enforces the restrictions based on a good faith and legally correct interpretation of them.” The Department, she wrote, “made good on its promise to designate Anthropic a supply chain risk” once Anthropic declined the ultimatum.
The majority engaged the argument directly. The dissent’s points “have some force, but we are ultimately unpersuaded,” Katsas wrote, reading the residual clause as broad enough to reach a supplier that can change how its product behaves.
§ 06Speech and retaliation
Anthropic argued the exclusion punished its public advocacy for AI safety limits. The court accepted that the advocacy was protected and the exclusion materially adverse, then found no causal link. In its words, the Department acted “not because of its advocacy, but because Anthropic refused to agree to a contract term the Department deemed essential to national security.” The majority pointed to the timeline: years of public safety advocacy while talks continued, and action only after the refusal.
§ 07What each side said
Anthropic, in a statement to CNBC: “We respectfully disagree with the court’s decision.” It added: “Another federal court has already held the government’s parallel designation unlawful.” And: “We remain confident in our position and are considering all options, including further review.” CNBC reports the panel delayed its decision from taking immediate effect so Anthropic can seek rehearing before the panel or the full court.
Emil Michael, the Department’s chief technology officer, posted that “the hammer of justice has smashed” Anthropic’s arguments, per Breaking Defense.
§ 08Who this affects
- Department of War systems. The March 6 memo ordered removal within 180 days; that outer limit fell on September 2, 2026.
- Defense contractors. Barred from using Anthropic products in their work for the Department. Work for other customers is outside this action.
- Everyone else. The ruling upholds a procurement exclusion, not a ban on commercial use. The broader federal designation remains set aside by the California court for now.
If you sell to the Department, your contracting officer and counsel decide what this means for your contract. This page is a record, not advice.
§ 09What this means if you run AI on real work
The case is a reminder that the model under your tools can be taken away by someone else’s decision: a buyer’s policy, a court, a vendor’s terms or a price change. Most businesses will never face a supply-chain designation. All of them face the same question at smaller scale: if the model changed tomorrow, what would stop?
§ 10What we are watching for
- A petition for panel rehearing or rehearing en banc, and any order on it.
- A petition to the Supreme Court.
- Any government appeal of the August 27 California ruling.
- What the Department names as Claude’s replacement in classified systems, beyond the OpenAI expansion the opinion records.
§ 11The record
As of September 26, 2026, 04:40 UTC: the D.C. Circuit has upheld the Department of War’s exclusion of Claude under 41 U.S.C. 4713, 2 to 1. The California ruling setting aside the separate 10 U.S.C. 3252 designation stands. Anthropic has not announced its next filing.
§ 12Update log
- September 26, 2026, 04:40 UTC: page opened on the September 25 decision.
§ 13Sources
- U.S. Court of Appeals for the D.C. Circuit, Anthropic PBC v. United States Department of War, Nos. 26-1049 and 26-1162, decided September 25, 2026.
- U.S. District Court for the Northern District of California, Anthropic PBC v. U.S. Department of War, No. 26-cv-01996, August 27, 2026.
- CNBC, U.S. appeals court upholds Pentagon designation of Anthropic, September 25, 2026.
- Breaking Defense, DC Circuit panel upholds Pentagon’s ban on Anthropic, September 25, 2026.
- Courthouse News, DC Circuit finds Pentagon justified, September 25, 2026.
Q1Which law did the court apply?
The Federal Acquisition Supply Chain Security Act of 2018, at 41 U.S.C. 4713. Its definition of supply chain risk covers the risk that any person may sabotage, introduce unwanted function, extract data or otherwise manipulate a covered product. The court held that Anthropic’s ability to change Claude’s behavior through training and guardrails fits that definition.
Q2How is this different from the California ruling?
Judge Rita Lin of the Northern District of California set aside a designation under 10 U.S.C. 3252 on August 27, 2026. That statute defines the risk as coming from an adversary, which the D.C. Circuit called much narrower. The two rulings address two different government actions, so the California result still stands.
Q3Why did the dissent disagree?
Judge Henderson read the definition in context, next to words like sabotage and maliciously introduce, and concluded it requires hostile or subversive conduct. Good-faith safety restrictions, in her view, are not a supply chain risk.
Q4Did the court find the Pentagon retaliated against Anthropic's speech?
No. It accepted that Anthropic’s advocacy was protected speech and that the exclusion was materially adverse, but found no causal link: in the court’s reading, the Department acted because Anthropic refused a contract term, not because of its advocacy.
Q5Does CellCog use Claude?
Yes. CellCog’s Core and Max tiers run on Claude Opus 5.5 and its Flash tier runs on Gemini 3.8 Flash. The ruling does not change commercial access. An AI employee on CellCog keeps its role, memory and task board if the model underneath changes.