Judge Gregory Katsas wrote a sentence Friday that I’ve now read four times, and each pass lands closer to the opposite of what I expected. The Pentagon’s supply chain risk label against Anthropic, he wrote for the majority, turns on what Anthropic does, not why Anthropic does it. That’s the entire ruling compressed into one line, and it gets worse the longer I sit with it.

The U.S. Court of Appeals for the D.C. Circuit ruled 2 to 1 on Friday that the Department of Defense had “ample support” for designating Claude a national security supply chain risk, which means DoD keeps pulling Claude out of its own systems and keeps barring contractors from touching it on defense work. Katsas and Judge Neomi Rao formed the majority, both nominated by Trump. The dissent came from Judge Karen Henderson, nominated by George H.W. Bush, who wrote she couldn’t agree this is “the scenario the Congress had in mind” when it passed the Federal Acquisition Supply Chain Security Act in 2018, a law aimed at sabotage by hostile foreign actors, not a company declining to let its own model do something.

The majority built the ruling on Anthropic’s own words. The company concedes it “encodes restrictions into Claude that prevent the model from performing tasks that Anthropic wishes to prevent,” and Katsas notes that on more than one occasion those restrictions have actually stopped Claude from doing something a government user asked for. The Department, he wrote, “reasonably feared” Anthropic might use that same design lever to block tasks the Pentagon considers contractually authorized. Read that back slowly. The court is treating the fact that Anthropic built guardrails against autonomous weapons targeting and mass surveillance as the evidence that Anthropic is the risk, not the tasks it was trying to prevent.

I wrote in early September about the Pentagon confirming it would drop Anthropic days after a different court called that earlier designation illegal and baseless, and I framed it then as a company getting punished for negotiating what its own product would be used for. Friday’s ruling doesn’t touch that earlier case at all, which is the part that’s hard to hold in your head at once. The D.C. Circuit judges said plainly they have “no quarrel” with the California court’s conclusions. They just decided a different statute, aimed at a different kind of designation, doesn’t require bad motive to apply. Anthropic now has one federal court on record saying the government acted illegally by punishing it for criticism, and a different federal court on record saying the government had every right to exclude it anyway, and somehow both rulings are true at once, each in its own lane.

Pentagon CTO Emil Michael did not go for restraint. “The hammer of justice has smashed AnthropicAI’s arguments,” he posted, adding that “warfighters will sleep better knowing that no private company will insert their opinions in the chain of command.” Department spokesman Sean Parnell called it a ruling that “completely validates the Department’s position.” Anthropic’s own statement landed flatter: it “respectfully disagrees,” points back at the California ruling, and says it’s “considering all options, including further review.” Reading those two tones side by side tells you which side thinks the fight is over.

Practically, this ruling only reaches Defense Department systems and DoD contractor work. This decision doesn’t bar Anthropic’s products from the rest of the federal government, a distinction that will matter less in headlines than in whatever Anthropic’s sales team does with it next quarter.

What actually bothers me is the incentive this creates going forward. I don’t think the judges got the narrow statutory question wrong so much as they’ve handed down a ruling that makes caution itself the disqualifying trait. Anthropic already skipped UK safety testing on its newest model this month, in a move UK officials read as protectionist, in the same news cycle where one of its own researchers put double-digit odds on an AI extinction scenario. Now a federal appeals court has effectively ruled that the more restrictions a lab builds into its own model, the more that lab looks like a supply chain risk to a government buyer who wants those restrictions gone. That’s a strange incentive to hand an industry the same weeks California is trying to mandate AI kill switches from the opposite direction, and it’s the kind of contradiction that three continents’ worth of AI enforcement keeps producing whenever more than one government decides it gets to grade the same homework.

I don’t know if Anthropic wins on further review, and I’m not going to pretend the legal odds are obvious to me.

A company built a product with limits on purpose, told the government about those limits, and a court just ruled that telling the government was itself the disqualifying act.

Sources