D.C. Circuit calls Claude's refusals a supply chain risk

Two of three D.C. Circuit judges agreed that you "manipulate" a doorknob just by turning it. That plain reading of a 2018 law was enough to treat Claude's built-in refusals as a supply chain risk and to reject Anthropic's challenge to its exclusion by the Department of War, according to excerpts of the opinions published by Reason.

At a glance

• Anthropic had refused to loosen contract terms barring Claude's use for lethal autonomous warfare or domestic surveillance, and the Department of War then excluded Claude from its supply chain under a 2018 law.
• The majority read "manipulate" in the statute broadly, so a vendor that encodes restrictions stopping Claude from doing lawful tasks requested by the Department counts as a supply chain risk.
• The catch is a divided bench: Judge Karen LeCraft Henderson dissented on statutory grounds, and District Judge Rita Lin had ruled the other way in the earlier case.

If you missed the earlier rounds, this started as a contract fight. Anthropic refused to relax contractual prohibitions on using Claude for lethal autonomous warfare or domestic surveillance, and the Department excluded Claude under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). Anthropic called the exclusion arbitrary, unauthorized by the statute and unconstitutional, and District Judge Rita Lin ruled the other way in the earlier case.

The majority says Claude's restrictions stopped government work more than once

Judge Gregory Katsas wrote the majority opinion, and Judge Neomi Rao joined it. They held that the Department had ample support for concluding that keeping Claude in its information systems presented a national-security risk covered by the statute. That applies whether the Department itself uses Claude or its contractors do.

The court relied on three facts. Anthropic admits it encodes restrictions into Claude that stop the model from doing tasks the company wants to prevent. More than once, those restrictions stopped Claude from doing tasks government users asked for. And a recent dispute over whether the contract barred Claude's use in an ongoing overseas military operation left the Department unsure whether Claude would perform as needed.

The majority set out the risks on both sides. The Secretary warned that overly constrained models could shut down unexpectedly and make military operations fail. Anthropic warned that unconstrained models could hallucinate inappropriate targets for lethal force. The court called both real national-security concerns, then said the President and the Secretary of War must decide how to weigh them against each other.

Prompt notice and a contract term defeated the constitutional claims

The due-process claim failed because, in the majority's account, the Department promptly told Anthropic about the exclusion and why, then gave the company a fair chance to contest it. The First Amendment claim failed on cause. The court found the Department acted because Anthropic refused a contract term the Department considered essential, not because the company supports more government regulation of AI.

So the court kept two things apart: Anthropic's policy advocacy, and the terms it attaches to Claude's use. Only the second drove the exclusion, the majority held, and it denied the petitions for review.

Section 4713(k)(6) turned on the words "otherwise manipulate"

FASCSA lets the Secretary blacklist a procurement source only after the Department concludes it poses a "significant" risk. The definition lists acts such as sabotage, maliciously introducing unwanted functions and extracting data. It ends with a catch-all, "or otherwise manipulate", covering anything done to covered articles that lets someone surveil, deny, disrupt or manipulate how they work.

Anthropic read "manipulate" to mean deliberately subversive acts done through deception. The Secretary, and the majority, read it to mean moving, operating or controlling something by hand or by mechanical means, whatever the purpose. Under that reading, turning a doorknob or pressing a gas pedal counts as manipulating it.

Picture a locksmith who secretly changes your locks, and then a landlord whose lease openly bans subletting. Under Anthropic's reading, only the locksmith manipulates anything. The majority also refused to read in a secrecy requirement just because two of the seven verbs in the lists, sabotage and surveil, suggest one. It rejected a focus on foreign companies too, because the definition covers "any person."

Judge Henderson reads the 2018 law as aimed at hostile infiltrators

Judge Henderson dissented on statutory grounds. When Congress takes the trouble to define its terms, she wrote, courts should apply them with rigor. She granted that both meanings of "manipulate" may be linguistically possible, but found that the surrounding text clearly favors the narrower one.

She pointed to history. Congress passed FASCSA after the intelligence community asked for legislation against hostile nation states and other bad actors getting into federal systems through supply chains, and agency reports described covert breaches in terms close to the statute's own. That history, she wrote, does not cover:

a contractor's honest and upfront enforcement of restrictions on a covered article's use disfavored by the government.

The excerpts leave a lot out. They do not say which tasks Claude refused, how often, or which overseas operation was in dispute, and the full opinions contain more reasoning than Reason quoted. In our view, the oddest part is that Anthropic's openness is what the court counts against it: restrictions the company admits and writes into its contracts now fall under the same definition that covers sabotage.

After the D.C. Circuit denial

The excerpts do not say whether Anthropic will ask the full D.C. Circuit to rehear the case or take it to the Supreme Court, and no timeline has been given. The author of the Reason post says he hopes to write more on the statutory and constitutional questions later. For contractors building Claude into Department systems, the open question is how long the exclusion stays in place while judges remain divided over the statute.