D.C. Circuit calls Claude’s refusals a supply chain risk

A divided D.C. Circuit panel on September 25 upheld the Department of War’s decision to drop Claude from its supply chain. The court ruled 2-1 that Anthropic’s ability to stop Claude from doing lawful work the Department asks for counts as a “supply chain risk” under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). Judge Gregory Katsas wrote the majority opinion in <i>Anthropic PBC v. U.S. Department of War</i>, joined by Judge Neomi Rao. Judge Karen LeCraft Henderson dissented.

Most of the case turned on one word in the statute: “manipulate.” According to the excerpts from the opinions published by Reason, the majority read it broadly enough to cover a vendor that openly enforces its own usage terms. The dissent read it as covering only covert sabotage. The court also rejected Anthropic’s due-process and First Amendment claims, and denied the petitions for review.

The record the Department relied on

The exclusion came after Anthropic refused to loosen contract terms that bar using Claude for lethal autonomous warfare or domestic surveillance. The majority said the Department had “ample support” for finding that keeping Claude in its information systems, whether run by the Department or by its contractors, was a national-security risk the statute covers. It gave three reasons. Anthropic admits it encodes restrictions into Claude that prevent the model from doing tasks the company wants to prevent. Those restrictions have stopped Claude from doing tasks requested by government users “on more than one occasion.” And a recent dispute over whether the contract barred using Claude in an ongoing overseas military operation left the Department “uncertain whether Claude would perform as needed and intended.”

The terms in question date back further than this case. The dispute grew out of failed renegotiations of a July 2025 contract that made Claude the first frontier model approved for classified government networks, Mayer Brown said in a client note. On January 9, Defense Secretary Pete Hegseth issued a memo requiring AI systems used by the military to allow “any lawful use,” The Economic Times reported.

The confrontation itself took three days. On February 24, Hegseth gave Dario Amodei until 5:01 p.m. on Friday, February 27 to allow unrestricted use of Anthropic’s models “for all legal purposes.” Anthropic said on February 26 that it would not move. On the deadline day, Trump told federal agencies to stop using Anthropic’s products, and Hegseth designated the company a supply chain risk. Formal letters dated March 3 cited two authorities, 10 U.S.C. § 3252 and FASCSA, and applied the designation to every Anthropic affiliate, product and service. It was the first such designation of an American company. Anthropic sued twice on March 9: once in the Northern District of California, and once in the D.C. Circuit, where it challenged the FASCSA letter. Today’s ruling resolves the second case.

Doorknobs and gas pedals

Under FASCSA, the Secretary can bar a source from the Department’s supply chains “only after” finding that it poses a “significant” risk that it will:

sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

Henderson noted that the majority does not dispute that the case depends entirely on the residual clause “or otherwise manipulate.” Anthropic argued that the word means intentionally subversive acts carried out by deceptive means. The Secretary argued, and the majority agreed, that it means to “move, arrange, operate, or control” something “by the hands or another body part or by mechanical means,” whatever the purpose. Henderson summed up that reading with the examples of turning a doorknob or pressing a gas pedal. On that reading, a refusal Claude was built to make, and that Anthropic disclosed in its contract, is already enough to trigger the statute.

The majority rejected Anthropic’s attempt to add a general requirement of acting secretly “just because two of the seven verbs in the strings (sabotage and surveil) have that connotation.” It also rejected Anthropic’s argument from the legislative history that the law targets “foreign companies working at the behest of foreign states.” Whatever examples individual members of Congress had in mind, the judges wrote, the definition is not limited to “adversar[ies]” and covers “any person,” which “cannot refer only to foreign entities.”

The other authority in the letters is worded differently. The § 3252 definition speaks of the risk that “an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system, the Mayer Brown note said, and the Secretary must first find in writing that “less intrusive measures are not reasonably available.” The FASCSA definition the court applied has “any person” where § 3252 has “an adversary,” and “manipulate” where § 3252 has “subvert.”

The majority’s conclusion, in its own words: “the Secretary’s concern about Anthropic disabling Claude from performing lawful actions requested by the Department qualifies as a ‘supply chain risk’ within the meaning of section 4713.”

Why the constitutional claims failed

The due-process claim failed because the Department “promptly notified the company of the exclusion and its supporting rationale” and then gave it a fair chance to contest it. The First Amendment claim failed because, the majority held, Anthropic was excluded for refusing to agree to a contract term the Department considered essential, not for supporting more government regulation of AI.

District Judge Rita Lin has twice reached the opposite conclusion in the California case. On March 26 she granted a preliminary injunction, finding that the government’s actions after Anthropic publicly refused to allow use in autonomous lethal weapons or mass surveillance were likely unlawful retaliation, Tech Policy Press reported. Two days earlier, at the hearing, she had said: “If the worry is about the integrity of the operational chain of command, [the Department of Defense] could just stop using Claude.” In late August she ruled that the Department had violated the First Amendment by acting “based on a desire to make a public example” of Anthropic.

The D.C. Circuit had already signaled which way it was leaning. On April 8, a three-judge panel denied Anthropic a stay, citing “weighty governmental and public interests on the other side of the ledger,” including forcing the military “to prolong its dealings with an unwanted vendor of critical AI services in the middle of a significant ongoing military conflict,” Tech Policy Press noted.

The majority did not treat the policy question as easy. It wrote that the Secretary raises “the deeply sobering prospect of overly constrained AI models shutting down unexpectedly and thus causing important military operations to fail,” while Anthropic raises “the deeply sobering prospect of unconstrained AI models hallucinating inappropriate targets for lethal military force.” Both are national-security concerns, the judges wrote, “but in our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks.” Sharon Swingle, Brett A. Shumate, Eric D. McArthur, Sean R. Janda and Brian J. Springer argued for the government.

Henderson’s dissent

Henderson’s dissent rests only on the statute. “When Congress takes the trouble to define the terms it uses,” she wrote, courts should apply them “with rigor.” She argued that the context around the residual clause “decidedly favors the narrower reading.” Congress passed FASCSA after the intelligence community asked for tools against ”[h]ostile nation state and other bad actors” getting into federal systems through their supply chains. For years, agencies had warned about companies “beholden to foreign governments” and described covert breaches in terms that closely track the statute’s key words.

That history, she wrote, rules out the conduct that today’s holding treats as a supply chain risk: “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government.”