DC Circuit lets the Pentagon treat Claude's built-in restrictions as a supply-chain risk

The user moment at the center of this case is small. A government user asks Claude to do a task, and restrictions Anthropic built into the model stop it. According to The Next Web's account of the opinion, that happened more than once ^[5]. The parties also disputed whether the contract barred Claude's use in an ongoing overseas military operation ^[15].

"The Department reasonably feared that Anthropic might manipulate Claude's design to prevent it from performing national-security functions that the Department deems contractually authorized and necessary," Judge Gregory Katsas wrote for the majority ^[6][2]. The key word is "manipulate." The 2018 law the Pentagon used covers a supplier that could "sabotage", "extract data" or "otherwise manipulate" a product ^[12]. Anthropic read the word as meaning deliberate, deceptive acts, and the majority read it more broadly ^[13].

Judge Karen LeCraft Henderson dissented ^[2]. She wrote that Congress passed the law after warnings that hostile states were getting into federal systems through suppliers, and that this history does not cover a contractor's "honest and upfront enforcement of restrictions" ^[16]. The majority wrote: "But in our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks" ^[17]. The administration now calls the Pentagon the Department of War ^[14].

Here's what teams tell themselves users do: they stay inside an acceptable-use policy, and the policy is a clause someone negotiated. Here's what users actually do: they send the request, and the restrictions encoded in the model decide whether it gets done ^[3][5]. The majority looked at both layers. It said the Pentagon excluded Anthropic over the company's "refusal to assent to a contract term that the Department deemed essential" ^[11]. It also said the restrictions Anthropic encodes into Claude supported the national-security finding ^[3].

WIRED reports that the surviving label will stay in place indefinitely, and that both court fights face the prospect of years of appeals ^[8]. The coverage says the bar applies to Defense Department work ^[4]. It does not say whether the label reaches a contractor's purely commercial use of Claude. For Defense Department workloads, I think the migration plan should start now. The tradeoff is that a contractor may pay for a switch that a later appeal in Anthropic's favor would have made unnecessary.

Two questions sort out where a contractor stands. The first is whether Claude touches Defense Department work at all. The second is how long a model swap takes: days if Claude sits behind a routing layer, months if prompts and evaluations were tuned to it. Defense work on a tightly wired Claude is a funded project with a named owner. Defense work behind a routing layer is a configuration change for those workloads alone. A swappable setup with no Defense work can stay put while the appeals run. Deep integration with no Defense work mostly raises questions from customers. Anthropic said it lost revenue after the designations because customers were concerned about doing business with a government pariah ^[19].