Judge Blocks Pentagon Blacklist of Anthropic as Illegal

A federal judge has thrown out the Pentagon’s attempt to blacklist Anthropic, ruling that the government illegally retaliated against the Claude maker for refusing to strip safety limits off its models. In a 59-page opinion, U.S. District Judge Rita Lin of the Northern District of California found that the Defense Department violated Anthropic’s First Amendment speech rights and its Fifth Amendment due-process rights, and ordered the government to rescind the directives it had issued against the company.

The decision, made public this week, is the first time a court has weighed in on a fight that has been building since February between the U.S. military and one of the country’s largest AI developers — and it hands AI labs a concrete legal precedent for the proposition that the government cannot punish them simply for drawing safety lines around how their technology is used.

How the fight started

The dispute traces back to Anthropic’s refusal to remove safeguards that prevent Claude from being deployed for two specific categories of work: fully autonomous weapons and mass domestic surveillance. According to the ruling, the Defense Department wanted unfettered access to Claude across all lawful purposes, and Anthropic declined, insisting on assurances that its models would not be wired into autonomous kill decisions or blanket surveillance of Americans.

Anthropic’s position rests on two claims. The first is a capability argument: the company maintains that current AI models are not reliable enough to be trusted inside autonomous weapons systems, where an error is measured in lives rather than tokens. The second is a rights argument: Anthropic says it opposes domestic mass surveillance as a violation of civil liberties, full stop. The Pentagon’s counter-position, as summarized in the case, was blunt — that private companies should not be able to constrain military action by attaching conditions to the tools they sell.

When Anthropic held its ground, Defense Secretary Pete Hegseth designated the company a national security supply-chain risk. That label is not a routine procurement dispute. It is the kind of designation the government reserves for firms it believes could expose military systems to infiltration or sabotage by foreign adversaries — a scarlet letter that can cascade across the entire federal contracting apparatus and, by Anthropic’s own account, cost the company billions of dollars in lost business and reputational harm.

What the judge found

Judge Lin’s opinion did not treat the designation as a close call. She found that officials had retaliated against Anthropic in violation of the First Amendment — punishing the company for taking a public position the administration disliked — and had stripped it of protected liberty interests without adequate notice or a meaningful chance to respond, the core of a due-process violation.

More striking was how the ruling handled the government’s national security rationale. Lin repeatedly picked apart the Pentagon’s central claims about what Claude could do, describing some of them as “entirely unfounded.” In one of the opinion’s sharpest lines, she wrote that “the empty invocation of national security is not a blank check to punish and retaliate against government critics.” That framing matters: courts are historically deferential when the executive branch raises national security, and a judge writing that the invocation here was empty is a signal that the record did not support the label the Pentagon tried to attach.

The remedy is targeted. The court ordered the government to rescind the directives issued against Anthropic under the supply-chain-risk designation. It stopped short, however, of compelling the Pentagon to resume buying Anthropic’s products — a court can strike down an unlawful blacklist, but it cannot force an agency to sign a contract. The practical effect is that the formal barrier is gone, while the commercial relationship remains the Defense Department’s to rebuild or not.

The safety-versus-access collision

The case crystallizes a tension that has been latent across the whole industry: AI labs increasingly ship models with hard-coded usage limits, and their largest potential customer — the U.S. government — increasingly wants those limits removed. Anthropic has been the most vocal holdout on questions of how far a model should be allowed to go, a posture consistent with its stance in the open-weight release debate, where it broke from rivals over how much control to give up.

That posture has a cost, and the Pentagon episode is the sharpest example yet of what it can be. The same company that has courted Washington on questions of AI security — testifying alongside peers in the congressional hearings on AI-enabled hacking and publishing evaluations of real-world misuse of its models — found itself branded a security threat for refusing a different set of government demands. The ruling suggests those two things can coexist: a lab can be a cooperative partner on defense against AI misuse while still saying no to specific military deployments, and the government cannot lawfully treat the second as evidence of the first.

The fight also lands against a backdrop of intensifying debate in Washington over who gets to control frontier systems and where the off switches live — themes running through proposals like the AI kill-switch legislation now circulating on Capitol Hill. Lin’s opinion does not resolve those larger questions, but it stakes out one boundary clearly: the executive branch cannot use the machinery of national security designations to coerce a private developer into abandoning its own safety commitments.

What it means

The immediate winner is Anthropic, which removes a designation that threatened its standing across federal contracting and, just as important, gets a judicial finding that its safety stance was lawful rather than obstructive. For a company weighing public markets — it has already filed confidentially for an IPO — clearing a “national security supply-chain risk” label off its record ahead of that process is worth more than any single defense contract.

The broader significance is precedential. For the first time, an AI lab has a court ruling it can point to when the government pressures it to loosen model constraints: retaliating against that refusal can violate the First and Fifth Amendments. That gives every frontier developer more room to hold safety lines under government pressure, and it slightly rebalances a negotiation that has, until now, tilted heavily toward the buyer with the biggest budget and the national-security card to play.

The losers are more complicated. The Pentagon loses this round and absorbs a judicial rebuke of its national-security reasoning, but it retains the ultimate leverage — the decision of whether to buy at all. Expect the government to weigh an appeal, and expect it to lean harder on developers that impose fewer restrictions. That is the real competitive dynamic to watch: if Anthropic’s safety limits make it a harder sell to the Defense Department, rivals willing to offer fewer constraints may capture the government workloads Anthropic won’t touch, ruling or no ruling.

Three things will tell the story from here. First, whether the administration appeals and how a higher court treats Lin’s skepticism of the national-security rationale. Second, whether the Pentagon quietly resumes purchasing from Anthropic now that the formal barrier is gone, or routes those dollars to less-restricted competitors. And third, whether other labs read this ruling as cover to publish and defend their own hard limits — or as a warning about how expensive a fight with the government can get, even when you win.