D.C. Circuit Upholds DOD Exclusion of Anthropic Claude From Defense Supply Chain

On 25 September 2026 the U.S. Court of Appeals for the D.C. Circuit rejected Anthropic's petition and upheld the Department of Defense exclusion of Claude from the defense supply chain. The fight turned on Anthropic's two contract red lines against lethal autonomous combat and mass surveillance of Americans, which DOD refused to accept in an all-lawful-uses clause.

Ruling

On 25 September 2026, the U.S. Court of Appeals for the D.C. Circuit rejected Anthropic's petition and upheld a Department of Defense (DOD) decision to exclude Claude from the defense supply chain. DOD had cited supply-chain security after Anthropic refused to drop two contractual limits: no use in lethal autonomous combat, and no use in mass surveillance of Americans.

Background

From 2024, U.S. defense and intelligence agencies used Claude through contractors. In March 2025, Anthropic launched Claude Gov and gradually allowed processing of classified material, foreign intelligence analysis, weapons-system design, and offensive cyber operations. In autumn 2025 the parties discussed a direct contract. DOD sought an all lawful uses clause. Anthropic said it could ease other limits but would keep the two exceptions.

In January 2026, Secretary of War Hegseth required models free of usage-policy limits that would block lawful military applications, and directed that procurement contracts include an any-lawful-use term. DOD then invoked the Federal Acquisition Supply Chain Security Act (FASCSA) and removed Anthropic from the supplier list. Anthropic sued.

Parallel cases

Anthropic filed two actions. In the U.S. District Court for the Northern District of California it challenged a presidential directive, Hegseth's directive, and a DOD designation under 10 U.S.C. §3252, a statute aimed at adversary backdoors, sabotage, or malicious implants. In the D.C. Circuit it sought review of the procurement exclusion under 41 U.S.C. §4713, which applies to any person and covers products, services, or supply chains that may endanger federal systems.

In August 2026 the California court ruled for Anthropic on the §3252 track, holding that the adversary-focused designation did not apply to the company. In September the D.C. Circuit ruled against Anthropic on §4713, holding that the exclusion can cover a domestic non-adversary firm.

Judge Henderson reserved on policy grounds, saying FASCSA was written against foreign adversaries and malicious actors, and that DOD had read it broadly. Henderson also noted the statutory subject is any person, so a pure legal-error claim is hard to win. Henderson said the outcome could let the government demand that a vendor strip technical or contractual safety limits and exclude the vendor if it refuses, even when those limits are public, written into contract, and intended to block unlawful or unconstitutional uses.

Supply-chain reasoning

The D.C. Circuit treated risk as a function of what Anthropic did, not of motive. It credited DOD's account that Claude had refused government tasks, that the two red lines were operationally unclear and could trigger refusals or feature limits, that model complexity prevents DOD from clearing uncertainty with limited tests, and that DOD cannot remain on old models indefinitely. Under 41 U.S.C. §4713, the court said, DOD may treat a model that refuses tasks the department deems lawful and necessary as a supply-chain risk.

The court did not decide whether lethal autonomous combat or mass surveillance of Americans is lawful. It did not hold that every federal agency may demand unbounded all-uses terms. It held that DOD may decline to buy a model whose vendor will not accept DOD's task boundaries.

Anthropic proposed limiting any exclusion to systems that might involve lethal autonomous combat or domestic mass surveillance. The court said per-system cuts are unworkable because an embedded model can constrain a larger system, and because reviewing every contractor and use case would add delay, cost, and uncertainty.

Anthropic also argued DOD could test each new model and keep an older build if unsatisfied. The court rejected that. It said concepts such as fully autonomous combat, human-in-the-loop control, and mass surveillance are not binary and vary by task, prompt, and setting. Court materials cited Claude parameter counts in the 5 trillion to 10 trillion range, limited auditability, and Anthropic's statement that slight wording changes can change replies. Claude Gov shipped multiple versions in 2025. The court said DOD cannot freeze on an old release.

Scope of the holding

The judgment addresses procurement eligibility, not product liability, and does not allocate downstream AI risk on a Section 230 model. Product, contract, domestic, and international-law duties do not disappear because a contract recites lawful uses.

On speech and process claims the two courts diverged. The California court found First Amendment retaliation and Fifth Amendment defects in the government's public statements, timing, and broad ban. The D.C. Circuit held that Anthropic's safety advocacy is protected, but that the exclusion followed refusal of contract terms DOD deemed necessary, and that action first with later process can meet due process given rapid model change and military urgency.

Court records described three Anthropic controls: training that encodes harm avoidance, privacy, and political freedom; technical monitoring of dangerous activity and jailbreaks; and a Usage Policy that bans specified uses. Anthropic told the court that models can be jailbroken and that from mid-2025 it added a second technical defense layer.

The parties framed the dispute as who sets permission and exceptions: the lab in the product, or the state customer inside authorization rules. The D.C. Circuit confirmed DOD's power not to purchase. It did not address supervision of that power, product liability after a serious incident, or whether older surveillance and intelligence statutes remain adequate for new model capabilities.