Appeals Court Says Claude’s Refusals Are a National Security Risk

WASHINGTON – The Pentagon never argued that Claude was dangerous. It argued the opposite: that the model’s refusals made it unreliable, and a federal appeals court agreed that was reason enough to cut Anthropic out of the Defense Department’s supply chain entirely.

The U.S. Court of Appeals for the D.C. Circuit ruled 2-1 on Friday that the Department of War, as the Pentagon is now formally named, had ample grounds to designate Anthropic a supply chain risk under a 2018 federal security law. Judge Gregory Katsas, writing for the majority and joined by Judge Neomi Rao, found that Claude’s built-in restrictions had “on more than one occasion” stopped the model from completing tasks government users requested, and that a dispute over whether those restrictions applied during an active overseas military operation left the department genuinely unable to predict how Claude would behave when it mattered most.

That reasoning is the actual substance of the ruling, and it inverts the industry’s usual pitch to the Pentagon. Anthropic has spent two years selling Claude partly on the strength of its refusals, the contractual guarantees that the model will not be used for lethal autonomous weapons or domestic mass surveillance. The court did not dispute that those guardrails reflect Anthropic’s genuine safety commitments. It ruled that a system a military customer cannot fully predict is, by definition, a supply chain problem, whatever the reason for the unpredictability.

The designation itself dates to March, when the Pentagon told Anthropic’s leadership it intended to phase the company’s services out of its systems entirely by the end of September. A district court initially blocked that move, one of two parallel legal tracks the standoff has run on: a federal judge in San Francisco ruled last month that a related designation under a different statute was unconstitutional retaliation for Anthropic’s stated AI safety positions, a decision that survives Friday’s ruling because it rested on separate legal grounds. Friday’s D.C. Circuit panel considered only the Federal Acquisition Supply Chain Security Act claim, and rejected Anthropic’s arguments that the exclusion was arbitrary, unauthorized by statute and unconstitutional in one sweep.

The dispute traces to February, when Anthropic refused Pentagon demands to loosen contractual limits on Claude’s use in autonomous weapons systems and domestic surveillance, a stance it has held even as Trump ordered the Pentagon to loosen its own rules on autonomous weapons more broadly. Judge Karen Henderson dissented from Friday’s majority, though the opinion does not resolve whether her disagreement centered on the statute’s scope or the department’s evidence. Anthropic said in a statement it “respectfully disagrees” with the ruling and is considering further review, including by the full appeals court.

What the ruling leaves open is whether other frontier AI developers now face the same exposure. Any company whose model is contractually restricted from certain military tasks, which is to say any company still committed to safety guardrails at all, could in principle be read by the same logic as an unpredictable supply chain component. The Pentagon has not said whether it intends to apply the standard elsewhere, and no comparable case involving another AI vendor has yet reached the courts. For now, the practical effect is narrower and more immediate: Anthropic’s products are formally excluded from the department’s information systems and those of its contractors, a loss the company has previously estimated in the hundreds of millions of dollars, pending whatever comes of its next appeal.