On September 25 the U.S. Court of Appeals for the D.C. Circuit, 2-1, denied Anthropic's petitions for review of the Department of War's decision to exclude Claude from its supply chain. Judge Katsas wrote for himself and Judge Rao; Judge Henderson dissented.

Four weeks earlier, on August 27, Judge Rita F. Lin of the Northern District of California had ruled the other way on a separate designation of the same company, made under a different statute. She also permanently blocked the President's directive that every federal agency stop using Anthropic's technology.

Both cases pose a question for every AI vendor with a usage policy. Can the government treat a supplier as a supply-chain risk because its product will refuse some jobs? Under one statute the appeals court now says yes. Under the other, the district court said no. Anthropic does not dispute that the Department may simply buy from someone else.

Disclosure: Anthropic is the petitioner in one case and the plaintiff in the other, and Hugin records are drafted with the help of Anthropic's Claude models. This record holds Anthropic to the same standard as any other party.

What the dispute was

In the appeals court's words: "The Department made this decision after Anthropic refused to relax contractual prohibitions on the use of Claude for lethal autonomous warfare or domestic surveillance."

The Department asked in the fall of 2025 to use Claude for "all lawful uses." Anthropic agreed to substantially relax its restrictions but kept what it called "two critical exceptions." On February 24 the Secretary demanded the term by February 27. On February 26 Anthropic refused. On March 3 Secretary Hegseth made a formal determination under the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. § 4713. Within days the Department's Chief Information Officer ordered Anthropic products out of Department systems "as soon as practical," and in any event within 180 days. The order also barred contractors from using them in Department work.

The court found the Department's worry grounded in the record. Anthropic acknowledges building restrictions into Claude, and the court wrote: "On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users." Its examples were early commercial versions refusing to work with classified material and a refusal of CDC prompts on infectious-disease research that the Department learned of in 2025. Anthropic said both were resolved.

One word does the work

The two definitions of "supply chain risk" differ where it counted. Section 4713 covers "the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate" a covered product. Section 3252, the statute the district court applied, covers "the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert" a covered system.

The majority read manipulate plainly, with no bad motive required:

Based on undisputed record evidence, there is not only a "risk"--but a certainty--that Anthropic will so manipulate the "design" or "operation" of Claude to deny it the "function" of conducting lethal autonomous warfare or mass domestic surveillance.

It added, "We have no reason to doubt that Anthropic manipulates Claude's function, use and operation with noble intentions," but held that, at least as applied here, the definition "turns on what Anthropic does, not why Anthropic does it."

The appeals court did not reject the district court's view of Anthropic. It wrote that "we have no quarrel with the Northern District's conclusion that Anthropic has acted with no such bad motive in its dealings with the Department." A footnote rejects Anthropic's argument that the district judgment is preclusive, in part because Congress gave the appeals court exclusive jurisdiction over section 4713 actions.

The dissent

Judge Henderson wrote: "Because I believe that the context decidedly favors the narrower reading, I respectfully dissent." She read manipulate alongside sabotage and maliciously as meaning intentionally subversive, deceptive acts. Then she applied the majority's reading to the next vendor:

But suppose the Secretary tells Anthropic's presumed replacement to change its AI-use policies to permit any "functions that the Department deems necessary" or it will share the same fate as Anthropic. ... According to today's decision, that contractor will have a choice: Agree to the Secretary's demands or risk being designated a national security threat under FASCSA.

In her reading, the holding reaches "a contractor's honest and upfront enforcement of restrictions on a covered article's use disfavored by the government." The majority's answer to the narrower reading: § 4713 is "a procurement statute addressed to what goods and services the Department may buy".

Four weeks apart, opposite constitutional answers

The appeals court agreed that Anthropic's advocacy was protected speech and that the exclusion was adverse, but found no causal link between the two. Of the Secretary's February 27 post it said: "Such rhetoric seldom provides a sound basis for judging the lawfulness of federal executive action." Its conclusion: "The nub of this dispute was contractual, and the First Amendment did not require the Department to continue a contractual relationship that it viewed as creating a national-security risk." On process, it held that notice and a chance to respond soon after the exclusion were enough.

The district court's rulings center on three actions: the President's February 27 directive, the Secretary's post the same day, and the § 3252 designation. It declared that they "violate the First Amendment because they are unlawful retaliation against Anthropic for constitutionally protected expressive activities", and that they denied Anthropic pre-deprivation process. It called the record slim and found that

the challenged actions were based on a desire to make a public example out of Anthropic for its "arrogance" in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model.

The government had conceded that the Secretary's order barring military contractors from any commercial activity with Anthropic had no statutory basis. It won the ultra vires claim and the agency claims against HHS, Commerce, VA, SEC and NASA.

Where GSA fits

On February 27 the General Services Administration said it "is removing Anthropic from USAi.gov and our Multiple Award Schedule (MAS)", citing the President's directive. On April 3, citing the March 26 preliminary injunction, GSA said it was "withdrawing this announcement and restoring Anthropic technology to the status quo in effect prior to February 27, 2026."

The August 27 order then vacated the implementing actions of nine agencies as orders and sanctions imposed without authority: the Department of War, State, OPM, NRC, Treasury, DHS, Energy, FHFA and GSA. It also said it "does not require the Department of War to use Anthropic's products or services".

What happens next, and when

Rehearing: November 9, 2026. D.C. Circuit Rule 40(a) allows 45 days after judgment when a federal agency is a party, and the federal rules say "rehearing en banc is not favored." The mandate waits until seven days after any timely petition is decided, or until November 16 if none is filed.
Supreme Court: December 24, 2026. Supreme Court Rule 13 allows a certiorari petition "within 90 days after entry of the judgment." A timely rehearing petition restarts that clock from the date rehearing is denied.
District judgment: October 26, 2026. Under appellate Rule 4(a)(1)(B), any party may appeal within 60 days when a federal agency is a party.
Ninth Circuit No. 26-2011. The government's appeal of the preliminary injunction "has been stayed at the parties' mutual request pending a ruling from the D.C. Circuit in a related case."

What the record does not say

No finding that Claude sabotaged anything. Of a disputed episode involving an overseas military operation, the majority wrote that "we do not know exactly what happened in the incident".
No answer on weapons or surveillance. The majority called these "profoundly difficult questions" and left the balance to "the President and the Secretary of War".
No reconciliation of the two judgments. Both opinions describe a March 3 determination resting on a joint recommendation and a memorandum by Under Secretary Michael. The district court vacated the one before it as a § 3252 designation; the appeals court let covered procurement actions under § 4713 stand. Neither says how the Department is to comply with both.
No current purchasing picture. Which agencies now use Anthropic, and whether it is on GSA's schedule today, is not shown here.
No final word. The mandate has not issued, and the district judgment can still be appealed.