A federal appeals court in Washington heard nearly two hours of sharp questioning this week. Judges probed whether the Defense Department overstepped when it branded Anthropic a supply chain risk. The label, usually reserved for foreign threats, bars military contractors from using the startup’s Claude models. Short answer: the stakes run high for both national security and the future shape of AI development.
The case, argued May 19 before Judges Karen Henderson, Gregory Katsas and Neomi Rao, marks the latest turn in a months-long standoff. Anthropic sued Defense Secretary Pete Hegseth and the department in March. It claims the designation punishes the company for setting limits on how its technology can be used. But the government insists the move protects critical operations from potential interference. And the exchanges revealed deep skepticism from at least one judge.
Judge Henderson didn’t hold back. She called the department’s action a “spectacular overreach.” She added, “I don’t see that the department has in any way supported its determination that there is a supply chain risk with Anthropic, much less a significant supply chain risk.” Her comments came during oral arguments that stretched well beyond the allotted 15 minutes per side. The panel will now issue a written opinion. No timeline yet.
The dispute traces back to failed talks. The Pentagon wanted unrestricted access to Claude for any lawful military purpose. Anthropic drew lines. It refused to allow its models for autonomous weapons, citing current limitations in accuracy and safety. It also blocked use for domestic mass surveillance of Americans, calling it a violation of fundamental rights. CEO Dario Amodei had made these positions public. He argued current-generation AI simply isn’t reliable enough for lethal autonomous decisions.
Once negotiations collapsed, Hegseth moved fast. The department designated Anthropic under a statute meant to shield supply chains from sabotage, typically aimed at adversaries like Chinese suppliers. Contractors must now certify they won’t use Claude on defense work. The move sent ripples. Some dropped the company. Others paused deals. A parallel lawsuit in San Francisco yielded a preliminary injunction that lets non-defense federal agencies keep using the models for now.
Anthropic’s lawyer Kelly Dunbar hammered the point. This isn’t about forcing contracts on the Pentagon, he said. “We’re simply attempting to make sure that the department is not misusing, in our view, a narrow supply chain risk designation to gain leverage in a contract dispute to retaliate against Anthropic for its perceived disagreement with the department.” He stressed no evidence exists that Anthropic has encoded restrictions into its models. The issue, he argued, remains a policy disagreement, not a technical threat.
Sharon Swingle, arguing for the Justice Department, pushed back. She said the designation alerted the entire agency at once. It gave time to find substitutes. “It put people on notice that they needed to be moving as quickly as possible.” Swingle emphasized future risk. Even if no backdoor exists today, Anthropic possesses the technical ability to interfere later. “I think it is clear that Anthropic has the technical capability to interfere with and even prevent the Department of Defense’s use of its AI model for critical military operations.”
The government’s pre-argument brief went further. It warned that Anthropic’s ability to “encode limitations” into its models creates an “untenable national-security risk.” Hegseth, the brief said, concluded the company had “undermined the substantial trust required to sustain the relationship” by positioning itself to “manipulate its model to enforce its own moral and policy judgments about the military’s appropriate use of the technology.”
Anthropic fired back in court filings. Those claims lack factual grounding, its lawyers wrote. The designation therefore has “no basis.” The company also alleges violations of free speech, due process and the Administrative Procedure Act. A San Francisco judge had already signaled strong agreement in the parallel case. “Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government,” that judge wrote.
Legal experts saw merit in Anthropic’s position early on. Reuters reported in March that the AI lab appeared to have a strong case that the administration overstepped with an obscure law aimed at guarding against sabotage. The Pentagon’s use against a domestic company was unprecedented.
Yet the D.C. Circuit had earlier denied Anthropic’s request for an emergency pause. That April ruling kept the blacklist in place while fast-tracking the appeal. The court acknowledged Anthropic “will likely suffer some irreparable harm” during litigation. Revenue projections underscored the threat. Executives told investors the designation could slash billions in sales and damage reputation. One internal estimate pointed to multiple billions lost in 2026 alone.
The episode exposes tensions at the heart of modern defense contracting. AI models differ from traditional hardware. They evolve. Their outputs depend on training data, fine-tuning and safeguards. A company that builds in refusals for certain prompts can, in theory, limit what the military achieves. But does that justify labeling an American firm a national security risk? The judges appeared divided on the answer.
Questions during arguments turned on procedure too. Did the department follow the least restrictive means required by statute? Could simpler contract terms have solved the problem without public blacklisting? Dunbar argued the Pentagon is “well equipped” to make procurement decisions without branding a U.S. company a threat. If it can’t trust the product to meet specifications, he said, “the secretary probably shouldn’t procure it.”
Swingle countered that speed mattered. The designation broadcast the issue across the agency. It forced contractors to adapt. And it reflected genuine concern over trust. Hegseth had publicly criticized the company. President Donald Trump later suggested a deal remained “possible.” Notably, the Pentagon has continued using Claude in some operations, including against Iran, despite the label. Inconsistent application? The record shows complexity.
Anthropic’s stance reflects its broader philosophy. The company, founded by former OpenAI executives, has long emphasized safety. Amodei has warned about risks of advanced AI. He isn’t opposed to military use of AI in principle. But he draws boundaries on autonomy and surveillance. Those views clashed with a department eager for maximum flexibility.
The case arrives as the Defense Department accelerates AI adoption. In recent weeks it announced partnerships with seven major tech firms — Google, OpenAI, Microsoft, Amazon Web Services among them — to bring their tools onto classified networks. Anthropic was absent from that list. The snub added pressure. Yet the company’s commercial business has grown rapidly. Annualized revenue recently topped $30 billion in some estimates, with heavy enterprise uptake outside government.
Observers on X noted the arguments could shape competitive dynamics. A win for the Pentagon might push defense AI contracts toward firms with fewer restrictions. A victory for Anthropic could embolden other labs to set guardrails without fear of retaliation. One post highlighted potential short-term market moves tied to the expected opinion.
Broader questions linger. How much control should AI developers retain over their models once deployed? Can the government compel unrestricted access through procurement power? And where does free speech end when the speech is embedded in code?
The three judges now deliberate. Their opinion will likely clarify the scope of the supply-chain risk law. It may also signal how far administrations can go in pressuring technology firms over policy differences. Henderson’s pointed remarks suggest the court takes the First Amendment concerns seriously. But Katsas and Rao focused more on jurisdiction and administrative details. The written decision could split.
Meanwhile, both sides have left the door open. Anthropic has said it remains open to talks. The Pentagon needs capable AI. A settlement could still emerge before the opinion lands. Yet the public nature of the fight — complete with social media posts and leaked memos — has hardened positions. Trust, once undermined, proves hard to rebuild.
This isn’t the last word on AI and national security. Other companies watch closely. Regulators, lawmakers and investors do too. The outcome will influence not just one startup’s contracts but the balance between innovation safeguards and military demands. For an industry racing toward more powerful systems, the courtroom has become an unexpected front line.
Recent coverage adds context to the fast-moving developments. CNBC detailed the oral arguments and judge reactions just days ago. The reporting captured the nearly two-hour session and specific quotes that shaped perceptions of the bench’s leanings. Earlier analysis from Reuters underscored the unprecedented nature of applying the statute to a U.S. firm and the potential precedent involved.
WebProNews is an iEntry Publication