What Happened
Defense Secretary Pete Hegseth classified Anthropic as a supply chain risk under the Federal Acquisition Supply Chain Security Act after the AI firm requested limits on how the Pentagon could use its Claude models on the GenAI.mil platform. Anthropic had already signed a contract worth up to $200 million over two years when it raised concerns about potential uses for mass surveillance and lethal autonomous warfare.
The U.S. Court of Appeals for the District of Columbia ruled 2-1 that the Pentagon acted within its authority. The court held that Anthropic's decision to train its models to refuse certain tasks constituted "manipulation" of the service under the statute, regardless of the company's intent. This ruling conflicts directly with a California federal court decision weeks earlier that sided with Anthropic and found First Amendment violations.
Anthropic now faces a bicoastal legal split that creates uncertainty for both the company and other defense contractors watching closely.
Timeline
- Early 2026: Anthropic signs contract with DoD worth up to $200 million over two years for Claude model access on GenAI.mil platform.
- Mid-2026: Anthropic requests restrictions on certain use cases, citing concerns about mass surveillance and autonomous weapons applications.
- 2026: Defense Secretary Pete Hegseth formally designates Anthropic a supply chain risk under Federal Acquisition Supply Chain Security Act.
- 2026: Anthropic files two lawsuits, one in U.S. District Court for Northern California, one in D.C. Circuit Court.
- Summer 2026: California federal judge rules in Anthropic's favor, orders Pentagon to reverse blacklisting, cites First Amendment violations.
- September 25, 2026: D.C. Circuit Court rules 2-1 in favor of Pentagon, upholding the blacklisting.
Which Controls Failed or Were Missing
This isn't a traditional control failure. No system was breached, no data exfiltrated, no access control bypassed. Instead, this incident reveals a gap in how supply chain risk is defined and assessed when the "risk" is a vendor's refusal to enable certain capabilities.
The Federal Acquisition Supply Chain Security Act allows agency heads to exclude contractors who pose supply chain risks. The statute defines such risks to include scenarios where a contractor might "sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance" of a system.
Judge Gregory Katsas wrote that manipulation means "to arrange, operate or control skillfully" and that Anthropic's training of Claude to refuse certain tasks demonstrates it can make its models refuse to comply with actions. The court explicitly stated: "the statutory definition of a 'supply chain risk' turns on what Anthropic does, not why Anthropic does it."
What failed here was alignment between vendor risk posture and government expectations. Anthropic implemented safety guardrails it viewed as responsible AI development. The Pentagon viewed those same guardrails as manipulation that could cause models to "suddenly shut down amid military operations," per the court opinion.
What the Relevant Standard Requires
The Federal Acquisition Supply Chain Security Act doesn't prescribe specific technical controls. It grants agency heads broad authority to identify and exclude supply chain risks. The statute focuses on outcomes, can a contractor potentially subvert system function, not on the contractor's stated intent or public commitments to safety.
For defense contractors, DFARS 252.204-7012 requires safeguarding covered defense information and cyber incident reporting. That clause flows down to subcontractors and triggers NIST SP 800-171 compliance. But those requirements address data protection and system security, not whether your product's built-in limitations constitute manipulation.
The Cybersecurity Maturity Model Certification framework under 32 CFR Part 170 assesses your cybersecurity practices across domains like access control, incident response, and system integrity. It doesn't assess whether your product design choices, even safety-oriented ones, might conflict with mission requirements.
What this ruling clarifies is that supply chain risk determinations under the Federal Acquisition Supply Chain Security Act operate in a different space. They're not control-based assessments. They're strategic judgments about whether a vendor's design decisions could compromise operational needs.
Lessons and Action Items for Your Team
Document mission alignment early. If you're building AI capabilities for defense customers, map your model's limitations against potential use cases before contract signature. Don't assume that safety features universally signal trustworthiness. In some contexts, they signal operational constraint.
Understand the manipulation standard. The D.C. Circuit Court held that "manipulation" doesn't require malicious intent. If you train a model to refuse certain tasks, you've demonstrated the ability to make it refuse tasks. That capability itself can constitute risk under this interpretation. Review your model's refusal behaviors and be prepared to explain how they align with, or potentially conflict with, mission requirements.
Recognize that competing court decisions create compliance uncertainty. A California federal court ruled the blacklisting violated Anthropic's First Amendment rights. The D.C. Circuit Court disagreed. If you're operating in this space, you're navigating unsettled law. Engage legal counsel who understand both procurement regulations and AI policy.
Assess your guardrail strategy. If you've implemented safety refusals in your models, document the technical mechanism, the triggering conditions, and whether you can disable or modify those refusals under contract terms. The court noted both "AI models suddenly shutting down amid military operations" and "unconstrained models hallucinating inappropriate targets" as national security concerns. Your contract should address how you balance those risks.
Evaluate subcontractor AI tools. If you're a prime contractor using third-party AI services, this ruling affects your supply chain. A vendor's safety commitments might create operational risk under the Federal Acquisition Supply Chain Security Act framework. Your vendor risk assessments should now include questions about model behavior constraints and whether the vendor can modify them.
Prepare for broader application. Philip Reiner, CEO of the Institute for Security and Technology, noted that a key concern is "how widely this decision will be applied." If built-in safety refusals can constitute supply chain risk, other product design choices might too. Consider how your technology's intended limitations could be reframed as manipulation under this standard.
Don't assume noble intent provides safe harbor. Judge Katsas wrote: "We have no reason to doubt that Anthropic manipulates Claude's function, use and operation with noble intentions, whether a principled commitment to personal privacy or a genuine concern about AI safety. But at least as applied here, the statutory definition of a 'supply chain risk' turns on what Anthropic does, not why Anthropic does it." Your compliance posture can't rest on good-faith explanations of design choices.
The Anthropic case exposes a tension between responsible AI development and defense operational requirements. You can build the most secure, compliant system in your sector and still face exclusion if your design philosophy conflicts with mission needs. That's not a control gap you can close with better documentation or additional assessments. It's a strategic misalignment that requires early, explicit negotiation with your government customer about what your technology will and won't do.
