The strongest case for the Pentagon runs like this. Military buyers must be able to rely on suppliers. A vendor that reserves the right to refuse certain uses of its technology could, in principle, leave a commander without a tool at a critical moment. Congress gave defense agencies special exclusion powers because ordinary contracting rules move too slowly when sabotage is the worry. That concern is legitimate, and the Department of War is, in Judge Rita Lin's words, "undisputedly free to select the AI vendor of its choice," as Nextgov reported.
The court's answer was that choosing a vendor and punishing one are different acts. On August 27, 2026, Judge Lin of the Northern District of California ruled that the department unlawfully retaliated against Anthropic. According to EFF's account, the designation was meant to penalize the company for telling the military it would not allow its technology to be used for mass surveillance of U.S. persons. The opinion also reached autonomous weapons, and it found a Fifth Amendment due process violation. The judge wrote that "the empty invocation of national security is not a blank check to punish and retaliate against government critics." The court's order on the cross-motions for summary judgment is hosted by EFF. I could confirm that the page resolves, but I could not retrieve the PDF text, so quotations here come from press accounts.
What the statute actually asks for
The authority at issue, 10 U.S.C. § 3252, defines supply chain risk as the risk that "an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert" a covered system. Before using it, the agency head must determine in writing that "less intrusive measures are not reasonably available." Congressional committees must also be notified.
That definition is about adversaries subverting systems. A vendor publicly stating usage limits, in a dispute over contract terms, does not obviously fit it. The Nextgov account says the court found Anthropic's products posed no meaningful national security threat. Once a statute is that far from the facts, a national-security label starts to look like a pretext, and courts have long treated pretext as the mark of retaliation.
The process point matters as much. According to reporting, the court found Anthropic was denied the pre-deprivation process the Fifth Amendment requires. Compare the sibling statute: 41 U.S.C. § 4713 requires a joint recommendation from acquisition and information officers, written notice to the affected source, and a 30-day window to submit opposition, with an exception for urgent national security interests. Procedure of this kind is how a bad determination gets caught before it does damage.
The ruling is narrower than the headline
Two caveats keep this from being a clean win. First, the department issued two designations on March 3, 2026, under different statutes. A&O Shearman's analysis says the § 3252 designation was the one enjoined in the Northern District of California, while the broader § 4713 designation was before the D.C. Circuit. Jones Walker reported that on April 8, 2026, a D.C. Circuit panel denied Anthropic a stay on the equities without reaching the merits, leaving that designation in effect during review. I have not verified what has happened in that case since, so readers should check its current status before drawing conclusions about Anthropic's overall position.
Second, this is a district court ruling, and the government has already shown it will appeal. Reporting on the earlier March injunction said the Pentagon took it to the Ninth Circuit, and it would be unsurprising to see the same here.
Why this matters beyond one company
The pro-innovation reading is not that AI labs are entitled to defense contracts. They are not, and no vendor has a right to be bought. The point is that the government's buying power is enormous, and if it can be turned against a company for its expressed views, the chilling effect reaches every firm that sells to Washington. A lab weighing whether to publish a usage policy would have to ask whether doing so invites exclusion.
That cuts against the safety and the security interests the government itself claims. Vendors that state clear limits on their products give buyers information. Punishing the statement teaches the market to stay quiet, which produces worse-informed procurement.
The proportionate alternative is simple. If the department finds a vendor's terms unacceptable, it can decline to buy, run a competitive process, or negotiate different terms. It cannot invoke a statute aimed at foreign sabotage to blacklist a domestic company whose offense was saying no. Lawmakers who want firm authority over military AI use should legislate it openly, with standards and review, rather than rely on procurement labels that courts then have to strike down.
What to watch
- Whether the government appeals the August 27 ruling and seeks a stay.
- The D.C. Circuit's treatment of the § 4713 designation, which rests on a different statute with its own notice-and-response scheme.
- Whether Congress or the department writes clearer rules for how usage restrictions in AI contracts are treated, so this dispute does not recur through improvisation.
The ruling does not settle who decides how military AI may be used. It does settle one narrower point: the government may choose its suppliers, but it may not use a security designation as a penalty for a supplier's speech.