Appeals court upholds the Pentagon's ban on Claude, 2-1

A federal appeals court in Washington, D.C., on Friday upheld the Pentagon’s decision to label Anthropic a supply-chain risk, in a 2-1 ruling [1][2]. The label stops the US military from using Anthropic’s Claude models and blocks defense contractors from using them in their work for the department [2]. Anthropic says it disagrees and is “considering all options, including further review” [2]. For most people who use Claude at work, nothing about the product changes today. For anyone who sells software or services to the US defense department and has Claude inside their stack, the ruling means that ban stays in place for now.

What was announced

The case is Anthropic PBC v. Department of War, decided on Friday by a panel of three judges of the U.S. Court of Appeals for the District of Columbia Circuit [1]. Judge Gregory Katsas wrote the majority opinion and Judge Neomi Rao joined it; Judge Karen LeCraft Henderson dissented [1][2]. According to CNBC, Katsas and Rao were appointed by President Donald Trump, and Henderson by former President George H.W. Bush [2].

The dispute started over contract terms. According to the opinion, the department asked Anthropic for permission to use Claude for “all lawful uses,” and Anthropic agreed to substantially relax its earlier restrictions but kept two: no use of Claude for lethal autonomous warfare, and no mass surveillance of Americans [1]. Talks stalled. In March the department labelled Anthropic a supply-chain risk under the Federal Acquisition Supply Chain Security Act of 2018, and Anthropic sued [1][2][4]. CNBC reports that Anthropic had signed a $200 million contract with the Pentagon in July of 2025, before the relationship broke down [2].

The majority upheld the label. It said the department “had ample support for its conclusion that the continued integration of Claude into the Department’s information systems, by the Department or its contractors, presented a statutorily covered national-security risk” [1][2]. The court pointed to three things: Anthropic admits it builds restrictions into Claude that stop the model from doing tasks the company wants to prevent; on more than one occasion those restrictions stopped Claude from doing tasks government users requested; and a dispute arose over whether Anthropic’s contract terms barred Claude’s use in an overseas military operation, which left the department unsure whether Claude would perform as needed [1][4].

The court also rejected Anthropic’s constitutional claims. On due process, it found the department promptly told Anthropic about the exclusion and its reasons and gave the company a fair chance to contest it [1][4]. On free speech, it found the department excluded Anthropic “based on the company’s refusal to assent to a contract term that the Department deemed essential, not based on the company’s support for greater governmental regulation of AI technology” [1][3]. The judges called the case one that raises “profoundly difficult questions” about military uses of AI, but said it is the President and the Secretary of War who must balance those risks [1][4].

Henderson’s dissent turns on one word in the statute. The law lets the department act against a source that may “sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” covered technology [1][4]. Henderson read “manipulate” to mean intentionally subversive acts carried out by deceptive means, the reading Anthropic argued for, and wrote that the law was passed to counter hostile nation-states and other bad actors hiding compromised products in government supply chains [4]. In her view it does not reach “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government” [4]. The majority rejected that reading and held that the definition covers “any person,” not only foreign adversaries [4].

What changed, and for whom

This ruling is one half of a two-part fight. The department relied on two separate designations, which had to be challenged in two courts [2][3]. A federal judge in San Francisco has already held one of them unlawful, first in March and again last month, according to Wired [3]. Friday’s ruling upholds the other one, which means the Pentagon can keep blocking Anthropic [3]. Wired notes that both rulings face the prospect of years of appeals [3].

The panel also delayed its decision from taking immediate effect, to give Anthropic time to ask the same panel for a rehearing or to ask the full D.C. Circuit to hear the case en banc [2]. Anthropic could also ask the Supreme Court to take it [2]. “We respectfully disagree with the court’s decision,” an Anthropic spokesperson told CNBC. “Another federal court has already held the government’s parallel designation unlawful” [2].

The ruling was not a surprise. In April the same panel declined to block the designation temporarily, finding Anthropic had not met the “stringent requirements” for an immediate reprieve [3]. At the hearing, the judges challenged both sides and appeared divided, according to Wired [3].

What the ruling does not say matters as much. The majority’s reasoning is about the department’s own systems and the work its contractors do for it [1][2]. Nothing in the opinion or in the reports describes a change to how Claude is sold or priced to businesses outside that relationship.

The business effect is harder to measure. Wired reports that Anthropic said it lost revenue right after the designations, because some customers worried about working with a company the government had blacklisted, but that the company has not updated that figure and has generally pointed to growing sales [3]. The Pentagon has not given detailed updates on replacing Claude with alternatives such as SpaceX’s Grok, Google’s Gemini or OpenAI’s GPT models, Wired adds [3].

Who it is for — and not

This matters most to companies with defense work: prime contractors, subcontractors and software vendors whose products reach the department. The opinion notes that when an AI model is layered into other applications, it can limit what the larger system does, which is one reason the court accepted a clean break over a granular inquiry into every contractor’s use of Claude [1]. If your product sends requests to Claude and a defense customer uses it, assume that customer cannot keep using that path while the designation stands.

It also matters to anyone watching how governments treat AI vendors that set their own use limits. The majority treated Anthropic’s usage restrictions as a reliability question for the buyer [1][4]. Henderson treated them as the kind of honest contract term the statute was never meant to punish [4]. Until a rehearing or a higher court settles it, the majority’s reading stands.

It matters less to the solo operator or small team using Claude for writing, coding or analysis with no government customers. The ruling does not change Claude’s features, availability or terms for you, and none of the sources report any such change. The one practical point for everyone is portability: keep prompts, files and workflows in a form you could move to another model if a customer, a regulator or a contract ever required it.

This page will be updated if Anthropic files for rehearing, if the full D.C. Circuit or the Supreme Court takes the case, or if the San Francisco ruling on the parallel designation changes on appeal.

∴ Claude stays barred from Pentagon work for now; if you sell to defense, plan for a second model.