"It's undisputed that the failure of the model in active military operations could have catastrophic national-security consequences and put service members' lives at risk," Department of Justice attorney Sharon Swingle told judges during oral argument.
Oral argument at the U.S. Court of Appeals for the D.C. Circuit
On Tuesday a three-judge panel heard Anthropic's challenge to the Pentagon's designation of the company as a supply-chain national security risk. The panel consisted of Judges Gregory Katsas, Neomi Rao and Karen Henderson. Anthropic asked the court to overturn the designation, a move that has already produced conflicting results in parallel litigation: the D.C. Circuit previously declined to pause the designation while expediting Anthropic's appeal, and a federal judge in San Francisco separately blocked the government from labeling Anthropic a supply-chain risk in a related case.
Anthropic's legal arguments and the company's operational limits
Anthropic attorney Kelly Dunbar told the panel the designation "defied congressionally mandated procedures, exceeded statutory limits and violated the Constitution." The company has emphasized that its usage restrictions apply only to two high-level categories: systems that enable fully autonomous lethal weapons and mass domestic surveillance. Anthropic has also argued it cannot alter its Claude model once the model is deployed inside classified military environments, and that if the Pentagon does not wish to use the technology the department can simply stop contracting with the company rather than attach a reputationally damaging national security label.
The government's national-security rationale and procedural developments
The government framed the dispute not as one about speech but about whether defense officials can trust a model provider whose usage limits might disrupt military operations. Swingle told the judges that military reliance on a model that fails or becomes unavailable during active operations could produce "catastrophic national-security consequences" and risk service members' lives. The designation invoked supply-chain risk authorities that, according to government filings, allow defense officials to act before a vulnerability becomes an operational failure.
The designation has immediate operational effect: it gave military agencies six months to stop using Anthropic technology while largely leaving non-defense government and commercial uses untouched. The Pentagon also notified the court it will treat an Anthropic request for reconsideration as timely even though the company had not sent the email to the specified official account — a procedural accommodation the department disclosed in a filing saying it intended to treat the email as timely despite the error.
Judges' comments, conflicting signals, and wider government activity
Judges pressed both sides on the limits of judicial review and on whether the record supports the government's supply-chain rationale. Rao questioned the court's ability to review designation decisions, noting that no prior national security risk designee had contested a label in court and suggesting the court might only be able to bar a future designation. Henderson expressed skepticism of the government's posture, calling the action "a spectacular overreach by the [Defense] Department." Katsas focused on model opacity and the rapid pace of AI development.
The litigation exists against a backdrop of the Pentagon pursuing broader frontier AI engagement: the department recently announced agreements with multiple AI companies, including OpenAI, Google, Nvidia, Microsoft and Amazon Web Services — a development Anthropic supporters say undermines the government's argument that pausing the designation would threaten military readiness. Outside national security officials who filed amicus briefs told the court the designation appeared pretextual and warned it could chill defense innovation and damage trust between the Pentagon and firms the department depends on for emerging technology.
Analysts say the split rulings have left Anthropic in a narrow and damaging position: barred from new Pentagon work while continuing to serve non-defense government and commercial customers, even as the government grapples with how to replace or retain access to "frontier AI capabilities already embedded in sensitive environments." Separate reporting noted federal staffers are still using Claude despite prior orders.
What this means for technologists, policymakers, and military procurement leaders
- Technologists and security teams: Expect scrutiny of model behavior and deployability in classified environments — Anthropic says it cannot alter Claude once deployed inside classified military settings, which complicates remediation and risk assessment.
- Policymakers and regulators: The case tests the reach of supply-chain risk authority and whether courts will review those designations; judges signaled differing views on judicial oversight and statutory limits.
- Military procurement leaders and operators: The designation created a six-month requirement for military agencies to stop using Anthropic technology, while the department simultaneously seeks alternative agreements with other frontier AI vendors — a dual track that raises practical continuity and readiness questions for systems already embedding those capabilities.
The appeal sharpens a central institutional tension: how far the Pentagon may use supply-chain risk authorities to compel changes in commercial AI practices without simply ending contracting relationships. The D.C. Circuit's decision will determine not only Anthropic's access to future military work but also the contours of how supply-chain risk designations are applied to frontier AI providers. For now the government has left the designation in place, reconsideration is under way administratively, and the courts remain the arena in which the legal and operational fallout will be resolved.
