A judge vacated one Pentagon label on Anthropic, and the other stands

Six months of a federal vendor ban ended on a Thursday night, in a 59-page order. Judge Rita Lin vacated the supply chain risk designation the Department of War hung on Anthropic back in February, and stacked a permanent injunction on top of the vacatur. The reasoning is the part worth your attention, and it is not really about one AI company. The Pentagon had reached for 10 U.S.C. § 3252, the statute that lets it push out a vendor when an adversary might sabotage a covered system. The court went and read the words. Sabotage, subvert, maliciously introduce unwanted function. Covert acts, all of them. None of which describes a supplier that publicly refused the government's preferred contract terms and said so out loud.

The order does two different things

People keep collapsing them into one. They aren’t.

The vacatur wipes the acts themselves. Secretary Hegseth’s 27 February directive and the supply chain risk determination that followed on 4 March stop existing as legal acts, rather than sitting on the books unenforced. The permanent injunction then binds the Department going forward, holding it to whatever was lawfully available to it before 27 February.

Notice what that second half is not. It is not an order to sign anything. Restoring a vendor’s eligibility and awarding that vendor a contract are separate events, and the roughly $200 million of work that reportedly evaporated in January is not coming back through this door. Agencies can still pick a different model tomorrow for entirely boring reasons. That’s the bit I expect to get lost in the coverage, because “company beats Pentagon” is a much cleaner sentence than “company is once again allowed to bid”.

The statute is the whole ballgame

Here is the part that outlives the case.

The Department leaned on 10 U.S.C. § 3252, the authority to exclude a source on supply chain risk grounds. Subsection (d)(4) defines that risk as an adversary who may “sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system. Read the verbs. Every one of them describes something done quietly, by someone pretending to be a normal supplier.

Anthropic’s conduct was the opposite of quiet. It said in public that Claude would not be available for lethal autonomous weapons or mass domestic surveillance, it declined the “all lawful purposes” terms the Department wanted, and the ban arrived shortly after. At the summary judgment hearing on 30 July the government argued that AI is different: models are opaque, a vendor can bake corporate moral judgment into the weights, and trust in the supplier is therefore part of the security question. It’s not a stupid argument. It just isn’t what the statute says, and the court declined to stretch the text to fit it.

The record did the rest of the work. Lin wrote that the government’s actions “constituted unlawful retaliation in violation of the First Amendment”, and that they “were based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model”. She also had a line ready for the national security framing: “The empty invocation of national security is not a blank check to punish and retaliate against government critics.”

What sank the government was its own behaviour after the label went on. It kept pursuing contracts with the supplier it had just called a national security risk, including collaboration on the Mythos model, the same one we looked at when the story went round that it had hacked the NSA. You cannot really tell a judge that a vendor might sabotage your systems while asking that vendor to help defend them.

What it doesn’t settle

Quite a lot, actually.

There’s a second case, in the D.C. Circuit, docket 26-1049, running on the FASCSA exclusion track rather than the § 3252 one. Anthropic was denied an emergency stay there back in April and the appeal is unresolved. So the sentence “the ban is over” is true for the California claims and shaky everywhere else.

Then there’s the appeal. This is one district judge, in one district, on one summary judgment record. The government has not said publicly what it plans to do, and if it goes up, this could run a long way. Anyone treating a 59-page N.D. Cal. order as a settled rule for federal AI procurement is getting ahead of the paperwork.

If you buy or sell software, this is the useful bit

Strip the politics out and a procurement question is left over, one that turns up in ordinary commercial deals constantly: is a vendor’s acceptable use policy a term you negotiate, or a loyalty test you pass?

A large customer asked for unrestricted use. The supplier said no, in writing, in public. In most industries that’s a Tuesday, and the deal either closes on amended terms or it doesn’t. What made this unusual is that the customer had a statutory hammer lying around and swung it. The court’s answer is narrow but clear enough to plan around: the hammer is for sabotage, and a published usage policy is speech, not a threat.

If you sell to government, the practical read is that your usage policy belongs in the term sheet from day one, argued as a commercial restriction, because a customer who treats it as disloyalty has now lost that argument once. If you buy, an “all lawful purposes” clause is a real ask and vendors are allowed to refuse it without becoming a security incident.

I might be wrong about how far this travels. It’s one order, it’s appealable, and the political weather around AI procurement changes faster than litigation does. But the statutory reading is the durable piece, and it will get cited. Anthropic has had a busy year in court either way, between this and the $1.5B copyright settlement, and none of it has much to do with the models.

What changed since

26 September 2026. The other track finished, and Anthropic lost it. On 25 September the D.C. Circuit ruled 2-1, in cases 26-1049 and 26-1162, that the Department of War lawfully excluded Claude under the FASCSA, 41 U.S.C. § 4713. Judge Katsas wrote for the majority, joined by Judge Rao. Judge Henderson dissented.

So the order we covered above is now half the story. Judge Lin's vacatur still stands, since it dealt with a different act under a different statute, and the appeals court said it saw no contradiction between the two. But the FASCSA exclusion is the one vendors will feel. As AP reads it, Claude stays out of Department systems, and contractors can't use Anthropic products in Department work. It doesn't reach the rest of the federal government.

The reasoning runs the opposite way to Lin's. She read the § 3252 verbs as covert sabotage. The majority read "manipulate" in the FASCSA as any control over the product, whatever the motive, and said the question turns on "what Anthropic does, not why Anthropic does it". A vendor restriction that blocks a task the Department considers lawful now counts as a supply chain risk. The First Amendment claim failed too: the court saw a refused contract term, not punished speech. Henderson's dissent reads "manipulate" roughly the way Lin read § 3252, as deceptive interference of the hostile state kind, and warns that the precedent hands the Secretary a lever over any contractor's AI use policy.

That lands on our procurement section above. We wrote that a customer treating a usage policy as disloyalty had lost that argument once. It's now won it once too, one level higher. If you sell to the Department of War, a published use restriction on your product is, for now, grounds for exclusion under the FASCSA. I don't think this is the last word. Anthropic says it's considering all options, including further review, which points at an en banc petition or the Supreme Court, and a 2-1 split with a pointed dissent is the usual shape for either. Until something moves, though, the California win doesn't open the Pentagon's door.

Sources for this update: AP for the vote, the judges and the scope of the exclusion, The Volokh Conspiracy for the opinion text and the § 4713 citation, and The Next Web for Anthropic's statement.

Sources

Ruling coverage: TechCrunch, Fortune for the 59-page count and the “arrogance” passage, Forbes and NPR. Claim by claim breakdown of the opinion and the § 3252(d)(4) reading: Techdirt. The 30 July summary judgment hearing: a hearing diary from the courtroom. Case number, docket and the 27 August termination entry: the CourtListener docket for 3:26-cv-01996, checked by us on 30 August 2026.

Frequently asked questions