Pentagon Rules Claude a National Security Supply Chain Risk: The Ban, the Reasons and the Court Fight

The Department of War — the Pentagon's secondary name since September 2025 — did not simply cancel a contract with Anthropic. It reached for the most serious tool in federal procurement: a formal finding that a supplier poses a supply chain risk to national security. On February 27, 2026, the same afternoon a Pentagon deadline for Anthropic to drop its usage restrictions expired, President Trump directed every federal agency to stop using Anthropic's technology, giving agencies including the Pentagon six months to phase it out, and Secretary Hegseth directed the supply chain designation.

Letters dated March 3, 2026 formally notified the company, and by March 6 the Pentagon was describing the label as effective immediately. Law firms advising contractors identified two authorities behind it: the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA, 41 U.S.C. § 4713), which reaches across federal procurement, and 10 U.S.C. § 3252, the Defense Secretary's power to exclude sources from national security system contracts. The General Services Administration also removed Anthropic from USAi.gov, the government's central AI testing platform.

These authorities were built with foreign adversaries in mind — the kind of exclusion better known from Chinese telecom and security vendors. Anthropic called the move unprecedented and legally unsound, an action “never before publicly applied to an American company.”

The dispute is not about hackers, foreign ownership or a hidden backdoor. It is about who controls how the model is used. In July 2025 Anthropic and the Pentagon signed a contract that made Claude the first frontier AI model approved for the military's classified networks, under Anthropic's acceptable use policy — which ruled out mass domestic surveillance and fully autonomous weapons. Claude was reportedly used in the U.S. operation in Venezuela in early 2026.

By January 2026 the Pentagon wanted those terms renegotiated so the military could use Claude for “all lawful purposes” without company-imposed exceptions. After weeks of talks, Anthropic said the final offer still left the door open to the surveillance and weapons uses it had refused, and it let the February 27 deadline pass.

From the Pentagon's side, that refusal is the risk. A model whose developer can decline certain missions — and which is trained to refuse certain requests on its own — is, in this view, a component the military cannot fully rely on in an operation. The D.C. Circuit majority accepted that framing: it found the Department had enough evidence to conclude that Claude's built-in restrictions and the unresolved contract dispute could make it unreliable for military operations, noting the restrictions had more than once stopped Claude from doing tasks government users asked for.

Anthropic's position is the mirror image: the company says it was punished for its public stance against lethal autonomous warfare and surveillance of Americans, and that the supply chain statutes were designed to stop sabotage by adversaries, not to settle a contract negotiation with a U.S. supplier that disclosed its limits up front. Defense Secretary Hegseth's response to the court win summed up the government's view: “The @DeptofWar does what is right for the Country and our Warriors.”

The headline — “Pentagon bans Claude” — is broader than the law behind it. Under 10 U.S.C. § 3252, the exclusion applies to covered systems: information technology used for intelligence, cryptologic activities, military command and control, and weapons systems. Routine administrative applications such as payroll, HR and finance are outside that authority. Legal analysts at Just Security stressed that § 3252 is “a procurement authority, not a sanctions authority”: it lets the Department keep a supplier out of sensitive contracts and require prime contractors to drop it from subcontracts, but it does not force anyone to divest from, or stop doing ordinary business with, the company.

The Pentagon's own supply chain framework explains why AI models now fall under this lens at all. The Department of War CIO's memorandum on commercial off-the-shelf information and communications technology supply chain risk management directs components to treat commercial software as part of the warfighting supply chain and to verify its security and reliability, rather than relying on vendor self-attestation. A frontier model sitting inside classified networks is exactly that kind of commercial component.

Seven months separate the Pentagon's ultimatum from the appeals ruling. The sequence below is drawn from court rulings, company statements and reporting by NPR, CNN, ABC News, CNBC and TechCrunch.

On Friday, September 25, 2026, a panel of the U.S. Court of Appeals for the District of Columbia Circuit upheld the Pentagon's designation, rejecting Anthropic's arguments that it was arbitrary, not authorized by the statute and unconstitutional. The vote was 2–1. Circuit Judge Gregory Katsas wrote the opinion, joined by Circuit Judge Neomi Rao.

“The Department had ample support for its conclusion that the continued integration of Claude into the Department's information systems, by the Department or its contractors, presented a statutorily covered national-security risk,” Katsas wrote. On Anthropic's free-speech argument, the majority deferred to the executive branch: “in our Republic, it is the President and the Secretary of War who must determine how best to balance the competing risks.”

Circuit Judge Karen LeCraft Henderson dissented. In her reading, the 2018 statute targets deliberate, deceptive subversion of government systems — the classic adversary threat — and does not treat “a contractor's honest and upfront enforcement of restrictions” on how its product may be used as a supply chain risk. That is the core of Anthropic's case, and the dissent gives the company a ready-made argument for further review.

Anthropic responded: “We remain confident in our position and are considering all options, including further review.” It also pointed out that “another federal court has already held the government's parallel designation unlawful.”

The appeals ruling was a reversal of fortune, because Anthropic had won the first round decisively. On March 26 U.S. District Judge Rita Lin in San Francisco granted a preliminary injunction, and on August 28, 2026 she ruled the parallel designation unlawful on three separate grounds:

The two rulings do not directly cancel each other out. They concerned two parallel designations, which is why Anthropic filed in two courts on March 9; the D.C. Circuit case concerned the one made under the 2018 supply chain security law. The practical result after September 25 is a split outcome: one label struck down in California, the other left standing in Washington — and the Pentagon's exclusion of Claude from covered national security work continues while Anthropic decides on its next move.

The Pentagon did not go without frontier AI. OpenAI announced its own agreement on the same day Anthropic was cut off. It accepted the “all lawful purposes” framework but layered on its own controls: cloud-only deployment, a proprietary safety stack the Pentagon agreed not to override, and cleared OpenAI engineers embedded with the programme. OpenAI later revised the deal after critics raised surveillance concerns. xAI had already reached a deal on February 23 for Grok to run in classified systems, and Google's Gemini had been the first model on the Pentagon's GenAI.mil platform in December 2025.

That contrast is the clearest illustration of how the Pentagon draws the line. Every major lab keeps safety policies; the difference is whether the government or the vendor has the final say over which lawful missions are off-limits. OpenAI's structure left that decision with the Department; Anthropic's two contractual exceptions did not.

For companies that sell to the federal government, the designation is a compliance task, not a headline. Under the FASCSA contract clause, FAR 52.204-30, contractors must check SAM.gov for exclusion orders at least quarterly, make reasonable inquiries to find any covered use of the designated product, report within three business days if it was provided to the government, and file a mitigation plan within ten business days. Those duties flow down to every subcontractor tier.

The open question is how far “use” extends. The statutes restrict Claude in federal contract performance, but Hegseth's broader statement about contractors' commercial activity left the boundary for internal, non-contract use unclear. Firms running AI coding assistants, document tools or agent platforms built on Claude should map exactly which workflows touch covered contracts, and get advice from counsel rather than relying on press summaries — including this one.

For data centre developers and infrastructure buyers, the case shows why AI supplier risk is now a procurement line item. Our AI Build Configurator models the power and capital side of an AI build; the supply chain side increasingly depends on which model vendors a site's tenants are allowed to run.

Anthropic has two obvious routes in the D.C. Circuit case: ask the full court to rehear it en banc, leaning on Judge Henderson's dissent about what the 2018 statute actually covers, or petition the U.S. Supreme Court. A case asking whether a national security procurement law can be used against a domestic supplier over its usage policy — with the executive branch and a district court on opposite sides — is the kind of question the higher courts take seriously.

The timing matters for a second reason. Anthropic is expected to go public in November 2026, and a live federal blacklist is precisely the kind of dispute that has to be disclosed in an IPO prospectus. Follow our Anthropic IPO date and price tracker for how the filing treats it, our Anthropic AI page for the company background, and our AI data center stocks list for the companies on both sides of this build-out.