Judge rules Pentagon's Anthropic blacklist was illegal retaliation

A federal judge has ruled that the Pentagon broke the law when it labelled Anthropic a supply-chain risk. In a 59-page decision reported on 28 August 2026, US District Judge Rita Lin found the label was retaliation for Anthropic's public criticism of government policy. That violated the First Amendment, and the way it was imposed violated the Fifth Amendment's due-process protections. For any company that sells software to the government, the ruling sets a limit on how far "national security" can stretch as a reason to punish a critic.

Anthropic is the company behind the Claude AI models. A supply-chain-risk designation is a label the government can put on a vendor it considers a security threat, which blocks agencies from buying from that vendor.

How the fight started

The dispute began in February 2026. Engadget reports that Defense Secretary Pete Hegseth pressed Anthropic to remove safety limits on how the military could use Claude, and the company refused. The limits blocked use in fully autonomous weapons and in mass surveillance of Americans. Hegseth then designated Anthropic a supply-chain risk, and an order from President Trump barred federal agencies from using the company's tools.

Anthropic filed two lawsuits in March 2026, according to TechCrunch. The California case is the one Judge Lin has now decided.

Date	What happened
February 2026	Pentagon designates Anthropic a supply-chain risk
March 2026	Anthropic files two lawsuits
28 August 2026	Judge Lin rules for Anthropic in the California case
Pending	Second, narrower case in the DC federal appeals court

What the judge found

The core finding is motive. Fortune quotes the ruling: the government's actions "were based on a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government". The judge found no real basis to believe Anthropic would sabotage its own model.

Judge Lin drew the line plainly. "The empty invocation of national security is not a blank check to punish and retaliate against government critics," she wrote, in a passage quoted by TechCrunch, Engadget, and The Register. She also wrote that "An IT vendor does not become a potential adversary of the United States whenever it asks probing questions."

The ruling does not say the Pentagon must buy from Anthropic. Judge Lin wrote that "the Department of War is undisputedly free to select the AI vendor of its choice". Her objection was to the "broad measures", which she called "illegal and baseless". The decision also found the action "arbitrary and capricious", a legal standard meaning the government acted without a reasoned basis.

The technical claim that fell apart

The Pentagon's security argument rested on a claim about how Claude works. The Register reports the government alleged Anthropic could remotely interfere with Claude models already deployed inside the military. The court found that was unfounded. Once a model is handed over, it is a static file, and TechCrunch reports Anthropic established it has no backdoor access after transfer.

Two other facts hurt the government's case, per The Register. Records showed no supply-chain concern about Anthropic before February 2026, which suggested the case was assembled after the decision. And the Pentagon kept working with Anthropic after the blacklisting, on Project Glasswing and on a cybersecurity model called Mythos.

What happens next

This is one win, not the end. Fortune reports the government has said it will appeal. Engadget notes the supply-chain-risk label itself remains in place pending the second case. And even if Anthropic wins both, Engadget reports the Pentagon would not be required to resume working with the company.

Anthropic kept its response short. A spokesperson said "We welcome the court's ruling that this supply chain risk designation was unlawful", and that the company remains focused on working with the government on national security.

What this means for developers

If you ship a model into a government or enterprise environment, this ruling just made one architecture fact legally important. The Pentagon's case failed partly because a delivered model is a static artifact the vendor cannot reach. Write that property down. Document what you can and cannot touch after hand-over, because a court has now treated that answer as decisive.

Read the usage-limits part carefully. Anthropic's refusal to drop its autonomous-weapons and surveillance limits triggered the whole fight, and the court did not say those limits were wrong. It said punishing the company for defending them was wrong. If your acceptable-use policy has hard lines, this is a precedent that you can hold them against a government buyer. It applies in the Northern District of California for now, and it is subject to appeal.

Do not treat the label as gone. It still applies until the second case is decided. If you are a contractor deciding whether to build on Claude for government work, the practical answer today is unchanged from yesterday. Watch the DC appeals case, not this one.

The wider point is about who gets to decide safety limits. This ruling says a vendor can set them and criticise policy without becoming a security threat by definition. Whether that holds on appeal is the thing to track over the coming months.