Federal Court Questions Pentagon's Case Against Anthropic Over AI Restrictions

A Judicial Rebuke on Technical Claims

U.S. District Judge Rita Lin told government attorneys during a Thursday hearing that the Department of Defense has failed to substantiate its assertion that Anthropic poses a supply-chain risk to national security. The designation, which bars federal agencies from procuring the company's AI systems, hinges on claims that Lin found unconvincing after reviewing the evidence presented.

At the center of the dispute: the Pentagon's argument that Anthropic could remotely disable or modify AI models already deployed in government systems. Lin stated plainly that she saw no proof the company possesses such capability, dismissing what she characterized as speculation about a theoretical "kill switch." Security experts have echoed similar skepticism, noting that once a model is delivered and integrated into a closed system, the vendor typically lacks the architecture to alter it remotely without explicit backend access.

The confrontation stems from contract negotiations that collapsed earlier this year. Anthropic declined terms that would have allowed the Defense Department to deploy its Claude models for what the company described as use cases the technology cannot reliably handle: mass surveillance of U.S. citizens and autonomous targeting or firing decisions in weapons systems. The company's position was that its models lack the accuracy and safety guarantees those applications demand.

When Contractors Say No

The Pentagon's response was unequivocal. Military officials argued that private vendors should not dictate operational parameters for technologies the government procures. The department emphasized it would use AI tools only in ways compliant with existing law, a position that presumes legal frameworks adequately govern emerging capabilities in autonomous systems.

But the government's rationale extended beyond the failed contract. Attorneys argued that Anthropic's public criticism of the DOD, including statements about the risks of premature military AI deployment, itself justified the supply-chain risk label and procurement ban.

Judge Lin called that logic "really troubling." She warned that accepting such reasoning could establish a precedent allowing the executive branch to retaliate against any federal contractor that publicly disagrees with agency policy. The implication: dissent becomes grounds for exclusion, chilling open debate about how emerging technologies should be governed.

At DailyTechWire, we've tracked similar tensions across Asia-Pacific markets, where governments from Seoul to Canberra are negotiating the boundaries of acceptable use with frontier AI labs. The difference in those jurisdictions has often been the presence of formal frameworks, such as Singapore's Model AI Governance Framework or Japan's AI Business Guidelines, that create shared vocabularies for risk before contracts are signed. The U.S. approach, by contrast, has been more adversarial and ad hoc.

Two Courtrooms, One Question

Anthropic filed two separate lawsuits in March challenging both the supply-chain designation and the procurement ban. The case before Judge Lin, heard in San Francisco, focuses on the evidentiary basis for the risk label. A parallel suit in Washington addresses the administrative process that led to the ban.

Lin issued a temporary injunction in March blocking enforcement of the ban while the case proceeds. Thursday's hearing addressed whether that injunction should become permanent. Her skepticism about the government's evidence suggests the company has a strong position, though she has not yet ruled.

The technical claim about remote model manipulation is particularly significant. If the government could demonstrate that Anthropic retains the ability to alter models post-deployment, that would constitute a genuine supply-chain vulnerability, akin to concerns about firmware backdoors in telecommunications hardware. But modern large language models are typically deployed as static weights and inference engines. Changing behavior requires either retraining or fine-tuning, both of which necessitate access to the deployment environment, not remote commands from the vendor.

The DOD's inability to produce evidence of such a mechanism raises questions about whether the designation was driven by technical analysis or policy frustration.

The Precedent That Worries Silicon Valley

Beyond Anthropic, the case has drawn attention from other AI companies and defense contractors. If public criticism of a government customer can be recast as a security risk, the chilling effect extends across the sector.

Several firms have privately expressed concern that the Anthropic case signals a shift in how the Pentagon manages relationships with commercial AI vendors. The defense sector has historically tolerated, even encouraged, red-teaming and public discourse about system limitations, viewing it as part of responsible development. Reframing that discourse as disloyalty or evidence of untrustworthiness would represent a significant departure.

The case also highlights an unresolved tension in U.S. AI policy. Washington wants access to cutting-edge commercial models, which are advancing faster than government-developed alternatives. But frontier labs, aware that their systems can fail unpredictably, are increasingly reluctant to grant blanket permissions for high-stakes applications without clearer accountability structures.

Other democracies have addressed this through co-development agreements that include ongoing safety evaluations and use-case reviews. The U.S., by contrast, has largely relied on procurement contracts that assume technologies are ready for deployment once purchased. Anthropic's refusal challenged that assumption, and the government's response has been to question the company's reliability rather than revisit the assumption itself.

What Comes Next

Judge Lin has not set a timeline for her final ruling on the permanent injunction. Both sides will submit additional briefs, and the Washington case will proceed on a separate track. If Lin rules in Anthropic's favor and lifts the risk designation, it would not compel the Pentagon to resume contract negotiations, but it would remove the formal barrier preventing other federal agencies from using the company's technology.

The broader question, whether private AI developers can set boundaries on government use of their models, remains unresolved. Contract law generally allows vendors to decline terms they find unacceptable, but the national security framing complicates that calculus. If the government deems a technology essential and a company refuses to provide it on the requested terms, does that refusal itself become evidence of unreliability?

For now, the answer depends on whether the evidence supports the government's claims. Judge Lin has signaled it does not. Whether that conclusion holds in the final ruling, and whether the Washington court reaches the same conclusion, will shape how other AI companies approach defense contracts in the months ahead.

The case is a reminder that as AI capabilities grow, so too do the stakes of who controls their deployment and under what constraints. Anthropic's willingness to walk away from a lucrative contract reflects a calculation that reputational risk and potential liability outweigh near-term revenue. Whether that calculus makes sense will depend, in part, on whether courts view such caution as prudent or as obstruction.