Judge rules the Pentagon’s supply chain risk label for Anthropic unlawful

Federal Court Strikes Down Pentagon’s Supply Chain Risk Designation Against Anthropic

Goldlaner.com – A federal judge in California ordered the Department of Defense to remove its “supply chain risk” label from AI developer Anthropic on Thursday evening, declaring the designation unlawful and a violation of two constitutional amendments. The ruling, issued by Judge Rita Lin of the Northern District of California, marks a rare judicial rebuke of a national-security-adjacent action taken against a domestic technology company and signals that the government cannot wield procurement designations as instruments of political punishment.

The Dispute: Guardrails vs. Military Autonomy

The conflict between Anthropic and the Pentagon traces back to early this year, when the company declined to strip internal safety guardrails from its Claude AI model. Those guardrails were designed to prevent the model from being deployed in autonomous weapons systems or mass-surveillance operations. Anthropic maintained that its models had not yet reached a reliability threshold sufficient for such high-stakes applications. Defense Secretary Pete Hegseth pushed back, arguing that a private firm should not dictate how the American military deploys its own tools. In February, he took the extraordinary step of formally designating Anthropic a supply chain risk — a classification previously reserved for firms perceived to have ties to foreign adversaries.

Under that designation, every element of the Pentagon, including its contractor network, was barred from using Anthropic’s products. The move effectively locked the company out of one of the largest procurement ecosystems in the world, a consequence far more severe than anything typically associated with ordinary contract disputes.

The Court’s Reasoning

Anthropic filed suit in March. Lin, appointed to the bench by former President Joe Biden, spent months weighing the competing claims before delivering her decision. She rejected the Pentagon’s central argument — that its inability to “trust” Anthropic justified the label — and found instead that the designation was motivated by animus toward the company’s public criticism of government policy.

“The empty invocation of national security is not a blank check to punish and retaliate against government critics,” Lin wrote. She added that the record showed the Pentagon sought to make a “public example out of Anthropic for its ‘arrogance’ in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model.”

Lin grounded her ruling in two constitutional provisions. First, she found the action “constituted unlawful retaliation in violation of the First Amendment,” meaning the government punished Anthropic for exercising its right to speak critically about how its technology was being deployed. Second, she held that the company “was denied the pre-deprivation process required under the Fifth Amendment,” because Anthropic received no meaningful opportunity to contest the designation before it took effect and severed its commercial relationships.

Broader Implications for Government Procurement and Free Speech

The decision carries implications well beyond a single contract dispute. Supply chain risk designations have become an increasingly common tool in U.S. procurement, originally developed to screen out firms with foreign ownership or state-linked financing. Applying that mechanism to a domestic company that merely disagreed with a customer about product design stretches the tool into new territory. Lin’s opinion suggests that stretching it into a vehicle for silencing critics crosses a constitutional line.

For the AI industry, the ruling also underscores that companies retain First Amendment protections even when they are deep inside government procurement pipelines. A vendor’s right to explain why its technology should not be used in certain contexts — autonomous weapons, pervasive surveillance — is not forfeited simply because its largest customer is the Department of Defense.

Government Continuity and the Saboteur Narrative

Lin pointed to a practical inconsistency in the Pentagon’s position: other branches of the federal government continued to work with and meet Anthropic even after the supply chain risk label was applied. In her view, that pattern undermined the premise that Anthropic posed a genuine sabotage threat.

“None of that is consistent with a genuine fear that Anthropic is a saboteur who would poison its software to harm national security,” Lin wrote.

The point matters because the supply chain risk framework is built on the assumption that a designated firm might embed defects, backdoors, or foreign-directed instructions into its products. If the rest of the government treats the same firm as a normal commercial partner, the saboteur narrative loses its factual footing.

Reactions and What Comes Next

An Anthropic spokesperson said the company “welcome[d]” the ruling and added: “We remain focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology.” The Pentagon did not immediately respond to requests for comment.

In a June interview with Axios, President Donald Trump acknowledged that he had once regarded Anthropic as a national security threat but said he no longer held that view — a public shift that may have influenced the broader political climate surrounding the litigation.

The legal fight is not entirely over. A second lawsuit brought by Anthropic, also connected to the supply chain risk designation, remains pending before a court in Washington, D.C. That case could address additional procedural questions about how such designations are imposed, reviewed, and lifted, and its outcome may further define the boundaries between legitimate procurement screening and unconstitutional retaliation.

For now, the Thursday ruling stands as a clear judicial message: the government’s power to choose its vendors is broad, but it is not unlimited, and it cannot be converted into a mechanism for punishing a company that tells its biggest customer its product is not ready for the job.