What Anthropic Actually Won in Its Fight With the Pentagon

On February 27, President Trump posted that Anthropic was a "radical left, woke company" and ordered every federal agency to stop using its chatbot Claude, according to Courthouse News⁵. Within hours, Defense Secretary Pete Hegseth designated the company a supply-chain risk to national security and announced that no contractor, supplier, or partner doing business with the American military could conduct "any commercial activity"⁸ with it. "America's warfighters will never be held hostage by the ideological whims of Big Tech,"⁷ he wrote, adding that the decision was final.

On Thursday night, a federal judge decided it wasn't. In a 59-page ruling⁴, Judge Rita Lin of the Northern District of California found the measures "illegal and baseless," holding that the government retaliated against Anthropic's constitutionally protected speech and denied it due process. The designation, she found, rested on a desire to "make a public example out"³ of the company for its arrogance in criticizing the government. An appeal is expected². I think Lin got this right, and I think the ruling is both narrower and more durable than either the administration or Anthropic's cheering section suggests. It protects an AI company's right to argue with the Pentagon in public. It gives no company a right to the Pentagon's business, and that distinction is the whole ballgame.

Start with what the fight was actually about. Anthropic was the first frontier lab (a developer of general-purpose models at the leading edge of capability) to get its systems onto classified networks, via a partnership with Palantir¹⁵, and it held a $200 million Pentagon contract. Negotiations collapsed when the department demanded Claude be available for all lawful purposes and Anthropic insisted on two exceptions⁹: mass domestic surveillance of Americans and fully autonomous weapons, uses the company says today's models are not reliable enough to support. When the Pentagon's deadline passed, the government reached for three instruments at once, as one legal analysis laid out¹⁴: a presidential directive banning Anthropic across the federal government, the Hegseth directive barring military contractors from commercial dealings with the company, and supply-chain-risk designations under two statutes, including the Federal Acquisition Supply Chain Security Act, a 2018 law built to purge foreign adversaries' hardware from federal systems. No American company had ever been designated before¹⁶.

The legal question was never whether Anthropic had speech rights. The Supreme Court settled that in 1996, holding in Board of County Commissioners v. Umbehr¹⁷ that the government cannot terminate a contractor in retaliation for protected speech, and in O'Hare Truck Service¹⁸ that it cannot strike a firm from an approved list over its politics. Those cases require courts to balance the speaker's rights against the government's operational interests, and under Mt. Healthy v. Doyle¹⁹ the government still wins if it proves it would have taken the same action for legitimate, non-speech reasons.

That is where the government made its stand, and the argument deserves a straight look, because it is not frivolous. Battlefield AI is not municipal trash hauling. A Justice Department lawyer argued at summary judgment that a lack of trust, not retaliation⁵, drove the designation: unlike a rifle or a radio, a hosted AI model cannot be disassembled and inspected, so the military must be able to trust that a vendor won't quietly tighten guardrails mid-operation. The record even contains an episode that gives this teeth. After the January raid that captured Nicolás Maduro, in which Claude was reportedly used through the Palantir pipeline, a senior Anthropic executive asked a Palantir counterpart¹⁵ whether Anthropic's software had been involved, in a way the Palantir executive read as disapproval and reported to the Pentagon. And in April, a D.C. Circuit panel hearing Anthropic's parallel challenge denied a stay¹³, saying it would "not lightly override"¹² military judgments and suggesting Anthropic's interests looked more financial than constitutional. Reasonable judges have read this record differently.

But the trust defense has to survive three facts, and on Lin's record it survives none of them. First, the government's behavior contradicted its stated fear: the Pentagon gave itself six months of continued Claude use after declaring the company a menace, and other agencies kept working with Anthropic throughout, which Lin said was inconsistent with "a genuine fear that Anthropic is a saboteur"¹. Second, the remedy didn't match the diagnosis. A real reliability judgment ends contracts; it does not purport to ban every military supplier in America from doing business with a company, an edict Anthropic argued, and the record bore out, had no statutory basis⁹. Third, the government narrated its own motive in real time: "woke," ideological whims, arrogance, an example to be made. Mt. Healthy asks whether the same action would have happened absent the speech. When the punishment arrives wrapped in commentary about the speech, that question tends to answer itself. As Lin put it, "The empty invocation of national security is not a blank check to punish and retaliate against government critics."²

The OpenAI comparison closes the loop. Days after the blacklisting, OpenAI signed its own classified-network deal with three red lines¹⁰: no mass domestic surveillance, no directing autonomous weapons, no high-stakes automated decisions. OpenAI even told the government Anthropic should not be designated. If materially similar safety limits could be engineered into a signed contract through cloud-only deployment and negotiated language, then Anthropic's red lines were not incompatible with national security. The designation punished the posture, not the product. I'll concede the comparison cuts both ways: OpenAI accepted the all-lawful-purposes framing and negotiated quietly, and civil-liberties critics argue¹¹ its protections are softer than Anthropic's hard prohibitions. A vendor that insists on holding enforcement power over its own model in live military systems is a genuinely harder counterparty, and the Pentagon was entitled to walk away from that deal.

Which is exactly what the ruling permits. Lin wrote that the military should have wide latitude to choose its partners, and Anthropic's suits never asked a court to force the Pentagon to restart work³. So the honest answer to whether AI firms can criticize defense policy without losing federal business is: they can absolutely lose the specific business. A lab that draws red lines the military won't accept should expect nonrenewal and a rival's logo on the contract. What the government cannot do is convert that commercial breakup into a government-wide excommunication because the vendor defended its position in public. The appeal will test that line, though the D.C. Circuit merits panel in May sounded skeptical⁶ of the government's claim that Anthropic had granted itself an operational veto, so the April split may prove shallower than it looked.

The company with the most riding on that appeal is not Anthropic, which is marching toward an IPO with its designation vacated. It is OpenAI, whose Pentagon contract now contains the very red lines that got its rival branded a national security threat. If Lin's ruling falls, every one of those clauses sits one policy disagreement away from a designation letter, and the industry's newest defense partner will have learned that its protections last exactly as long as its silence.