A court erased the Pentagon’s blacklist of Anthropic. It did not order the military to keep buying Claude, certify the model as secure, or end the government’s ability to change providers.
The Anthropic Pentagon blacklist is no longer in force. A federal district court granted Anthropic summary judgment on its First Amendment and due-process claims, permanently enjoined the challenged actions for the covered defendants, and vacated both the supply-chain designation and a directive aimed at companies doing business with Anthropic.
That is a substantial legal win. It is also narrower than some victory-lap headlines suggest. The final order leaves the government free to stop using Anthropic through a lawful provider transition, and the government prevailed on several other claims.
What the court actually removed
The case came from the Northern District of California. In its summary-judgment opinion, the court ruled for Anthropic on its First Amendment and procedural due-process theories against the participating defendants.
The accompanying final relief order permanently blocks those defendants from enforcing the challenged supply-chain-risk designation. It also vacates the directive that had told military contractors, suppliers, and partners to avoid commercial activity with Anthropic.
| Question | Result |
|---|---|
| Does the supply-chain designation remain? | No. The court vacated it. |
| Can the covered defendants enforce the challenged blacklist? | No. The injunction is permanent. |
| Must the military keep using Anthropic? | No. |
| Can the government lawfully move to another provider? | Yes. |
| Did Anthropic win every claim? | No. The government prevailed on the ultra-vires claim and several agency-related claims. |
A blacklist ruling is not a model-security test
The court evaluated government action, the evidentiary record, and constitutional process. It did not run Claude through a cyber range, inspect model weights, or certify Anthropic’s infrastructure. Legal invalidity and technical security are different questions.
This distinction matters because AI procurement arguments often collapse four separate judgments into one label: capability, safety policy, vendor security, and contract suitability. A court can find that a blacklist lacked a lawful basis without finding that every Anthropic model is suitable for every classified or military workload.
Our report on Anthropic’s production-code risk evidence shows why vendor oversight still needs its own operational test. The result here restores a procurement position; it does not replace that test.
The slim record became the government’s problem
The opinion repeatedly focuses on the record supporting the government’s action. The court described it as thin and found no evidence of a hidden access mechanism or similar technical compromise that would explain the supply-chain label.
For procurement teams, that is the useful part of the case. A serious restriction needs a traceable chain: named threat, supporting evidence, affected systems, decision owner, review process, and a route to challenge or cure the finding. A label applied first and explained later is fragile, especially when it punishes parties beyond the vendor itself.
- Separate policy disagreement from a documented technical risk.
- Name the systems and contracts the restriction covers.
- Preserve the evidence used at the decision date.
- Give the vendor notice and a meaningful response path.
- Review whether downstream contractors are being restricted more broadly than the evidence supports.
Anthropic did not win the whole complaint
The government won Anthropic’s ultra-vires theory and several claims involving agencies or defendants that did not participate in the challenged actions. That mixed result matters. Calling the judgment a total victory would erase which legal theories succeeded and which did not.
It is also a district-court judgment. An appeal remains possible. Until the appellate deadline and any later proceedings are resolved, procurement teams should treat the injunction as controlling current law without describing the dispute as permanently finished.
The builder lesson is evidence before exclusion
Most companies will never issue a government supply-chain designation. They still make smaller versions of this decision every week: block a model, remove a plugin, suspend a vendor, or prohibit an agent because somebody heard about a risk.
A defensible internal restriction should answer three questions. What failure are we preventing? What evidence connects this provider or tool to that failure? What would have to change before the restriction could be reviewed? Without those answers, a safety rule can become an unchallengeable reputation score.
Record the answers at the time of the decision, not after a dispute begins. Add an owner, an expiry or review date, and a narrowly defined scope. That gives engineers a rule they can implement and gives management a record it can defend.
The same discipline applies to incidents. Our analysis of AI cyber tests that reached real systems separates confirmed containment failures from claims the evidence does not prove. Procurement restrictions deserve that level of attribution too.
My verdict: the blacklist failed, due diligence did not disappear
Anthropic won the relief that mattered most: the designation and contractor directive were vacated, and the covered defendants cannot revive the same challenged actions under the injunction. That repairs a legal and commercial injury.
Buyers should resist the opposite overreaction. The ruling is not permission to skip model evaluation, data-boundary review, incident planning, or contract analysis. It says the government needed a lawful, evidence-backed process for this exclusion. Every serious AI buyer should want the same standard inside its own organization.
Read the primary record
- Read the court’s summary-judgment opinion.
- Read the final order and permanent injunction.
- Compare the legal record with Associated Press reporting.
Checked August 29, 2026. This article describes a U.S. district-court judgment and is not legal advice. The order does not prevent a lawful transition to another provider, and later appellate proceedings could change the legal posture.
