Judge Vacates Pentagon's Anthropic Risk Label

On Thursday evening in San Francisco, U.S. District Judge Rita Lin finished a fight that started as a procurement spat and ended as a First Amendment case. She vacated Defense Secretary Pete Hegseth's supply-chain risk label on Anthropic and ordered the Trump administration to rescind the directives that told every federal agency to drop Claude.

The quarrel was never about a backdoor in the model. Anthropic refused to loosen product rules that block fully autonomous weapons and mass surveillance of Americans. The White House and the Pentagon answered by treating a domestic AI lab like a sabotage risk, then trying to freeze its federal business and its defense-contractor customers.

6 min read

What Lin found

Lin's order says the designation was arbitrary and capricious under the Administrative Procedure Act, denied Anthropic the process the Fifth Amendment requires, and retaliated against protected speech. The legal definition of a supply-chain risk, she wrote, covers adversary sabotage and subversion of covered systems. Anthropic does not fit that box.

She also noticed the government talking out of both sides of its mouth. Officials floated the Defense Production Act as if Anthropic were essential to national security while branding it a threat. The Department of Defense kept chasing a contract. Agencies collaborated with Anthropic's Mythos model on cybersecurity. Lin treated that contradiction as evidence, not noise.

"The empty invocation of national security is not a blank check to punish and retaliate against government critics," she wrote. That sentence is the load-bearing one. The Department of War remains free to choose another vendor. What it cannot do, on this record, is punish a company for arguing in public about how its own tools should be used in war and domestic surveillance.

Anthropic had already won a preliminary injunction from Lin in March. Thursday's ruling makes the block permanent in the California case. A narrower D.C. Circuit fight over a separate procurement designation is still open, and the government is expected to appeal. OpenAI, for its part, struck a Pentagon deal hours after Anthropic was punished earlier this year. The market heard the lesson before the court wrote it down.

The philosophical stake is who gets to set the moral perimeter of dual-use software once the buyer is the state. Anthropic claims a right to publish limits on lethal autonomy and mass surveillance. The Pentagon claims a right to buy tools without a vendor's veto. Both claims can be serious. Lin's point is narrower and sharper: you do not get to win that argument by inventing a sabotage label for a critic.

Sonar has watched Anthropic publish Claude's own critique of its risk report. The company likes to perform caution in public. That performance does not make a supply-chain designation lawful. It does make the government's retaliation look exactly like what Lin said it was: an attempt to make an example of arrogance.

A court that insists on the ordinary meaning of supply-chain risk is doing unfashionable work. National security rhetoric is designed to short-circuit review. Lin refused the short circuit. The appeal will try to restore it. Until then, the rule in her courtroom is simple. Argue with Anthropic about contracts if you want. Do not call disagreement sabotage.