Anthropic, Defense Department face off in DC court over blacklisting

A federal appeals court in Washington, D.C., heard arguments on Tuesday in Anthropic’s lawsuit over its blacklisting by the Department of Defense, the latest faceoff in the monthslong clash between the Pentagon and one of the country’s leading artificial intelligence companies.

A lawyer for the U.S. Department of Justice, on behalf of the DOD, and counsel for Anthropic answered questions from a panel of three circuit judges for nearly two hours. Judge Karen Henderson, Judge Gregory Katsas and Judge Neomi Rao will now take the matter under advisement and issue a written opinion.

Anthropic sued Defense Secretary Pete Hegseth and the DOD in March after the agency declared the AI startup a supply chain risk, meaning it purportedly threatens U.S. national security. The label has historically been reserved for foreign adversaries, and requires defense contractors to certify that they will not use Anthropic’s Claude models in their work with the military.

Judge Henderson said Tuesday that the DOD’s actions seem like a “spectacular overreach.”

“I don’t see that the department has in any way supported its determination that there is a supply chain risk with Anthropic, much less a significant supply chain risk,” Henderson said.

The judges asked both sides questions about the court’s jurisdiction, whether Hegseth and the DOD followed procedure and why they did not utilize any “less intrusive” solutions.

Sharon Swingle, the DOJ’s attorney, said the DOD needed to act quickly, and the designation served as a way to get the entirety of the agency aware of the risk at the same time.

“It put people on notice that they needed to be moving as quickly as possible to get substitute AI models to be integrated into the system in lieu of Anthropic’s model,” Swingle said.

Kelly Dunbar, the attorney representing Anthropic, said the DOD is “well equipped” to make operational and procurement decisions without “jumping to the highly public blacklisting of an American company as a national security threat.”

“If the secretary cannot get himself satisfied that any defense product he’s purchasing will meet standards and specifications of operability during conflict, the secretary probably shouldn’t procure it,” Dunbar said during the proceedings.

The designation landed after months of tense negotiations between Anthropic and the DOD collapsed. The DOD wanted Anthropic to grant the Pentagon unfettered access to its models across all lawful purposes, while Anthropic wanted assurance that its technology would not be used for fully autonomous weapons or domestic mass surveillance. 

The two sides failed to reach an agreement, and Hegseth blacklisted Anthropic and bashed the company on social media. Anthropic CEO Dario Amodei said the company had “no choice” but to challenge the supply chain risk designation in court. 

The DOD continued to use Anthropic’s models to support its military operations against Iran, and President Donald Trump told CNBC last month that a deal between the DOD and the startup is “possible.”

The appeals court denied Anthropic’s request to temporarily block the designation in April, which means it will remain in effect as the lawsuit plays out. However, the judges agreed to expedite the case since Anthropic “will likely suffer some irreparable harm” during the litigation, according to an order. 

While defense contractors have dropped Anthropic to comply with order, the company’s popularity in the private sector has only increased, as more businesses adopt its models and AI coding tools. Anthropic has been in talks to raise new funding at a $900 billion valuation, which would put it above OpenAI, up from $380 billion in February.

The company said last month that it had reached $30 billion in annualized revenue, after generating roughly $10 billion in revenue last year.

In a brief ahead of Tuesday’s proceedings, the government argued Anthropic could “encode limitations” into its model, which presents an “untenable national-security risk.” Hegseth determined that Anthropic “undermined the substantial trust required to sustain the relationship,” according to the brief, particularly since Anthropic could “manipulate its model to enforce its own moral and policy judgments about the military’s appropriate use of the technology.”

“I think it is clear that Anthropic has the technical capability to interfere with and even prevent the Department of War’s use of its AI model for critical military operations,” Swingle said Tuesday.

Anthropic, in a separate brief, said the notion that it could encode limits in future models is unsupported and provides “no basis” for a supply chain risk designation.

Dunbar acknowledged that Anthropic can and does develop guardrails through model training, but he said there’s “no record evidence” that the company has attempted to encode the two narrow use restrictions into Claude. He said Anthropic doesn’t have visibility into how Claude is used once it’s deployed in a classified environment.

Swingle countered that even if Anthropic doesn’t have a back door available to it today, it “doesn’t take away a risk that they could put one in in the future.”

Dunbar said the issue between Anthropic and the DOD is fundamentally a contract dispute.

“The question here isn’t that we’re trying to force contracts onto the department that the department doesn’t want,” Dunbar said. “We’re simply attempting to make sure that the department is not misusing, in our view, a narrow supply chain risk designation to gain leverage in a contract dispute to retaliate against Anthropic for its perceived disagreement with the department.”

In addition to its lawsuit in Washington, D.C., Anthropic filed a separate but related suit in federal court in San Francisco. The DOD relied on two distinct designations to justify its supply chain risk action, which means they have to be litigated in two separate courts. 

Anthropic was granted a preliminary injunction in its San Francisco case, allowing government agencies other than the DOD to use Anthropic’s models while the litigation unfolds. 

“Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government,” the judge wrote.

WATCH: Anthropic considering raising $50B at valuation near $900B: Report