Anthropic asks the full D.C. Circuit to rehear the Pentagon's Claude blacklist

What Anthropic filed

On 13 October 2026 Anthropic filed a petition asking the US Court of Appeals for the District of Columbia Circuit to rehear its challenge to the Pentagon's decision to brand the company a national-security “supply chain risk.” The petition asks for rehearing by the same three-judge panel or, failing that, by the full court sitting en banc. It is signed by Anthropic's lawyers at WilmerHale and runs 3,894 words, just under the court's limit.

The target is a 2-1 decision issued on 25 September in which the panel denied Anthropic's petitions for review and left the designation in place. Judge Gregory Katsas wrote the majority opinion, joined by Judge Neomi Rao. Judge Karen LeCraft Henderson dissented. The designation, made under a 2018 procurement law, lets the Department of War, as the Pentagon now calls itself, keep Claude out of its own systems and out of the work its contractors do for it.

Two days later, on 15 October, the court's clerk ordered the government to respond to the request for panel rehearing within 15 days, which puts the deadline at 30 October. The response is capped at 3,900 words, and Anthropic may not file a reply unless the court asks for one. The court has also been holding back its mandate, the formal step that makes a ruling final, since the September decision.

How the fight started

According to the petition and the panel opinion, the Pentagon began using Claude in March 2025 under a government-specific usage policy. Anthropic had earlier built a separate Claude Gov model after standard Claude refused some national-security tasks, such as summarising threat assessments and translating intercepted material describing violence. Over time the company dropped most of its restrictions for government users but kept two: no mass surveillance of Americans and no lethal autonomous warfare.

In September 2025 the Pentagon insisted Claude be available for “all lawful uses.” CNBC reports that talks collapsed as the two sides negotiated Claude's deployment on the department's GenAI.mil platform, two months after Anthropic signed a $200 million contract with the Pentagon. On 24 February 2026 Anthropic's chief executive met Secretary of War Pete Hegseth, who, the petition says, gave the company until 27 February to accept or face designation as a supply-chain risk or a takeover of Claude under the Defense Production Act.

Anthropic refused publicly. On 27 February President Donald Trump ordered all agencies to stop using Anthropic's technology, and Hegseth announced the designation in a social-media post that, as quoted in the petition, attacked the company's “sanctimonious rhetoric” and “ideology.” A formal notice under the 2018 law followed on 4 March, with a separate notice under a second statute, and Anthropic sued in two courts: the D.C. Circuit, which has exclusive jurisdiction over the 2018 law, and the federal district court in San Francisco for the second designation.

What the panel decided

The law at the centre of the case, 41 U.S.C. § 4713, defines supply-chain risk as the risk that a supplier may “sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” a technology product so as to deny or disrupt its use. The Pentagon's original justification, a four-page memo disclosed during the stay fight in March, described Anthropic as a “hostile party” that might alter or shut off Claude in the middle of military operations. Anthropic answered that once Claude runs on classified systems, it cannot access or change it.

The majority did not adopt the hostility theory. It wrote that it had “no reason to doubt” that Anthropic shapes Claude's behaviour with “noble intentions,” whether out of concern for privacy or AI safety. But it read “manipulate” in its ordinary sense, to skilfully arrange, operate or control, and held that the definition “turns on what Anthropic does, not why Anthropic does it.” Because Anthropic trains Claude to refuse certain tasks, and those refusals had blocked some government requests, the court found a covered risk. It noted that a dispute had arisen over whether the contract barred Claude's use in an ongoing overseas military operation.

The panel also found that skipping the advance notice the statute normally requires was harmless, since Anthropic could not show a different outcome, that the company got enough process after the fact, and that the exclusion rested on Anthropic's refusal to accept a contract term the Pentagon considered essential, not on its public advocacy for AI regulation.

Why Anthropic says the full court should step in

The petition argues four points. First, the majority's reading of “otherwise manipulate” clashes with the Supreme Court's 2024 Fischer decision, which read a similar catch-all clause in light of the words before it. Under the panel's reading, Anthropic says, every contractor “arranges, operates, or controls” its products and could be designated. Judge Henderson's dissent made the same argument, saying the statute targets “subversive acts, carried out through deceptive means.”

Second, Anthropic says the panel invented a harmless-error exception the statute does not contain, contrary to the Supreme Court's 2026 ruling in Trump v. Cook. Third, it says the panel gave an American company less procedural protection than D.C. Circuit precedent gives groups designated as foreign terrorist organizations. Fourth, it says the court ignored direct evidence of retaliation for speech, pointing to Hegseth's own words.

The company also stresses scale. It says § 4713 had never been publicly used before, and that the broader 2018 act had been used only once, against a Swiss company it describes as having Kremlin ties. It counts fifteen amicus briefs on its side, including one from 149 former judges, and quotes the dissent's summary of the choice it says every contractor now faces: “Agree to the Secretary's demands or risk being designated a national security threat.”

A split with the San Francisco court

The petition leans on a conflicting ruling. On 27 August, Judge Rita F. Lin of the Northern District of California granted Anthropic final relief against the second designation, made under 10 U.S.C. § 3252. Her order declared that the government's actions were unlawful retaliation for protected speech and violated due process, vacated the designation, and set aside Hegseth's order that no military contractor may do any commercial business with Anthropic. She permanently barred the participating agencies from enforcing those actions.

That leaves an odd position. One federal court has struck down one designation as retaliatory, while the appeals court with exclusive power over the other designation has upheld it on what Anthropic calls a materially similar record. The § 4713 exclusion, which keeps Claude out of Pentagon systems and contractor work for the department, stands for now.

What it means for Anthropic and other AI labs

For Anthropic, the ruling is a commercial and political weight. Defence contractors can still use Claude for private work under the San Francisco ruling, but not in their Pentagon contracts. The case also lands as the company reports rapid revenue growth ahead of a planned stock listing, where a standing national-security label is the kind of risk investors read about in a prospectus.

For other labs, the panel's reasoning is the bigger story. If refusing certain uses through model training counts as manipulation, any AI vendor that builds in refusals, which all of them do, could face the same treatment when a defence customer wants a behaviour removed. Anthropic's updated usage policy and its draft federal AI bill for lawmakers show the company still pressing for limits on how AI is used and how far government power over models should reach, the same commitments at the centre of this dispute.

Anthropic declined to comment beyond the filing, and a Pentagon spokesperson told CNBC the department does not comment on pending litigation.

Limitations and what comes next

Full-court rehearing is rare. Under the federal appellate rules it is reserved for cases of exceptional importance or conflicts with precedent, and it takes a vote of a majority of the court's active judges. The clerk's order asks only for a response to the panel-rehearing request; it does not signal how the court will rule on either request.

This article relies on the court filings and on CNBC's reporting. The account of the February meeting and the Pentagon's memo comes from Anthropic's petition and the record as summarised by the court, and the government has not yet filed its answer. Things to watch: the government's response, due 30 October; whether the panel or the full court agrees to rehear the case; whether the government appeals Judge Lin's judgment; and, if rehearing is denied, whether Anthropic asks the Supreme Court to take the case.