Key Takeaways
- Anthropic won. On August 27, 2026, U.S. District Judge Rita Lin ruled that the Pentagon’s designation of Anthropic as a “supply chain risk” was unlawful retaliation under the First Amendment, a violation of Fifth Amendment due process, and “arbitrary and capricious.” She ordered the designation removed.
- The fight isn’t over. A second, narrower Anthropic case remains pending before the D.C. Circuit under a different statute, and the government is expected to appeal Lin’s ruling. The Justice Department had already appealed an earlier injunction to the Ninth Circuit in April.
- The trigger was two red lines. Anthropic refused to let Claude be used for mass domestic surveillance of Americans, or to power fully autonomous weapons without human control over targeting and firing decisions. Defense Secretary Pete Hegseth insisted the department should have access for “any lawful purpose.”
- The real lesson for India is not about the US. It is that India’s procurement rulebook — GeM contracts, IndiaAI Mission tenders, defence acquisition — currently has no written answer to the question this case forced open: can a private AI vendor impose usage limits on the state, and what happens when the state says no?
What Actually Happened: February to March 2026
The dispute grew out of a July 2025 award. The Pentagon’s Chief Digital and Artificial Intelligence Office (CDAO) gave Anthropic, Google, OpenAI and xAI contracts with a $200 million ceiling each to build agentic AI prototypes for national security work. Anthropic became the first AI company authorised to run a frontier model inside classified government networks, under terms that acknowledged its Acceptable Use Policy.
Those terms are what collapsed. As the relationship deepened, Hegseth pushed for unrestricted use of Claude across all lawful military purposes. Anthropic CEO Dario Amodei would not move on the two prohibitions, and talks broke down — reportedly made worse by the administration publicly attacking the company while negotiations were still live.
In late February 2026, Trump posted on Truth Social directing all federal agencies to immediately stop using Anthropic technology, with a six-month phase-out period for departments like the DoD. Shortly after, Hegseth declared the company a supply chain risk on X, and the Defense Department followed with a formal determination letter in early March.
That label matters far more than it sounds. It is drawn from an obscure procurement statute (10 U.S.C. § 3252) written to protect military systems from foreign sabotage, and it had never before been applied to an American company. In practice it forces every defence contractor to certify that it is not using Anthropic products on DoD-linked work. The General Services Administration also terminated Anthropic’s “OneGov” agreement, pulling its services from federal systems.
Amodei’s response was blunt: the company did not believe the action was legally sound and saw no choice but to challenge it in court.
The Full Timeline
What Judge Lin Actually Found
The August ruling is the document worth reading, because it sets out how a US court weighs a government’s national-security assertion against a vendor’s speech.
Lin accepted that the military should have wide latitude in choosing who it works with. But she found the evidence that Anthropic posed a genuine national security risk to be slim, and concluded that the real motivation was punishing the company for criticising the government — that the Pentagon was seeking to make an example of it. On that basis the designation amounted to unlawful retaliation in violation of the First Amendment, and Anthropic had been denied the process it was owed before being deprived of its interests.
The government’s central argument — that AI models are so enormous and opaque that the Pentagon cannot evaluate them the way it evaluates hardware — did not persuade her.
Anthropic has been careful throughout to say that neither lawsuit seeks to force the government to buy its products. The claim is narrower and more consequential: that officials cannot brand a company a security threat because they dislike its policy positions.
What Was at Stake Financially
In its March filing, Anthropic told the D.C. Circuit that for 2026, the government’s actions risked hundreds of millions — or multiple billions — of dollars in lost revenue. The larger number reflects the chilling effect on private defence contractors, not the federal contracts themselves. Once every DoD supplier has to certify it isn’t using Claude on department work, the designation reaches deep into commercial relationships that have nothing to do with the Pentagon directly.
That transmission mechanism — a procurement label spreading through a supply chain into private contracts — is the part India should study most closely.
India’s Sovereign AI Dilemma: Four Things That Need Answering
India is building its own AI procurement machinery right now, which makes this a rare chance to write rules before the crisis rather than after it.
The IndiaAI Mission, approved by the Union Cabinet in March 2024 with an outlay MeitY puts at ₹10,371 crore (widely reported as ₹10,372 crore) over five years, runs across seven pillars, one of which is Safe & Trusted AI. As of mid-2026, the government had identified 20 indigenous sovereign model proposals for support — 12 LLMs and 8 SLMs — including Sarvam AI’s 30-billion and 105-billion parameter models. Thirteen Responsible AI projects have been approved across Indian institutions, and the IndiaAI Safety Institute, announced in January 2025, now oversees that pillar.
On the governance side, MeitY released the India AI Governance Guidelines on November 5, 2025 — a deliberately techno-legal, principle-based framework built on seven “sutras” that leans on existing law rather than a standalone AI statute. It proposes three institutions: an AI Governance Group (AIGG), a Technology & Policy Expert Committee (TPEC), and the AI Safety Institute (AISI). In February 2026, MeitY separately notified amendments to the IT Rules targeting synthetically generated information.
Here is what that architecture does not yet address.
1. Whose acceptable use policy governs a government deployment?
India’s framework says a great deal about how AI should be built and very little about who wins when a vendor’s usage restrictions collide with a state buyer’s intentions. GeM contracts and standard government tender conditions were not drafted with model-level behavioural restrictions in mind. The practical question is whether an Indian ministry procuring an LLM inherits the vendor’s AUP as a contractual term, or whether procurement is assumed to override it. Right now, both readings are available — which is precisely the ambiguity that produced the US standoff.
2. Indian model builders will face this earlier than they expect
Sarvam AI, Krutrim and the other IndiaAI-backed labs are building general-purpose models with public funding. Indian defence and intelligence agencies will want them. Founders have to decide now, while writing their first enterprise terms, whether to hardcode usage limits — and whether doing so puts their government funding or future tenders at risk. A company that has taken IndiaAI support is in a structurally weaker position to say no than a privately funded US lab with a $350 billion valuation and a litigation budget.
3. Indian IT services carry the compliance burden either way
TCS, Infosys, Wipro, HCLTech and LTIMindtree all do substantial US Department of Defense and federal work. During the months the designation was in force, every one of them had to verify that no Claude instance touched DoD-linked delivery — across subcontractors, GCCs and offshore development centres. Lin’s ruling lifts that specific obligation, but the precedent is now established: a US procurement designation can impose audit costs on Indian firms with no notice and no involvement in the underlying dispute. That is a supply-chain risk worth modelling regardless of how the appeals go.
4. India has no dispute-resolution path between vendor and state
The AIGG-TPEC-AISI structure is designed for standard-setting, not adjudication. Nothing in it handles a vendor refusing a specific government use case. Two fixes are available and neither requires new legislation:
- Write baseline safety obligations directly into procurement contracts — so the permitted-use boundary is negotiated at tender stage rather than asserted mid-deployment.
- Give TPEC or AISI a mediation mandate for vendor-state disagreements over model use, so the dispute has somewhere to go before it becomes an economic-retaliation fight.
What to Watch Next
- Whether the government appeals Lin’s ruling to the Ninth Circuit, and how that panel treats the First Amendment finding.
- The pending D.C. Circuit decision on the second designation — a loss there would leave Anthropic partially blacklisted even after winning in California.
- Whether the CDAO’s multi-vendor structure holds, or whether the Pentagon consolidates around vendors with looser usage terms.
- Whether MeitY’s next procurement guidance under the Safe & Trusted AI pillar addresses vendor usage restrictions explicitly.
FAQs
Why was the “supply chain risk” designation unprecedented?
The statute behind it was written to keep foreign sabotage out of military systems, and the label had previously been applied to companies seen as tied to foreign adversaries. Anthropic is the first US company to receive it. Applying a foreign-espionage tool to a San Francisco firm during a contract dispute over safety terms is what made national security experts call it highly unusual.
Did Anthropic file one lawsuit or two?
Two, both on March 9, 2026 — Northern District of California and the D.C. Circuit Court of Appeals. The Pentagon relied on two distinct designations resting on different statutes, which had to be challenged in separate courts. The D.C. case is still open.
Can a government legally force an AI company to remove safety restrictions?
Judge Lin’s ruling does not say the Pentagon must work with Anthropic — it says the government cannot brand a supplier a national security threat in retaliation for the supplier’s protected speech. The Pentagon remains free to buy elsewhere, and OpenAI, Google and xAI hold parallel CDAO contracts. Note that OpenAI’s published contract description also bars mass domestic surveillance and direction of autonomous weapons, so the underlying restrictions are not unique to Anthropic.
Does any of this bind Indian agencies?
No. It has no legal force in India. Its relevance is as a template: it shows exactly how an unresolved procurement ambiguity escalates into blacklisting, litigation and supply-chain compliance costs, and it gives India a fully documented failure mode to design around while the IndiaAI procurement rules are still being written.
Sources
- Axios — Anthropic sues Pentagon over rare “supply chain risk” label
- Reuters via Yahoo Finance — Anthropic seeks appeals court stay
- CNBC — Anthropic loses appeals court bid to temporarily block Pentagon blacklisting
- Federal News Network / AP — Appeals court judges divided over Pentagon dispute
- CNN — Judge rules Pentagon’s supply chain risk label unlawful
- NPR — Judge says Pentagon can’t designate Anthropic a supply chain risk
- PBS NewsHour — Judge says Pentagon’s measures were illegal and baseless
- Breaking Defense — CDAO awards $200M each for agentic AI
- PIB — Safe & Trusted AI Pillar under IndiaAI Mission
- PMO — Cabinet approves IndiaAI Mission
- DSCI — Summary of India AI Governance Guidelines