A federal appeals court ruled on Friday that the US Department of Defense may blacklist Anthropic's artificial intelligence, upholding a designation that began when the company refused to let the Pentagon use its Claude models for "all lawful purposes".
How a refusal became a security designation
Anthropic's objection was to scope, not to defence work as such. It held red lines around autonomous weapons and surveillance of US citizens, and would not sign them away. Earlier this year the Trump administration responded by labelling the company a "supply chain risk" and ordering federal agencies and military contractors to stop doing business with it.
The weight of that label is easy to miss. It is normally used for firms tied to foreign adversaries, and had never before been applied to an American company. In practice it meant no contractor, supplier or partner working with the military could deal with Anthropic at all — down to using the paid version of Claude. For a company betting on enterprise revenue ahead of a possible trillion-dollar public offering before the end of this year, that is not a symbolic penalty.
Two courts, two answers
Anthropic sued, arguing the designation violated the First Amendment and was legally unsound. It won partially in California in August, where a court invalidated part of the label; the government has not appealed that ruling. On Friday the DC Circuit went the other way, finding the Pentagon had "ample support" for concluding that integrating Claude into its systems could pose a national security threat. One of the three judges dissented, seeing no legitimate concern that the company would manipulate its technology to create a risk.
The rulings do not actually collide, because the Pentagon used several designations and the two courts ruled under different statutory authorities. The practical result is a split: Claude stays banned inside the Pentagon, while other federal agencies and contractors may keep working with Anthropic. The company says it disagrees and is considering all options — which means either asking the full eleven-judge DC court to rehear the case, or going to the Supreme Court.
The Pentagon's tone left little doubt about what it thinks the case was about. Undersecretary Emil Michael wrote on X that warfighters will sleep better knowing no private company will insert its opinions into the chain of command.
The precedent underneath
Strip out the parties and a rule is being established: a government that cannot get the terms it wants from an AI vendor can reclassify that vendor as a security problem. Whatever you think of Anthropic's red lines, the lever now exists, it has survived appellate review, and it is available to any administration and against any supplier. It also cuts against the argument the industry has been making at the UN — that companies want binding external limits — since here a company holding a limit was penalised for it, days after Altman and Amodei asked the Security Council for exactly such rules.
What it means in Bangladesh
The lesson here is not about American politics; it is about what happens to everyone downstream when a supplier and a government fall out. Bangladeshi banks, telecom operators, BPO firms and government projects increasingly build on one foreign AI provider, and this case shows two ways that can break: the vendor may refuse a use you need on ethical grounds, or the vendor's own government may put it out of reach regardless of your contract. Neither risk appears anywhere in a standard procurement checklist here.
Three clauses are worth insisting on before the next AI contract is signed. Require a documented exit path — an export of prompts, fine-tuning data and evaluation sets in a portable format, so switching provider is an engineering task and not a rewrite. Require notice of any change in permitted use, because the terms that made the system legal for your purpose can change without you. And for anything in defence, policing or citizen records, keep at least one workload running on a model you can host yourself, so the capability survives a decision taken in another country. That is the same argument for sovereign capacity that runs through the open-versus-proprietary split now dividing the rest of the world.
