AI Strategy• 9 min read

March 2026: Anthropic Takes the Pentagon to Court Over Who Sets AI's Limits

In March, the Pentagon formally designated Anthropic a supply chain risk, a label never before applied to a domestic company, and Anthropic sued. On March 26, a federal judge blocked the designation and the president's ban on federal use of Claude, calling the government's actions "classic illegal First Amendment retaliation." The case turned a contract dispute into a test of whether an AI vendor can limit how a government uses its models.

Author: Macaulan Chiaramonte

March 2026 was the month the dispute between Anthropic and the Department of War moved from social media to the courtroom. A March 4 letter made official the supply chain risk designation that Defense Secretary Pete Hegseth had announced on X in late February, and Anthropic filed two lawsuits on March 9. Microsoft, the ACLU and retired military leaders were among those who filed briefs on Anthropic's side.

On March 26, U.S. District Judge Rita Lin granted a preliminary injunction, writing that nothing in the governing statute supports "the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government." The Pentagon's chief technology officer replied that the designation remained in force. For every enterprise that buys AI, the case raised a question that will outlast the ruling: who decides what a model may be used for?

How a Contract Dispute Became a Blacklisting

The relationship began as a showcase. Claude Gov models had served national security users since March 2025, and Anthropic received a Top Secret facility security clearance after an 18-month vetting process, according to the court's order. In July 2025, the Pentagon's Chief Digital and Artificial Intelligence Office awarded it a two-year agreement worth up to $200 million.

The trouble started that fall, when talks about deploying Claude on the department's GenAI.mil platform ran into its demand for "all lawful uses" of the technology. Anthropic agreed, with two exceptions: mass surveillance of Americans and lethal autonomous warfare. The department's position, as quoted in the order, was blunt: "We will not let ANY company dictate the terms regarding how we make operational decisions."

Talks collapsed on February 27. President Trump directed federal agencies to "IMMEDIATELY CEASE all use of Anthropic's technology," and Hegseth posted that "no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic." Shortly afterward, OpenAI announced its own agreement with the department.

OpenAI's Deal and the Backlash

OpenAI said its agreement had "more guardrails than any previous agreement for classified AI deployments, including Anthropic's," enforced through a cloud-only deployment, its own safety stack and cleared OpenAI staff in the loop. Critics countered that the published language, which lets the department use the system "for all lawful purposes," left loopholes for surveillance.

Consumers reacted faster than lawyers. Sensor Tower data cited by TechCrunch showed US uninstalls of ChatGPT jumped 295% day-over-day on February 28. Claude reached No. 1 on the US App Store that day and still held the spot on March 2.

On March 2, OpenAI added language stating that its system "shall not be intentionally used for domestic surveillance of U.S. persons and nationals," and said the department's intelligence agencies, such as the NSA, were excluded. Sam Altman said the rush to sign had made the deal look "opportunistic and sloppy."

The amendment sharpened the contrast with Anthropic. "I am confused about why the Pentagon would accept this language when they just tried to nuke Anthropic for asking for something very similar to this," Charlie Bullock of the Institute for Law and AI wrote, as quoted by NBC News. Retired Gen. Paul Nakasone, an OpenAI board member, put it plainly: "This is not a supply chain risk."

The Designation Becomes Official, and Anthropic Sues

On March 4, the administration sent two formal letters designating Anthropic a supply chain risk under two statutes, Breaking Defense reported: 41 USC 4713, which covers the federal government as a whole, and 10 USC 3252, a streamlined process for the Defense Department. Such designations are typically reserved for foreign adversaries and require Pentagon contractors to certify they do not use the company's models, TechCrunch noted.

Anthropic read the letter narrowly. In a March 5 statement, Dario Amodei said it "plainly applies only to the use of Claude by customers as a direct part of contracts with the Department of War, not all use of Claude by customers who have such contracts." He added that the law requires "the least restrictive means necessary" to protect the supply chain.

The Pentagon framed the decision as a matter of command. The military "will not allow a vendor to insert itself into the chain of command by restricting the lawful use of a critical capability and put our warfighters at risk," it said, according to NPR. Amodei, for his part, pledged to keep providing models to the department at nominal cost for as long as a transition required.

On March 9, Anthropic filed two cases: a complaint in the Northern District of California and a petition in the D.C. Circuit Court of Appeals targeting the procurement-law designation. "The Constitution does not allow the government to wield its enormous power to punish a company for its protected speech," the California complaint reads.

The complaint also argued that "no federal statute authorizes the actions taken here" and that the department skipped procedures Congress requires, such as a risk assessment and a chance for the company to respond. TechCrunch reported that the General Services Administration had already terminated Anthropic's OneGov contract, ending its availability across all three branches of government.

Support came from unusual quarters, including employees of rival AI companies. A brief from retired military leaders warned that the government's actions "will materially detract from military readiness and operational safety." Another brief described the measures as "attempted corporate murder."

In Court: "Classic Illegal First Amendment Retaliation"

At the March 24 hearing in San Francisco, Judge Lin appeared skeptical of the government's case. "If the worry is about the integrity of the operational chain of command, [the Department of War] could just stop using Claude," she said, according to ABC News. "It looks like defendants went further than that because they were trying to punish Anthropic."

Deputy Assistant Attorney General Eric Hamilton argued that Anthropic might "manipulate the software" through a future update to control how the department used Claude. He could not say definitively whether Anthropic could even push such an update, and Lin called the government's standard "a pretty low bar."

Hamilton also appeared to contradict Hegseth's February post. "I'm not aware of any authorities that would permit DOW to categorically bar contractors from using a company's products or services for non-DOW work," he told the court.

Two days later, Lin granted the preliminary injunction in a 43-page order. It bars 17 federal agencies from implementing the president's directive, and the department and Hegseth from enforcing his directive and the designation, while the case proceeds. "Punishing Anthropic for bringing public scrutiny to the government's contracting position is classic illegal First Amendment retaliation," she wrote.

The order leaned on the government's own record. The department's records, Lin wrote, show it designated Anthropic a supply chain risk because of its "hostile manner through the press." She found the designation "likely both contrary to law and arbitrary and capricious," and said Anthropic's lack of notice or a chance to respond likely violated its due process rights.

Lin was careful about what the case is not. "It is the Department of War's prerogative to decide what AI product it uses," she wrote, and the injunction does not require the government to keep using Claude. She stayed the order for seven days to allow an appeal and set a nominal bond of $100.

The fight is not over. Pentagon CTO Emil Michael posted that the order contained "dozens of factual errors" and that the designation under the governmentwide statute remained "in full force and effect," arguing it falls outside the court's jurisdiction. Anthropic's D.C. Circuit petition on that designation was still pending.

Why the Case Matters Beyond Anthropic

The narrow legal question is retaliation; the larger one is control. The department holds that a buyer decides how to use what it buys, while Anthropic holds that a vendor may decline uses its product cannot safely support. Lin declined to settle that policy debate, but her order drew a line: the government may walk away from a vendor, not brand it an adversary for disagreeing.

The month also exposed two competing models for AI safeguards. Anthropic relied on contractual usage restrictions. OpenAI accepted "all lawful purposes" language but leaned on architecture: cloud-only deployment, its own safety stack and cleared staff in the loop. Which approach customers and regulators trust will shape how frontier models enter every sensitive industry, not just defense.

For AI vendors, the lesson cuts both ways. Publishing firm usage limits can build customer loyalty, as Claude's App Store surge suggested, but it can also invite retaliation from the most powerful buyer in the world.

Finally, the case showed how quickly AI vendor risk can become political risk. A tool designed for foreign adversaries was aimed at a domestic supplier within a day of a public disagreement, and companies from Microsoft to small developers had to assess their exposure. That is a new category of risk for any enterprise that builds on a single model provider.

What Enterprise Leaders Should Do Now

Most enterprises will never negotiate with the Pentagon, but the dispute previews pressures that can reach any regulated or public-sector supplier:

  • Inventory your models: Know which foundation models sit inside your products and your vendors' products, including those reached through partner platforms and cloud marketplaces.
  • Design for portability: Keep prompts, agent configurations and evaluation suites provider-neutral so a workload can move to another model in weeks, not quarters.
  • Read usage policies as contract terms: A vendor's acceptable use policy defines what you cannot do. Negotiate it explicitly for regulated and public-sector work.
  • Segment government workloads: Contractors should isolate federal contract work so a designation tied to one customer does not spill into commercial systems.
  • Track the litigation, not the headlines: The injunction is preliminary, stayed for a week and disputed in scope. Base compliance decisions on counsel's reading of the current orders.
  • Decide your own red lines: If a vendor's safeguards are part of why you chose it, document that, and know which vendors will accept your terms.

The goal is not to pick a side in Anthropic's dispute. It is to make sure a decision made in Washington, or in a vendor's boardroom, cannot strand critical workloads overnight.

Also in March

  • OpenAI launched GPT-5.4: The March 5 release, billed as "our most capable and efficient frontier model for professional work," set records on the OSWorld-Verified and WebArena Verified computer-use benchmarks and scored 83% on OpenAI's GDPval test.
  • The White House proposed a national AI framework: Its March 20 legislative recommendations urge Congress to preempt state AI laws that "impose undue burdens," to avoid creating a new federal AI regulator and to establish regulatory sandboxes.
  • A supply chain attack hit the AI stack: On March 24, the TeamPCP group published two compromised versions of LiteLLM, a popular library for routing calls across LLM providers, to PyPI with a credential stealer, following its March 19 compromise of the Trivy security scanner.

Looking Forward: The Limits of "Any Lawful Use"

March 2026 turned an abstract debate about AI safety into a concrete legal record. A federal judge found that the government likely punished a company for public disagreement, and the government signaled it would keep fighting.

Key developments to watch in the coming months:

  • The appeal: Whether the government seeks an emergency stay from the Ninth Circuit before the seven-day pause on Lin's order expires
  • The D.C. Circuit petition: A ruling on the governmentwide designation under 41 USC 4713, which Pentagon officials say remains in force
  • Contractor guidance: How defense contractors interpret certification requirements for Claude in practice
  • Other labs' terms: Whether other AI companies accept "all lawful use" language or seek safeguards like OpenAI's amended contract
  • Congress: Whether lawmakers clarify how supply chain risk authorities may be used against domestic vendors

January showed agents going autonomous, and February showed markets pricing what they could replace. March asked who gets to set their limits. The answer will shape AI procurement well beyond the Pentagon, and for now, a federal court has said that disagreement alone does not make a vendor a threat.

Sources

Related Articles

AI Strategy

June 2026: The 18 Days Washington Switched Off Anthropic's Most Capable Models

Anthropic launched Claude Fable 5 and Claude Mythos 5 on June 9, and on June 12 a Commerce Department export control directive forced it to switch both off for every customer worldwide. The 18-day shutdown, lifted on June 30 in exchange for new security commitments, showed that access to frontier AI now depends on policy as much as on product.

10 min read
AI Strategy

February 2026: AI Agents Trigger the SaaSpocalypse and a Software Reckoning

Anthropic's Cowork plugins, OpenAI's Frontier platform and Claude Code Security set off a month of steep selling in software, data and cybersecurity stocks. The rout was dubbed the SaaSpocalypse: a bet that AI agents will erode the per-seat licenses the software industry was built on.

10 min read