Everything About AI
NextFin News - Anthropic PBC has asked the full U.S. Court of Appeals for the District of Columbia Circuit to rehear its case against the Department of War, elevating a single statutory phrase into the next major battleground over who controls how artificial intelligence systems may be deployed. On Tuesday, October 13, 2026, the San Francisco-based AI developer petitioned for rehearing en banc after a three-judge panel upheld, 2-1, the government's designation of the company as a supply-chain risk to U.S. national security.
The petition asks the circuit's active judges to reconsider a September 25, 2026 ruling in which Judges Gregory Katsas and Neomi Rao held that the Department could exclude Claude from defense procurement under the Federal Acquisition Supply Chain Security Act of 2018, even though Anthropic's restrictions on the model were deliberate safety choices rather than evidence of foreign compromise or sabotage. Judge Karen LeCraft Henderson dissented, arguing the majority read the statute's catchall language too broadly.
Anthropic's filing frames the question in stark terms: the majority, the company argues, allowed the Defense Department to act "without any pre-designation process and despite straightforward evidence the designation was retaliation for Anthropic's speech about AI safety." The outcome will decide not only whether Anthropic regains access to Pentagon contracts, but whether a domestic AI developer's published usage policy can itself be treated as a national-security defect — a precedent that would reach every AI vendor selling to the U.S. government.
The Core Dispute: When Safety Restrictions Become a Security Risk
The conflict traces to February 27, 2026, when Secretary of War Pete Hegseth announced on X that he was directing the Department of War to designate Anthropic a supply-chain risk. In a statement the same day, Anthropic said the action followed months of negotiations that reached an impasse over two exceptions it requested to the lawful use of Claude: "the mass domestic surveillance of Americans and fully autonomous weapons." The company said it supported "all lawful uses of AI for national security aside from the two narrow exceptions above," and that the exceptions had not affected a single government mission to date.
On March 4, 2026, the Department formally notified Anthropic of the determination, and on March 9, 2026, the company filed a petition for judicial review in the D.C. Circuit under 41 U.S.C. § 1327, the review path Congress wrote into FASCSA. Anthropic also challenged a separate designation issued under 10 U.S.C. § 3252, which applies only to the Pentagon's national-security systems, in federal court in the Northern District of California.
That split in statutory authority produced a split in outcomes, and the divergence is the key to understanding where the case stands. On August 27, 2026, Judge Rita F. Lin in California ruled for Anthropic on the Section 3252 designation, and that ruling remains in force. But the D.C. Circuit panel's September 25 decision left the FASCSA designation standing, creating a litigation posture in which Anthropic has won one statutory fight and lost another over essentially the same conduct.
The practical consequence is narrow but severe: the FASCSA order remains an active compliance requirement for government contractors. Primes and agencies must continue to treat Anthropic products as excluded from covered procurements, even though commercial access to Claude, Claude Code, and the company's API is unaffected for private users. A defense contractor using Claude Code internally, or embedding a Claude model in a deliverable, now faces a certification question that did not exist in February 2026.
The procedural history shows how quickly the case moved. On April 8, 2026, the court denied Anthropic's emergency motion for a stay pending review of the Secretary's determination, emphasizing that it would not lightly override the Department's national-security judgments during an active military conflict. The court noted the "relatively contained risk of financial harm to a single private company" against the burden of "judicial management of how, and through whom, the Department of War secures vital AI technology during an active military conflict." The court did grant expedition, setting oral argument for May 19, 2026, before the same three judges who had rejected the stay.
What the Panel Decided: A Broad Reading of FASCSA
The majority's holding turned on the statutory definition of "supply chain risk" in 41 U.S.C. § 4713. The court concluded that FASCSA focuses on the potential for a supplier's actions to deny, disrupt, or limit functionality the government deems operationally necessary — not on whether the supplier is a foreign adversary or acted with hostile intent.
That reading detaches the designation power from the statute's origin story. FASCSA was enacted in 2018 to keep compromised or hostile suppliers out of federal systems, a response to concerns about foreign adversaries embedding backdoors in information and communications technology. Section 4713(k)(6) defines a supply-chain risk to include any source of risk that may result in a disruption of function, or a malicious activity, that reduces the security or resiliency of a system — language broad enough, the majority held, to cover a vendor that has trained its model to refuse certain tasks.
The panel's interpretation extends the statute beyond its original target: a domestic provider whose technology restrictions conflict with government operational requirements, even where no sabotage, data extraction, or malicious modification is alleged. For government contractors, the practical effect is that the FASCSA designation remains in force and agencies may continue requiring compliance with related restrictions, certifications, reporting obligations, and removal directives applicable to covered procurements.
Legal analysts at Womble Bond Dickinson summarized the shift bluntly: the D.C. Circuit's interpretation "potentially expands FASCSA from a tool traditionally associated with hostile or compromised suppliers into a mechanism that can be used against domestic providers whose technology restrictions conflict with government operational requirements." That expansion is the heart of what Anthropic now asks the full circuit to undo.
Anthropic's Argument: Retaliation, Not Risk
Anthropic's petition for rehearing en banc argues the majority misread the catchall in § 4713(k)(6). The company's position, echoed by the Center for AI and Digital Policy, is that "otherwise manipulate" must be read alongside the specific forms of harmful conduct Congress identified in the surrounding provisions — hostile or integrity-threatening interference with information and communications technology, not a developer's disclosed limitations on the purposes for which its system may be used.
The Center for AI and Digital Policy, which is preparing an amicus brief supporting rehearing en banc, puts the point in technical terms: restrictions intentionally designed to prevent specified uses of an AI system are different from malicious modification, sabotage, or data extraction. Determining whether an AI safeguard constitutes a security vulnerability requires distinguishing intentional system design from compromise or interference. The Center does not argue that the Department must purchase or deploy Claude; federal agencies retain substantial authority to decide whether a product satisfies operational requirements. The narrower question is whether Congress authorized the government to characterize disclosed safety safeguards as a statutory supply-chain risk.
Anthropic also presses a First Amendment theory. The company contends the designation was retaliation for its speech about AI safety — a public position that has been central to its brand and its investor pitch since its founding. If the government can brand a company a national-security threat because it publicly refused to build or enable certain capabilities, the designation becomes a penalty on speech rather than a neutral procurement judgment. The company's February 27 statement called the designation "an unprecedented action — one historically reserved for U.S. adversaries, never before publicly applied to an American company."
The Counter-Thesis: Operational Control Is a Legitimate Security Concern
The government's strongest argument is not that Anthropic is hostile, but that a defense department cannot be forced to rely on a model whose behavior it cannot direct in a conflict. If the Pentagon cannot guarantee that Claude will execute a lawful task because the vendor has hard-coded a refusal, then from the military's perspective the supplier has introduced an uncontrollable node into the supply chain. The designation is less about espionage than about operational dependency.
This view has real force in wartime procurement. A supplier that can unilaterally disable functionality the government has paid for is different in kind from a supplier that merely delivers a defective part. The majority's reading gives agencies a tool to reject that dependency without proving foreign sponsorship or malicious intent — a lower evidentiary bar that procurement officials argue is necessary when the technology in question can shape targeting, intelligence, and logistics decisions.
The D.C. Circuit's April 8 stay denial foreshadowed this reasoning. The court's reluctance to intervene before the merits ruling reflected a judicial instinct to defer to executive national-security judgments during an active conflict. That same instinct runs through the September 25 majority opinion: when the choice is between a private company's financial harm and the Department's control over how it secures AI technology in wartime, the court leaned toward the Department.
But the counter-thesis has a limit, and it is the limit Anthropic's petition presses. FASCSA already gives agencies broad authority to decide whether a product satisfies operational requirements. The narrower question is whether Congress authorized the government to brand disclosed safety safeguards as a statutory supply-chain risk, with the stigma and exclusion that label carries. Treating a published usage policy as a security defect creates a perverse incentive: developers who are transparent about what their systems will not do are penalized more heavily than developers who stay silent and negotiate restrictions behind closed doors.
Second-Order Effects: The Incentive to Hide Safety Constraints
The second-order consequence is the one the market is not pricing in. If a vendor's disclosed safeguards can be weaponized as evidence of a supply-chain risk, the rational response is not to remove safeguards — it is to stop disclosing them. Developers may keep the same restrictions but describe them in vague terms, move them into confidential contract schedules, or decline to publish model cards that explain refusal behavior. Transparency, in other words, becomes a liability.
That dynamic cuts against the stated goals of both AI-safety advocates and procurement-security officials. Safety researchers want developers to document constraints so risks can be audited. The government wants to know what it is buying. A rule that punishes disclosure pushes both objectives underground, where neither auditors nor contracting officers can see the constraints until a failure occurs. The Center for AI and Digital Policy warns that treating disclosed safeguards as evidence of a national-security threat "could discourage developers from adopting, maintaining, or explaining safety protections."
There is also a competitive asymmetry with real market consequences. Large, well-counseled developers can absorb the cost of a designation and litigate through en banc review and the Supreme Court. Smaller AI firms cannot. The result may be a defense AI supply chain dominated by vendors willing to accept broad government use clauses, or by vendors with enough balance-sheet depth to fight the government in court for years. Either way, the designation power functions as a barrier to entry, and barriers to entry in a nascent market are a structural feature, not a temporary distortion.
For investors, the exposure is concentrated but visible. Anthropic is privately held, so there is no direct equity to repric. But the ruling affects any public company whose products depend on large-model APIs for government-facing workloads, and any defense prime whose proposals embed commercial AI. The compliance burden — identifying direct and indirect uses of Anthropic technology, evaluating the scope of certifications requested by customers or primes — is a real cost line that did not exist before February 2026.
Is This Cyclical or Structural?
The right read is that the designation itself is cyclical — a policy choice by one administration that a future administration could reverse through ordinary agency action — but the legal precedent, if it stands, is structural. A reversal at the agency level would restore Anthropic's access to contracts without touching the statutory interpretation. Only a court ruling can undo the broader reading of FASCSA, and a D.C. Circuit precedent would bind future panels and shape how other agencies use the statute.
This distinction matters for anyone trying to forecast the outcome. If the case is decided on narrow, administration-specific grounds, the risk reverts when the political winds shift. If it is decided on statutory scope — as the September 25 opinion did — the risk persists across administrations and reaches beyond Anthropic to any vendor whose usage policy conflicts with a future government's operational requirements. The panel chose the structural path. Anthropic's rehearing petition asks the full circuit to pull the case back to the cyclical one.
What Comes Next
Rehearing en banc is an exceptional procedure, generally granted only for questions of exceptional importance or to maintain uniformity in the court's decisions. A divided panel with a reasoned dissent on a question of statutory scope is a plausible candidate, but most petitions are denied without comment. Under D.C. Circuit Rule 40(f), amicus briefs supporting a rehearing petition are filed only by court invitation; the Center for AI and Digital Policy has said it plans to request an invitation to file one supporting Anthropic.
If the full circuit declines rehearing, Anthropic's remaining path is a petition to the Supreme Court. Either route is slow, and neither is likely to be resolved quickly. In the near term, the FASCSA designation remains in force, and contractors should continue to treat Anthropic products as excluded from covered federal procurements.
The timeline to watch is straightforward. The D.C. Circuit will first decide whether to grant rehearing en banc. A denial leaves the September 25 panel opinion as the law of the circuit. A grant would vacate that opinion and set the case for rehearing before the court's active judges, resetting the clock on a dispute that has already run from February through October 2026 without a final resolution.
Outlook and Scenarios
Short term: the designation stands. Government contractors face an unchanged compliance burden, and Anthropic's exclusion from Department of War procurement continues regardless of the commercial availability of Claude. The en banc petition itself changes nothing operationally.
Medium term: the en banc decision is the inflection point. If the full circuit grants rehearing, the statutory question — whether safety restrictions can constitute a supply-chain risk absent hostile intent — gets a second, potentially more careful airing. If it declines, the panel's broad reading of FASCSA becomes circuit precedent and invites Supreme Court review. The falsifying signal for the view that this precedent will expand: if other agencies begin issuing FASCSA designations against domestic software vendors over usage-policy disputes within the next six to twelve months, the D.C. Circuit's reading has become a working tool, not an outlier.
Long term: the case will shape how AI developers write usage policies. A ruling that treats disclosed safeguards as security defects pushes restrictions into confidential schedules and discourages the transparency that safety audits depend on. A narrower reading preserves agencies' ability to reject products that do not meet operational needs while leaving developers free to publish safety constraints without being branded a national-security threat. The base case is continued limbo: rehearing denied, Supreme Court review uncertain, and the designation in place through at least 2027.
"The majority incorrectly interpreted the law by allowing the Defense Department to take action without any pre-designation process and despite straightforward evidence the designation was retaliation for Anthropic's speech about AI safety," Anthropic said in its petition for rehearing en banc.
The central judgment: this is less a fight about whether the Pentagon can exclude a vendor — it clearly can, on operational grounds — than about the legal label the government must use. If a safety policy can be recharacterized as a supply-chain defect, the cost falls not on Anthropic alone but on every developer deciding whether to publish the next model's red lines.
Explore more exclusive insights at nextfin.ai.
