A federal judge has ruled in favour of artificial intelligence company Anthropic in its legal battle against the Pentagon after the government labeled the company as a supply chain risk earlier this year.

U.S. District Judge Rita Lin issued a written order Thursday night that the Pentagon acted illegally by punishing the AI company for its criticism of the Department of Defense’s views on AI use. The government is expected to fight the ruling.

The dispute between the AI company and the government broke out in February when U.S. President Donald Trump and Defense Secretary Pete Hegseth accused Anthropic of endangering national security and designated the company a supply chain risk. Anthropic CEO Dario Amodei refused to back down over concerns the company’s products could be used for mass surveillance or autonomous armed drones.

Lin wrote that the government’s actions “were based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticising the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model.”

An Anthropic spokesperson said in a statement that they welcome the judge’s ruling: “We remain focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology.”

The White House did not immediately respond to a request for comment.

In the 59-page ruling, Lin, an appointee of former U.S. President Joe Biden, wrote that neither the Constitution nor the federal statute the government invoked allows them to “impose sweeping penalties based principally on Anthropic’s critique of the Administration’s views.”

Anthropic sued the Pentagon over the supply chain risk designation in March for what it called an “unlawful campaign of retaliation” over its refusal to allow unrestricted military use of its technology.

The legal challenge intensified an unusually public dispute over how AI can be used in warfare and mass surveillance. Anthropic’s primary tech industry rival, ChatGPT maker OpenAI, made its own deal to work with the Pentagon just hours after the government punished Anthropic for its stance.

Anthropic and OpenAI are each ramping up for buzzy initial public offerings.

Anthropic has also filed a separate and narrower case that is still pending in the federal appeals court in Washington, D.C. That case involves a different rule the Pentagon is using to try to declare Anthropic a supply chain risk.

Earlier in the legal proceedings, Lin had temporarily blocked the Pentagon from labeling the company as a supply chain risk and blocked enforcement of Trump’s social media directive ordering all federal agencies to stop using Anthropic and its chatbot Claude.

In a hearing July 30, Lin had said that the government’s position was “really troubling” to her and that it seemed “at odds to me with the First Amendment.” She also said she believed the record had “gotten worse for the government” over time.

In that same hearing, Department of Justice lawyers argued that the nature of AI models is “so staggeringly enormous and opaque” that the Defense Department cannot evaluate it in the same way it would a physical piece of hardware.

Anthropic lawyer Michael Mongan said in that hearing that the government’s actions “profoundly harm Anthropic” and that they “threaten more broadly to chill speech and debate on a very important issue.”

Anthropic has also filed a separate and narrower case that is still pending in the federal appeals court in Washington, D.C. That case involves a different rule the Pentagon is using to try to declare Anthropic a supply chain risk.

Anthropic has spent the last year trying to get into an awkward position: close enough to the U.S. national security apparatus to be treated as a frontier supplier but far enough not to get burned. In one demonstration of this reputational yoga, it was revealed that the U.S. operation to abduct Venezuelan President Nicolas Maduro on January 3 used Anthropic’s AI model Claude.

More recently, Anthropic clashed with the Pentagon over safeguards to prevent fully autonomous weapons targeting and U.S. domestic surveillance. While Anthropic contended that these are non-negotiable limits, the Pentagon has held that commercial AI should be available for “all lawful purposes”. Even more recently, the Pentagon has been considering designating Anthropic a “supply chain risk” — a tag that could pressure contractors to certify that they’re not using Claude.

Why has Anthropic found itself in this bind?

In 2025, the company publicly embraced a larger defence footprint by announcing an agreement with the U.S. Department of Defence worth $200 million. It was a sign that Anthropic wanted to be the lab to say ‘yes’ to national security while still operating within limits, and in the process keep up a public reputation as a company that’s part of the military machinery. Anthropic has also been trying to present itself as an enterprise productivity company rather than as only a lab with a chatbot. Its partnership with Infosys, for instance, will pair its models with a firm that already sells compliance and governance services to industries that are heavily regulated.

Two ambitions

The reason for its bind is that a company that can claim to operate safely in government contexts with stringent security expectations can also plausibly sell itself to banks, manufacturers, and telecom companies. That is, to governments, Anthropic says, “We will help democratic states maintain a technological advantage, but we won’t accept deployments like autonomous targeting or expansive domestic surveillance”. As a result, it gets to say to enterprises, “We can operationalise frontier AI inside environments with strict compliance requirements”.

Unfortunately, these two ambitions have since collided. Anthropic appears to believe that conceding on autonomous targeting and domestic surveillance would destroy the line it has tried to draw with other frontier labs and entrants that are also courting defence customers.

The Pentagon, however, seems to be signalling that its vendors’ moral compunctions are beside the point, especially once the vendors are inside the defence supply chain.

The enterprise automation layer — i.e. the coding and agentic systems that allow Claude to be embedded directly within workflows rather than keep it as a chatbot that enterprises use in an ad hoc way — is still one of Anthropic’s main focus areas. And the company has also been trying to pitch its models’ safety features as an advantage because its logic seems to be, regulators and enterprises will prefer these models even when competitors develop more powerful alternatives. But this also means that if Anthropic yields to the Pentagon’s demand, it could lose its signature differentiation, whereas if it refuses, the Pentagon could make an example of it.

The fact is that while Anthropic can try to control how Claude is used, its control will weaken once Claude leaves the building. Anthropic can say “you may not use Claude for x” in the terms of service or train the model to refuse certain requests, but even then, large customers rarely use an AI model as a standalone chatbot. Instead, they access it through cloud platforms, embed it inside software tools like for data analysis and automation, and they adapt it for specific missions. In other words, customers can work around the terms of service and the question of Anthropic’s complicity still lingers.

In this sense, Anthropic’s recent decisions are probably coherent. It bet that a market nervous about AI — e.g. governments worried about adversaries or enterprises worried about liability — will pay a premium for a developer that can both deploy and restrain. And the dispute with the Pentagon is the first major demonstration of what it will cost Anthropic to do both at once.