There's a version of the AI-safety debate that assumes the biggest risk is a model doing too much — following a dangerous instruction it should have refused. On September 25, 2026, a federal appeals court endorsed the opposite framing, in a real legal ruling: Anthropic's Claude isn't banned from the Pentagon's supply chain because it's dangerous. It's banned because it's too careful to be fully trusted with military work — and a divided panel of the U.S. Court of Appeals for the D.C. Circuit said that reasoning is legally sound.
The ruling is the latest turn in a monthslong fight between Anthropic and what a 2025 executive order authorized the Pentagon to also call the Department of War — a secondary title for the Department of Defense, which Congress has not formally renamed. It lands at an odd moment: eight days after Anthropic disclosed that Claude already leads 26% of the R&D work building the next version of itself, and the same month five frontier-AI CEOs — including Anthropic's own Dario Amodei — publicly called for the industry to slow down. Here's exactly what the court decided, why, and what Anthropic says happens next.
Quick summary: On September 25, 2026, a 2-1 panel of the U.S. Court of Appeals for the D.C. Circuit upheld the Department of War's designation of Anthropic's Claude as a 'supply chain risk,' rejecting Anthropic's argument that the designation was arbitrary, unauthorized, and unconstitutional. The dispute traces back to Anthropic restricting Claude's use for mass domestic surveillance and fully autonomous weapons while still supporting other military and intelligence applications; the Department argued Claude's built-in refusals and contractual restrictions made it operationally unreliable, and the majority agreed that proving bad intent wasn't legally required for the designation to stand. Dissenting judge Karen LeCraft Henderson argued the underlying statute is aimed at intentionally subversive or deceptive conduct by hostile actors, not an openly disclosed, enforced policy. Anthropic says it disagrees with the ruling and is considering further review; notably, a different federal judge in California had already ruled the opposite way on a related Pentagon designation, setting that designation aside as unlawful on August 27, 2026 — an Anthropic win that shows the legal question isn't settled.
How a safety restriction became a 'supply chain risk'
The dispute traces to a position Anthropic has held publicly since at least February 26, 2026, when CEO Dario Amodei laid out the company's stance on military use of Claude: Anthropic would support intelligence analysis, operational planning, cyber-defense work, and other military and intelligence applications, but would not contractually authorize Claude for mass domestic surveillance or for fully autonomous weapons systems making lethal decisions without a human in the loop. Those are refusals built into how Claude is sold and used, disclosed openly as contract terms — not hidden behavior.
The Department's position, as the majority described it, wasn't that Claude is dangerous in the sense of doing something it shouldn't. It was closer to the reverse: a model that refuses certain categories of military tasking, with usage terms that could in principle change, introduces a form of operational uncertainty the Department doesn't want in its information-systems supply chain. The majority opinion held this was 'ample support' for concluding that continued integration of Claude presented a statutorily covered national-security risk — and, critically, that the statute doesn't require proving Anthropic acted with bad intent (Source: therundown.ai).
The dissent: a statute aimed at deceptive conduct
Judge Karen LeCraft Henderson dissented, and her objection cuts to why this ruling is being watched well beyond the AI industry: the underlying statute, in her reading, is aimed at deceptive interference with supply chains — hidden backdoors, concealed foreign influence, undisclosed sabotage — not a vendor's openly stated, contractually enforced restrictions on its own product. Treating a disclosed policy the same as concealed interference, in her view, stretches the statute past what Congress wrote it to cover. The majority didn't dispute that Anthropic lacked bad intent; it held the law simply didn't require proving any.
| Question | Majority view | Dissent (Judge Henderson) |
|---|---|---|
| Does intent matter? | No — statute doesn't require proving bad intent | Statute specifically targets deceptive interference |
| Is an open, disclosed restriction the same as concealed interference? | Sufficient grounds for the designation either way | No — openly enforced policy is not deceptive conduct |
| Outcome | Pentagon designation upheld | Would have ruled for Anthropic |
Timeline: how we got here
- February 26, 2026 — Anthropic CEO Dario Amodei publicly sets out Claude's military-use policy: support for most defense/intelligence work, refusal of mass domestic surveillance and fully autonomous lethal weapons.
- August 27, 2026 — A California federal judge sets aside a separate, related Pentagon supply-chain designation.
- September 25, 2026 — The D.C. Circuit panel upholds the Department of War's Claude designation, 2-1, in the case Anthropic had itself asked the court to expedite.
That August 27 ruling matters because it shows this isn't a single, uniform legal question with one obvious answer — a different federal judge, on a related designation, reached the opposite conclusion. That split is part of why Anthropic says it's considering further review rather than treating the September 25 ruling as final.
Why this matters even if you'll never buy Claude for the Pentagon
This case is a concrete test of an argument that's mostly been theoretical until now: can a model's safety behavior itself become the basis for excluding it from a market, separate from whether the model is good at its job? The court's answer, for now, is yes — a model can be excluded not for what it did wrong, but for being too consistently unwilling to do certain things at all. For any enterprise buyer weighing a vendor's safety commitments against a competitor with fewer guardrails, this ruling is a reminder that 'more cautious' and 'more trusted by every customer' aren't the same thing — and that the gap between them can become a legal fact, not just a product trade-off.
01Did a court rule that Claude is dangerous?
No — the opposite. The Department of War's own argument, which the court accepted, was that Claude's safety refusals and contractual restrictions make it operationally unreliable for its purposes, not that the model poses a safety danger itself.
02What was the vote, and who dissented?
It was a 2-1 decision by a panel of the U.S. Court of Appeals for the D.C. Circuit, issued September 25, 2026. Judge Karen LeCraft Henderson dissented, arguing the relevant statute targets deceptive interference, not openly disclosed contractor restrictions.
03What restrictions does Claude actually have on military use?
Per Anthropic's publicly stated February 2026 policy, Claude supports most intelligence and defense applications — analysis, planning, cyber-defense work — but Anthropic won't contractually authorize it for mass domestic surveillance or for fully autonomous weapons systems that make lethal decisions without human oversight.
04Is this the final word on Claude and the Pentagon?
Not necessarily. Anthropic says it disagrees with the ruling and is considering further review, and a separate federal judge in California had already set aside a related Pentagon designation on August 27, 2026 — so the legal picture isn't fully settled.
05Does this affect Claude for non-government customers?
No — this designation is specific to the Department of War's own supply chain. It doesn't restrict Claude's availability to businesses, developers, or consumers.
Whatever side of this debate you land on, it's a useful reminder that different AI labs draw their safety lines in genuinely different places — and those differences show up in how a model actually responds, not just in a policy document. LumiChats gives you access to more than 40 AI models, including Claude alongside models from OpenAI, Google, and others, so you can see firsthand how differently they handle a sensitive request rather than relying on any one company's framing of it.
