A Judge Vacated the Pentagon's Anthropic Blacklist. The Designation That Actually Gates Procurement Is in a Different Court.
U.S. District Judge Rita F. Lin ruled on Thursday, August 27, that the Pentagon's decision to designate Anthropic a national security supply chain risk was unlawful. She vacated the designation, found the government violated the First Amendment by retaliating against a vendor for its public position, found a Fifth Amendment due process violation on top of it, called the action arbitrary and capricious under the Administrative Procedure Act, and barred the federal agencies named in the suit from enforcing the order to stop using Anthropic's tools. The coverage caught up on Friday and read, uniformly, as Anthropic wins.
It is a real win and I do not want to undersell it. It is also not the end of the blacklist, and the reason is that there have been two cases running in parallel since March. Thursday resolved one of them. The other one, the one filed under the statute the Pentagon actually used to shut off procurement, is still sitting undecided with a three-judge panel in Washington that already declined once to pause the designation.
If you are a buyer, a contractor, or a lab writing your own usage policy, that distinction is the whole story.
Two Courts, Two Statutes
Anthropic filed in two forums because the government moved on two tracks. Here is what each one controls.
| Forum | Legal hook | What it controls | Status |
|---|---|---|---|
| N.D. Cal. | 1A / 5A / APA | The cease-use order across the named agencies and the constitutionality of the motive behind it. | Won Aug 27. Appeal expected. |
| D.C. Circuit | 41 U.S.C. 4713 | The supply chain risk determination itself and the covered procurement actions that flow from it. | Argued May 19. No merits ruling. |
The Federal Acquisition Supply Chain Security Act of 2018 is the machinery. Section 4713 lets an agency head determine that a source presents a supply chain risk and then take exclusion and removal actions on that basis, with judicial review that is deliberately narrow. That is the lever the Defense Secretary pulled on March 3. The D.C. Circuit denied Anthropic's emergency stay in April, set argument for May 19, and heard the case before Judges Katsas, Rao, and Henderson. Reporting from the argument suggested the panel was skeptical of the Pentagon's reading of its own authority. Skeptical is not a holding. As of this morning there is no opinion.
The Timeline
| Date | Event |
|---|---|
| Feb 27 | Executive order directs all federal agencies to cease use of Anthropic products, with a six month phase-out for existing deployments. Hegseth announces the supply chain risk designation the same day. |
| Mar 3 | Section 4713 authority exercised. Covered procurement actions begin. GSA pulls Anthropic from USAI.gov and the Multiple Award Schedule. |
| Mar 26 | Judge Lin temporarily blocks enforcement of the cease-use order. |
| Apr 2 | The administration appeals. |
| Apr 8 | D.C. Circuit declines to block the Section 4713 designation pending full review. The two courts are now formally split on posture. |
| May 1 | DoD signs classified-network AI deals with seven other vendors. Anthropic is not among them. |
| May 19 | D.C. Circuit hears argument. No decision follows. |
| Aug 27 | Judge Lin vacates the designation on the merits and enjoins the named agencies. |
Run the arithmetic on the first row. A six month phase-out that starts on February 27 runs out at the end of August. The merits ruling landed in the same week the last existing deployments were scheduled to go dark. That timing is not a coincidence, it is a litigation schedule doing its job, and it is also the reason the practical effect of Thursday is smaller than it sounds: for six months the pipeline has been unwinding, and unwinding is easier than rebuilding.
What the Opinion Actually Says
The constitutional finding is the part that will get cited for years. Lin concluded the designation was driven by a desire to make a public example of the company rather than by any assessed risk, and wrote that the empty invocation of national security is not a blank check to punish and retaliate against government critics.
The evidentiary detail that did the most damage to the government was internal inconsistency. The same administration that labeled Anthropic a supply chain threat had also floated applying the Defense Production Act to the company. You do not invoke the DPA against a vendor you consider a security risk. You invoke it against a vendor you consider essential. The two positions cannot both be sincere, and the court said so.
For anyone who has watched procurement disputes get waved away with a classified-adjacent hand gesture, that is a meaningful line in the sand. National security review is deferential. It is not infinite.
The Money
Anthropic's own filings put the exposure in three tiers. CFO Krishna Rao stated the government's actions could reduce 2026 revenue by multiple billions of dollars. Hundreds of millions of that is direct DoD work. The larger number is the second-order hit: defense contractors and other DoD-dependent buyers that could not keep a designated vendor in their stack without inheriting the designation, with the company projecting losses in the 50 to 100 percent range from that cohort.
That second tier is the mechanism worth understanding, because it is what makes a Section 4713 designation function as a commercial death sentence rather than a lost contract. The designation does not only remove you from federal buying. It contaminates you for anyone who sells to the federal government, which in enterprise AI is most of the large accounts worth having. A prime with a $2 billion DoD portfolio does not litigate the merits of your designation. It rips you out on Monday.
Three Reasons Not to Call This Over
One, vacatur is not reinstatement. A court can void a designation. It cannot relist you on the GSA Multiple Award Schedule, restore an authority to operate, reverse the risk memo a prime's general counsel wrote in March, or un-migrate a workload that already moved to another vendor. Each of those is a separate administrative process with its own clock, and the federal ones do not run in days. The people who moved off Claude in the spring made a defensible decision under the information they had, and they are not going to move back on the strength of a district court order the government has said it will challenge.
Two, this is one judge and the appeal is not hypothetical. The administration appealed the March order within a week. There is no reason to think August gets different treatment, and the Ninth Circuit posture is a separate question from the D.C. Circuit posture, which means we could plausibly end up with three appellate answers to roughly the same question. That is a live circuit split forming around whether a national security label can be applied for a stated non-security reason, and it is exactly the kind of thing that ends up somewhere higher.
Three, the chilling effect already worked and the ruling does not undo it. This is the argument I keep coming back to. Put yourself inside a competing lab in March 2026, watching a peer get designated for refusing two specific use cases. The lesson you take is not hold your red lines and you will be vindicated in eighteen months. The lesson is that holding your red lines costs you multiple billions in forecast revenue, six months of unwinding, two federal cases, and a year of legal spend, and you will maybe get most of it back. A win that arrives six months late and is still under appeal does not restore the incentive. It documents the price.
Our Take
Back in May we wrote that the Pentagon skipping Anthropic while signing seven other vendors was the first case of a frontier lab being punished for enforcing its own safety terms, and that the real question was whether safety-as-product survives contact with a customer that can designate you. Thursday is the first serious answer, and it is better than I expected: a federal judge looked at the file, found the security rationale pretextual, and said so in language that will be quoted in every future procurement retaliation brief.
But the answer is narrow. What got vindicated is the right to say no in public without being punished for the saying. What did not get resolved is whether the specific statute the government used to execute the punishment was applied lawfully, and that question belongs to a panel that has been sitting on it since May. Until the D.C. Circuit rules, Anthropic's federal position is a legal victory sitting on top of an unresolved administrative fact, and those are not the same asset.
The broader read for the industry is about pricing. Every lab now has an actual number for what a hard usage policy costs when the counterparty is the U.S. government: call it a multi-billion dollar revenue hole, six months of pipeline decay, and a two-forum legal fight with no clean ending after six months. Anthropic paid it and can afford to. A Series C lab could not. That asymmetry is the durable outcome of this episode, and no ruling fixes it.
What I Am Watching
One, whether the D.C. Circuit issues its Section 4713 opinion inside 30 days now that the district court has moved. Panels do not like being the last word outstanding on a question a coordinate court has answered loudly, and the argument was three months ago. If that opinion goes Anthropic's way, the designation is genuinely dead. If it goes the other way, we have a split and Thursday shrinks considerably.
Two, whether Anthropic returns to the GSA Multiple Award Schedule and USAI.gov, and how many weeks it takes. That is the only observable that tells you whether a vacatur converts into procurement access, and it is a cleaner signal than any statement either side puts out. Relisting is the scoreboard.
Three, whether any other frontier lab publishes or tightens a comparable red line inside 90 days. If the ruling actually changed the calculus, somebody else takes the position now that the retaliation cost has been litigated. If nobody does, then the chilling effect held and the case was a personal win for one company rather than a structural one for the field. Provider-level model availability and pricing shifts, including anything that shows up as a government-specific tier, is what we track on the models tracker, and a return to federal buying usually announces itself there before it announces itself anywhere else.