United States District Judge Rita Lin blocked the Defense Department from enforcing its designation of Anthropic as a supply-chain risk on Thursday. The order runs 59 pages and came out of the Northern District of California. The designation had shut the company out of military contracting. Lin found the department used a rarely invoked procurement statute to answer the company's public criticism.
A federal agency's power to brand a private firm a national-security risk now carries a court-drawn boundary, and the boundary is the First Amendment.
The dispute began in late February. Secretary of War Pete Hegseth asked Anthropic to remove safety restrictions from its Claude models. Chief executive Dario Amodei declined, citing autonomous weapons and domestic surveillance. President Trump then directed federal agencies to stop using the company's services, and the supply-chain designation followed. Federal courts have spent this year sorting how far executive discretion reaches into contracting, personnel and licensing decisions. This is that question running through procurement law.
- The order bars named federal agencies from enforcing the president's directive.
- Anthropic reported $11.5 billion in second-quarter revenue, roughly 14 times a year earlier.
- A second supply-chain designation against the company awaits a separate ruling.
Lin sits in San Francisco. Hegseth runs the Department of War. Amodei runs Anthropic. The ruling reaches contractors who criticize the agencies that buy from them, federal employees whose offices dropped the company's tools mid-project, and service members whose units were told to stop using them. Every regulated firm that sells to Washington now has a district-court reading of how far a security label can travel.
Disputedwhether the supply-chain designation was a security judgment or a penalty for speech.
The FramingsAdministration framing presents the designation as ordinary supply-chain discretion — the department decides which vendors it trusts with classified workloads, and a vendor that withholds the mission is a risk by definition. Pentagon-security framing narrows that: a model provider that limits capabilities during a war is an operational dependency the services cannot carry. Company framing presents the designation as retaliation for protected speech, pointing to the sequence from Amodei's refusal to the president's directive to the label. AI-safety framing reads the case as a test of whether a developer may enforce its own use restrictions and keep access to the federal market. Defense-industry framing sets this vendor aside and looks at precedent: if criticism can trigger a security label, every contractor's compliance office reads it as a speech rule.
The RecordLin's 59-page order is the document. She wrote that "the empty invocation of national security is not a blank check to punish and retaliate against government critics," and barred enforcement against named agencies. The department did not comment. Anthropic said it welcomed the ruling. Confidence in the order's contents: certain. Confidence in it surviving appeal: low.
What to watch: whether the government files a notice of appeal to the Ninth Circuit within the 60 days it has; the ruling in the second supply-chain designation case now pending; whether any agency restores the company's tools before that ruling lands.
Sources: Al Jazeera, CNBC, Engadget, Forbes, The Washington Post, U.S. District Court for the Northern District of California
