The government called it supply chain risk. The court called it punishment for talking. On Thursday, Judge Rita F. Lin of the Northern District of California struck down the Defense Department’s blacklist of Anthropic on three independent grounds — First Amendment retaliation, Fifth Amendment due process, and arbitrary-and-capricious action — and permanently barred the government from giving it effect. The designation, premised on Claude capabilities the product did not actually have, is dead. The template for how a lab fights back is very much alive.
A Blank Check, Rejected
The ruling’s spine is the retaliation finding. The Pentagon’s rationale, the court found, rested largely on Anthropic’s public criticism of the administration’s AI positions — and a federal agency cannot dress up the punishment of speech as procurement hygiene. Judge Lin rejected the government’s national-security framing as a “blank check” to penalize critics: if citing national security were enough, every agency could blacklist every company that disagreed with it, and the First Amendment would have a procurement exception. It does not.
The other two grounds make the holding durable rather than lucky. Due process: the designation carried real consequences and issued without adequate pre-deprivation process — the company was condemned before it was heard. Arbitrary-and-capricious: the factual predicate was false, because the cited Claude capabilities did not exist in the product. Any one of the three might have carried the day. All three together read like a court building a wall with three load-bearing walls, so that no single appeal knocks it down.
What the Order Does Not Do
Read past the headlines and the order is narrower than the victory lap suggests. It does not require the Defense Department to buy anything from Anthropic. It does not resolve the underlying dispute over AI safeguards that escalated into the blacklist in the first place. What it does is establish that the mechanism — punishing a lab through procurement power for its public positions — is unconstitutional when built on retaliation, process failures, and false predicates. The government lost the weapon, not the argument. The argument remains open, and it will be had in publications and comment letters and, if necessary, the next courtroom.
The industry watched with a different kind of attention. OpenAI and DeepMind employees had filed amicus briefs in the underlying dispute — a quiet, unprecedented show of inter-lab solidarity against state coercion. The détente between the labs and the government has been fraying all year; this ruling converts the fraying into case law. Every lab now has a template: document the false predicates, litigate the retaliation, and let the court say the quiet part — that “national security” is not a license to punish speech.
The government lost the weapon, not the argument.— What the order actually holds
The Week in Uniforms
Set the ruling beside this week’s other supply-chain story and the shape of the era comes into focus. OpenAI cut off Cursor because of who bought it — a lab punishing a customer’s choice of owner. The Pentagon blacklisted Anthropic because of what it said — a state punishing a lab’s choice of words. One is market power wearing terms of service; the other is state power wearing procurement policy. Both are the same fact in different uniforms: intelligence supply has become a theater of power, and everyone in it — labs, customers, governments — is now a combatant or a case.
For the labs, the lesson is that courts will hold the line on process but not necessarily on policy — the First Amendment protects the criticism, not the contract. For the government, the lesson is that false predicates are discoverable and fatal. And for everyone building on frontier models, the lesson is the one this desk keeps returning to: the supply chain is the story now. The models are becoming infrastructure, and infrastructure has politics. This week, the politics got a docket number and a blog post. Next week, it gets more of both.
What This Means
- The blacklist is dead on three independent grounds. Retaliation for protected speech, denial of due process, and a false factual predicate — the cited Claude capabilities did not exist. Enforcement is permanently barred.
- A legal template now exists for every lab. Document the false predicates, litigate the retaliation, and the “blank check” of national security stops at the courthouse door.
- The order compels nothing — and that is the point. The court set aside the punishment without picking the vendor. The underlying safeguard dispute remains open, now inside a constitutional frame.
The blacklist died in court on a Thursday. What was born there is older and harder to kill: the principle that the state’s purchasing power is not a gag order. The labs noticed. So did the procurement officers. Nothing about the argument was settled — but the weapon is gone, and everyone can see who is holding what.