A three-judge panel in the U.S. Court of Appeals for the District of Columbia Circuit appeared divided on May 19 as Anthropic and the Defense Department (DOD) returned to federal court in their ongoing dispute over whether the DOD lawfully labeled the company a national security risk.
Under the Trump administration, the DOD was rebranded as the War Department.
The hearing marked the latest chapter in an ongoing battle between Anthropic and the DOD over the company’s restrictions on military uses of its AI models.
The dispute began after Anthropic refused to allow its systems to be used for mass domestic surveillance or fully autonomous weapons. President Donald Trump later ordered federal agencies to cut ties with the company, and Defense Secretary Pete Hegseth designated Anthropic a “supply chain risk,” a label typically associated with foreign national security threats.
Anthropic has filed two lawsuits alleging illegal retaliation, including a separate case in California where a federal judge temporarily blocked the designation in March.
Judges split over Pentagon authority
Two of the three judges pressed Anthropic attorney, Kelly Dunbar, on procedural issues and the scope of the court’s authority to review the DOD’s decision.
Judge Neomi Rao said she was skeptical of Anthropic’s legal arguments, saying, “this court can’t review designation decisions,” and could only decide whether future actions blocking the company’s products from government use were unlawful.
Rao also questioned whether judges should second-guess Hegseth’s national security assessment.
“I take the secretary to be making more general points … It’s about risk, and they say, ‘Well, based on what we know, we can’t trust that the AI model may not have something embedded within it that is going to create a problem for military capabilities,’” Rao said.
However, Dunbar argued that the Pentagon has continuously shifted its rationale for labeling Anthropic a supply chain risk. He claimed that the department initially claimed Anthropic had the technical capability to manipulate its AI systems after deployment, but later argued the company could manipulate models before deployment.
Yet, Judge Gregory Katsas questioned Anthropic’s argument that its products do not pose the risks identified by the Pentagon.
“AI three months from now will be totally different from current systems,” Katsas said, adding that he had “conceptual difficulties” with Anthropic’s position.
Dunbar argued that Anthropic was not trying to force the government to buy its products.
“If we, Anthropic, cannot convince the government that we are presenting a product to you that is transparent enough for you to accept the risks of its use, then you shouldn’t purchase it,” he said, arguing that the Pentagon’s designation went too far and had caused the company irreparable harm.
Judge Karen LeCraft Henderson appeared to agree with Anthropic’s position and repeatedly challenged the Pentagon’s justification.
“For the life of me, I do not see under the definition of any evidence of maliciousness,” Henderson said, referring to the government’s claim of Anthropic having “mal intent” and being untrustworthy.
“I don’t see that the department has in any way supported its determination that there is a supply chain risk with Anthropic, much less a significant supply chain risk,” Henderson said, further calling the designation a “spectacular overreach by the department.” She questioned whether officials had considered “less intrusive means.”
Justice Department attorney Sharon Swingle defended the Pentagon’s actions, arguing Anthropic retained the ability to interfere with the military’s use of its AI models in critical operations. She said the Pentagon’s concerns centered on whether Anthropic could impose undisclosed restrictions, or “red lines,” on military uses of its systems.
“In setting the guardrails, [Anthropic] made clear that there was a very real sense in which Anthropic did demand an operational veto,” Swingle said, arguing the company believed its interpretation of lawful use should override that of the DOD.
Anthropic argued that claims that the company could alter models’ post-deployment were “factually incorrect.”
Swingle also disputed Anthropic’s argument that the Pentagon could have used narrower measures – such as eliminating the contract – instead of the supply chain designation, saying an alternative memo or statement “would have been no less intrusive than what was done.”
The three-judge panel did not indicate when it would rule on Anthropic’s appeal, though the court is scheduled to reconvene on Friday, June 5. While the judges declined an earlier request from Anthropic to pause the designation, they agreed to expedite the case because of the potential impact on the company.
The D.C. Circuit’s earlier refusal to block the designation diverged from a federal judge’s ruling in California that temporarily barred the Pentagon from applying the label. If the courts ultimately reach conflicting conclusions, the dispute could set the stage for review by the U.S. Supreme Court.