Six months of a federal vendor ban ended on a Thursday night, in a 59-page order. Judge Rita Lin vacated the supply chain risk designation the Department of War hung on Anthropic back in February, and stacked a permanent injunction on top of the vacatur. The reasoning is the part worth your attention, and it is not really about one AI company. The Pentagon had reached for 10 U.S.C. § 3252, the statute that lets it push out a vendor when an adversary might sabotage a covered system. The court went and read the words. Sabotage, subvert, maliciously introduce unwanted function. Covert acts, all of them. None of which describes a supplier that publicly refused the government's preferred contract terms and said so out loud.
The short answer
Judge Rita Lin vacated the Pentagon supply chain risk designation on Anthropic and added a permanent injunction, holding the Department to what it could lawfully do before 27 February. The core finding is statutory: a supply chain risk means covert sabotage, not a vendor whose usage policy said no in public. It does not compel anyone to buy anything, and Washington is still live.
The order does two different things
People keep collapsing them into one. They aren’t.
The vacatur wipes the acts themselves. Secretary Hegseth’s 27 February directive and the supply chain risk determination that followed on 4 March stop existing as legal acts, rather than sitting on the books unenforced. The permanent injunction then binds the Department going forward, holding it to whatever was lawfully available to it before 27 February.
Notice what that second half is not. It is not an order to sign anything. Restoring a vendor’s eligibility and awarding that vendor a contract are separate events, and the roughly $200 million of work that reportedly evaporated in January is not coming back through this door. Agencies can still pick a different model tomorrow for entirely boring reasons. Honestly, that’s the bit I expect to get lost in the coverage, because “company beats Pentagon” is a much cleaner sentence than “company is once again allowed to bid”.
The statute is the whole ballgame
Here is the part that outlives the case.
The Department leaned on 10 U.S.C. § 3252, the authority to exclude a source on supply chain risk grounds. Subsection (d)(4) defines that risk as an adversary who may “sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system. Read the verbs. Every one of them describes something done quietly, by someone pretending to be a normal supplier.
Anthropic’s conduct was the opposite of quiet. It said in public that Claude would not be available for lethal autonomous weapons or mass domestic surveillance, it declined the “all lawful purposes” terms the Department wanted, and the ban arrived shortly after. At the summary judgment hearing on 30 July the government argued that AI is different: models are opaque, a vendor can bake corporate moral judgment into the weights, and trust in the supplier is therefore part of the security question. It’s not a stupid argument. It just isn’t what the statute says, and the court declined to stretch the text to fit it.
The record did the rest of the work. Lin wrote that the government’s actions “constituted unlawful retaliation in violation of the First Amendment”, and that they “were based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model”. She also had a line ready for the national security framing: “The empty invocation of national security is not a blank check to punish and retaliate against government critics.”
What sank the government was its own behaviour after the label went on. It kept pursuing contracts with the supplier it had just called a national security risk, including collaboration on the Mythos model, the same one we looked at when the story went round that it had hacked the NSA. You cannot really tell a judge that a vendor might sabotage your systems while asking that vendor to help defend them.
What it doesn’t settle
Quite a lot, actually.
There’s a second case, in the D.C. Circuit, docket 26-1049, running on the FASCSA exclusion track rather than the § 3252 one. Anthropic was denied an emergency stay there back in April and the appeal is unresolved. So the sentence “the ban is over” is true for the California claims and shaky everywhere else.
Then there’s the appeal. This is one district judge, in one district, on one summary judgment record. The government has not said publicly what it plans to do, and if it goes up, this could run a long way. Anyone treating a 59-page N.D. Cal. order as a settled rule for federal AI procurement is getting ahead of the paperwork.
If you buy or sell software, this is the useful bit
Strip the politics out and a procurement question is left over, one that turns up in ordinary commercial deals constantly: is a vendor’s acceptable use policy a term you negotiate, or a loyalty test you pass?
A large customer asked for unrestricted use. The supplier said no, in writing, in public. In most industries that’s a Tuesday, and the deal either closes on amended terms or it doesn’t. What made this unusual is that the customer had a statutory hammer lying around and swung it. The court’s answer is narrow but clear enough to plan around: the hammer is for sabotage, and a published usage policy is speech, not a threat.
If you sell to government, the practical read is that your usage policy belongs in the term sheet from day one, argued as a commercial restriction, because a customer who treats it as disloyalty has now lost that argument once. If you buy, an “all lawful purposes” clause is a real ask and vendors are allowed to refuse it without becoming a security incident.
I might be wrong about how far this travels. It’s one order, it’s appealable, and the political weather around AI procurement changes faster than litigation does. But the statutory reading is the durable piece, and it will get cited. Anthropic has had a busy year in court either way, between this and the $1.5B copyright settlement, and none of it has much to do with the models.
Sources
Ruling coverage: TechCrunch, Fortune for the 59-page count and the “arrogance” passage, Forbes and NPR. Claim by claim breakdown of the opinion and the § 3252(d)(4) reading: Techdirt. The 30 July summary judgment hearing: a hearing diary from the courtroom. Case number, docket and the 27 August termination entry: the CourtListener docket for 3:26-cv-01996, checked by us on 30 August 2026.
Frequently asked questions
What did the court actually decide on 27 August 2026?
In Anthropic PBC v. U.S. Department of War, case 3:26-cv-01996 in the Northern District of California, Judge Rita Lin issued a 59-page order vacating the supply chain risk designation and the 27 February directive behind it, and granting a permanent injunction. Anthropic won on First Amendment retaliation, on Fifth Amendment pre-deprivation process, and on the Administrative Procedure Act. Its ultra vires claim failed. The docket shows the civil case terminated the same day.
Does this force federal agencies to buy Anthropic products again?
No, and that is the most common misreading. Vacatur erases the designation, and the injunction holds the Department to whatever was lawfully available to it before 27 February 2026. Restoring eligibility is not the same thing as awarding a contract. Agencies remain free to buy from whoever they like, on ordinary procurement grounds.
What is 10 U.S.C. § 3252 and why did it matter so much?
It is the defence procurement authority that lets the Department exclude a source over supply chain risk. Subsection (d)(4) defines that risk as an adversary who may sabotage, maliciously introduce unwanted function, or otherwise subvert a covered system. The court read those verbs as covert conduct. A vendor refusing an all lawful purposes clause in public is the opposite of covert, so the label did not fit the statute.
Is the dispute over?
Not yet. A separate case sits in the D.C. Circuit under number 26-1049, on the FASCSA track, and Anthropic was denied an emergency stay there in April. The government can also appeal the California order, and several observers expect it to. This is one district judge on one record, not settled appellate law.
Why does a procurement ruling matter to anyone outside defence contracting?
Because the fight was about a usage policy. The Department wanted Claude available for all lawful purposes, Anthropic kept restrictions on lethal autonomous weapons and mass domestic surveillance, and the ban followed. The order treats that refusal as protected speech rather than evidence of untrustworthiness, which lands squarely on any vendor whose acceptable use policy is a live negotiating point with a customer.