Why Anthropic Refused the Pentagon: Inside Dario Amodei’s Decision to Keep Two AI Safeguards

On February 26, 2026, Dario Amodei published a statement that turned a months-long contract negotiation into a public test of corporate resolve. The Pentagon wanted Anthropic to accept a single clause allowing Claude to be used for any lawful purpose. Amodei said the company “cannot in good conscience accede” to the request, and he named the two uses it would not support.

The Anthropic Pentagon decision can be read as a story of principle meeting power. It is more useful as a business problem. Anthropic was selling an AI model to the military and the intelligence community, under a contract worth up to $200 million, while insisting on limits its customer saw as an intrusion on its authority. Refusing put the contract at risk, and then something larger: the company’s standing across the federal supply chain.

Eight months on, the question behind Dario Amodei’s standoff with the Pentagon is still open. Can an AI company keep control over how its technology is used when its most important government customer demands broader access in the name of national security? Two federal courts have examined the dispute under different laws and arrived at different answers.

How did Anthropic end up inside the Pentagon’s systems?

According to the D.C. Circuit’s account of the record, the Department of Defense and the intelligence community began using commercially available Claude models in classified systems in 2024, working through contractors. The early experience was awkward. Claude, trained to decline certain requests, refused tasks that made sense in a national-security setting, including summarizing threat assessments and processing classified documents.

Anthropic’s answer was a specialized model, Claude Gov, released in March 2025, along with a government addendum to its usage policy that permitted uses it would not allow ordinary customers. Anthropic came to let the Department use Claude to design weapon systems, analyze foreign intelligence and conduct offensive cyber operations. In his February statement, Amodei described Anthropic as the first frontier AI company to deploy models on classified government networks. In July 2025 the Pentagon included the company in an AI contract worth up to $200 million, which is a ceiling, not revenue Anthropic had booked.

Two restrictions survived every round of loosening.

What did the Pentagon ask for, and what did Anthropic refuse?

The talks that began in the fall of 2025 were meant to put the relationship on a direct contract and expand it. The Department asked for permission to use Claude for “all lawful uses.” By the court record’s account, Anthropic agreed to relax its restrictions substantially, but not on two points.

The first was mass domestic surveillance of Americans. Amodei’s position was that, to the extent such surveillance is legal today, that reflects a law that has not caught up with what AI can do. The second was fully autonomous weapons, meaning systems that select and engage targets with no human in the loop. He did not argue that such weapons should never exist. He wrote that they might one day matter to national defense, but that today’s frontier models are not reliable enough to be trusted with them.

The Pentagon’s side was policy, not improvisation. On January 9, Defense Secretary Pete Hegseth issued an AI strategy directing that contracts carry standard any-lawful-use language. The Department’s position was that legality is the end user’s responsibility, not the vendor’s.

The distinction matters. The government was not asking Anthropic to break the law, and Anthropic was not refusing the military. The disagreement was about who holds authority at the edge: whether legality, as the government defines it, is the only test a vendor may apply. Anthropic’s answer was that legality alone did not settle its concerns about these two uses.

How did a contract dispute become a supply-chain risk designation?

By late January, Reuters reported that negotiations had deadlocked. Then, according to the Department, an Anthropic executive questioned whether a contractor’s use of Claude in a sensitive military operation abroad was proper, even though the Department believed its terms allowed it. Anthropic called the episode a misunderstanding, and the court said it did not know exactly what happened.

On February 24, Amodei met Hegseth, who demanded that Anthropic accept the all-lawful-uses term by February 27. Two days after the meeting, Amodei refused in public. He acknowledged that choosing contractors is the Department’s prerogative, promised a smooth transition if it chose to offboard Anthropic, and said the company would prefer to keep serving the military with its two safeguards in place.

On February 27, President Trump directed federal agencies to stop using Anthropic’s technology, and Hegseth said he would designate the company a supply-chain risk. That was an announcement. The legal acts came on March 3, when the Secretary signed formal determinations under two statutes: 10 U.S.C. § 3252 and the Federal Acquisition Supply Chain Security Act. On March 6 the Department ordered Claude removed from its systems within 180 days and barred contractors from using it in Department work. Anthropic sued in California on March 9 and, the same day, petitioned the D.C. Circuit.

What did the decision put at risk?

The financial figures in the record come from Anthropic, and they are estimates. In a March 9 court declaration, Chief Financial Officer Krishna Rao wrote that the government’s actions could reduce the company’s 2026 revenue by multiple billions of dollars. Anthropic said hundreds of millions of dollars in 2026 revenue tied directly to Defense Department work could be at risk, and that revenue from defense contractors and other customers dependent on the Department could fall by 50 to 100 percent.

Those are projections prepared for a lawsuit, built on worst-case readings of the government’s actions, and they are not realized losses. Some damage was documented early, though. In her March 26 preliminary injunction, Judge Lin recounted Anthropic’s evidence that three contractor customers had terminated contracts or been told to, and that three deals worth more than $180 million had collapsed on the verge of closing. The $200 million figure is also easy to misread: it was a contract ceiling, not cash received.

Anthropic’s IPO filing gives a more measured picture. In its S-1, submitted on October 26, the company said revenue from government agency contracts was approximately 1 percent of its revenue in each period presented. It then added that the risks are not limited to that direct revenue and could affect relationships with customers and partners, and it warned of possible material revenue losses or business disruptions.

Read together, the documents show where the exposure sits. The Pentagon was a small customer by revenue and a large one by consequence. The danger was less the contract than the network around it: defense primes, subcontractors and any enterprise that sells to Washington and might decide an Anthropic relationship was not worth the compliance question. That reading is analysis, not reported fact.

The market evidence complicates any simple account. The D.C. Circuit noted that Anthropic’s valuation had risen sharply since the designation, citing reports of investment offers above $900 billion, and questioned how much reputational harm the company had suffered. Anthropic maintains it was harmed.

Why did the Pentagon treat Claude’s restrictions as a risk?

The Department’s argument is easy to caricature and worth stating properly. It did not claim that Anthropic was a saboteur. Its concern was operational: that a model trained to refuse certain requests might refuse at the wrong moment, and that nobody in the chain of command would know in advance.

The memorandum from Under Secretary Emil Michael, on which the Secretary relied, cited Anthropic’s ability to alter guardrails and model weights, its refusal to allow all lawful uses and the overseas-operation episode. The record adds earlier episodes in which Claude refused government queries. Anthropic calls them resolved glitches, but the court said they showed its training did enforce restrictions.

Anthropic’s reply was technical. Once a model is delivered for classified use, it said, the company cannot access, alter or shut it down, there is no remote kill switch, and the Department can test each new model before adopting it. The majority was not persuaded. Testing cannot cover every scenario, it said, because the contested limits are hardly self-defining and degrees of human involvement in targeting vary widely.

Timing sharpened the concern. Offensive operations against Iran began two days after Anthropic’s refusal, reportedly with Claude involved, and the court cited that in accepting the Department’s claim of urgency. The government’s fear was not that Anthropic could switch Claude off mid-mission. It was that the judgment built into the model might differ from a commander’s, and that the difference would surface only when it mattered.

Why did two federal courts reach different conclusions?

On August 27, Judge Rita Lin of the Northern District of California largely granted Anthropic summary judgment in a 59-page order. She vacated the designation made under § 3252 and the broader February 27 directive, and issued a permanent injunction. She found First Amendment retaliation, a denial of Fifth Amendment due process and arbitrary action under the Administrative Procedure Act. The Department is free to choose its AI vendor, she wrote, but the measures it took here were “illegal and baseless.”

On September 25, a divided panel of the D.C. Circuit ruled the other way on a different action. The Department had also excluded Anthropic under 41 U.S.C. § 4713, and Congress gave the D.C. Circuit exclusive jurisdiction over review of those orders. Judges Katsas and Rao formed the majority and denied Anthropic’s petitions. Judge Henderson dissented.

The rulings do not contradict each other, because they apply different statutes. Section 3252 defines a supply-chain risk as the danger that an adversary may sabotage or subvert a system. The majority said it had no quarrel with the California conclusion that this language requires bad motive, or that Anthropic acted without any. But § 4713 is broader. It reaches the risk that any person may manipulate a product’s design or operation to deny or disrupt its function. The panel read that to cover Anthropic’s training of Claude and held that the statute turns on “what Anthropic does, not why Anthropic does it.”

The sharper disagreement was over retaliation. Judge Lin found that Anthropic’s public statements were a substantial motivating factor in the government’s actions. The D.C. Circuit majority agreed that Anthropic’s advocacy was protected and that exclusion was an adverse action, but saw no causal link. The Department, it said, acted because Anthropic refused a contract term, and the sequence supported that view: the July 2025 award came first, and action followed only after talks broke down. Henderson’s dissent argued that the statute was written against hostile foreign actors and does not reach a contractor’s honest, open enforcement of restrictions on use.

Neither opinion decides whether Anthropic’s judgment about autonomous weapons or surveillance is correct. The D.C. Circuit called the questions profoundly difficult and treated both risks as real: AI that shuts down unexpectedly, and AI that selects inappropriate targets. It left the balance to the President and the Secretary of War.

Where does the case stand now?

As of early November, the dispute is unresolved. On October 13, Anthropic asked the D.C. Circuit to rehear the case, before the panel or the full court, arguing that the majority had turned a statute aimed at hostile foreign actors into one that reaches nearly every government contractor. The court has withheld its mandate while the petition is pending, and no ruling on it has been reported. Former CIA Director Leon Panetta, other former national-security officials and several technology trade groups have filed briefs urging the full court to take the case. If the petition is denied, Anthropic could ask the Supreme Court to review it.

The practical position is split. The Pentagon’s exclusion of Claude stands under § 4713, so Claude remains barred from Department systems and from contractor work done for the Department. The California judgment removed the broader measures, which lets other agencies and contractors keep working with Anthropic. The government is contesting that: on October 26, the Justice Department filed a notice of appeal to the Ninth Circuit.

What can other executives take from it?

Where a restriction lives determines how a customer experiences it. A clause in a contract is something a buyer can negotiate or litigate. A restriction trained into a model behaves like a property of the product, and the D.C. Circuit treated it that way. A customer may see it as a feature that can fail, not only a term it agreed to.

Vague limits invite disputes at the worst moment. The January episode shows what happens when a vendor’s staff and a customer’s operators read the same clause differently in the field. Definitions, escalation paths and a clear answer to who decides in real time belong in the contract before deployment.

Exposure follows dependency, not revenue share. A customer that accounts for 1 percent of sales can still shape access to the contractors and enterprises that buy from the other 99.

A principled position is neither free nor guaranteed to be vindicated. Anthropic’s refusal kept two limits intact. It also cost the company its place inside the Pentagon for now, and left its commercial relationships under a cloud that its own prospectus says could still become lost revenue. The decision is a bet that the limits will be worth more over time than the access, and that courts or customers will eventually agree. Neither has finished ruling.

What remains is the question Amodei’s statement put on the table in February: whether the company that builds an AI system or the government that buys it has the last word on what the system may be used for. So far, the courts have decided narrower questions under different statutes, and the larger one remains open.