Anthropic v. Department of War and the First Amendment

On March 9, 2026, Anthropic PBC filed suit in the Northern District of California against the U.S. Department of War, fifteen other federal agencies, and the officials who head them, seeking to set aside a presidential directive, a "Supply-Chain Risk to National Security" designation, and the wave of contract terminations that followed.¹ What makes the case interesting is not that a government contractor lost a contract, but Anthropic's argument: it declined to strip two use restrictions from Claude's Usage Policy, a prohibition on lethal autonomous warfare without human oversight and a prohibition on the mass surveillance of Americans, after the Department demanded "all lawful use" language in its contracts.² The following analysis discusses the complaint's five counts, situates the case within First Amendment retaliation doctrine and the Youngstown separation-of-powers framework. Everything attributed to the parties below is drawn from Anthropic's complaint and public statements; the government defendants have not yet answered.

Anthropic had supplied Claude to the Department of War since 2023, including a custom fine-tuned version deployed on classified networks, and had been negotiating an "any lawful use" contract addendum for a new "GenAI.mil" deployment through late 2025 and early 2026.³ On February 24, 2026, Secretary of War Pete Hegseth met with Anthropic CEO Dario Amodei and gave the company until 5:01 p.m. Eastern on February 27 to abandon its two restrictions or face either commandeering under the Defense Production Act or exclusion as a "supply chain risk."⁴ On February 26, Amodei issued a public statement reaffirming that the two restrictions address uses "simply outside the bounds of what today's technology can safely and reliably do" and that Anthropic "cannot in good conscience accede to" the Department's request — the statement Anthropic itself now attaches as evidence of its protected speech.⁵ The next day, before its own deadline had run, the government moved: President Trump posted on Truth Social directing "EVERY Federal Agency" to "IMMEDIATELY CEASE all use of Anthropic's technology," and Secretary Hegseth followed within hours with a post directing the Department to designate Anthropic a "Supply-Chain Risk to National Security" and barring "any contractor, supplier, or partner that does business with the United States military" from conducting "any commercial activity with Anthropic."⁶ A formal two-page letter invoking 10 U.S.C. § 3252 arrived by email at 8:48 p.m. Eastern on March 4, nearly a week after the designation had already been announced on social media.⁷

Count I is built on 10 U.S.C. § 3252, the statute Congress enacted to let the Department exclude a "source" from covered procurements where necessary to protect against the risk that a foreign adversary will "sabotage . . . or otherwise subvert" a covered information system.⁸ The provision is not a general-purpose contracting remedy; it is tethered to sabotage and subversion risk, defines "covered articles" and procedures with some specificity, and - critically - requires the Secretary to consult with relevant officials, make a written determination that exclusion is necessary and that less intrusive measures are unavailable, and notify the appropriate congressional committees before acting.⁹

Anthropic's complaint argues the Secretarial Order fails on both the substantive and procedural axes of Section 3252. Substantively, the "adversary" concept in the statute and its implementing authorities has historically meant designated foreign threats - China, Russia, Iran, North Korea, Cuba, and Venezuela under Executive Order 13,873 - not a Delaware public benefit corporation headquartered in San Francisco that holds an active facility security clearance and has, according to the complaint, taken affirmative steps to keep its models out of the hands of state-sponsored cyber operators.¹⁰ Procedurally, the complaint alleges no interagency consultation occurred, no written necessity determination was made before the February 27 announcement, and Congress was never notified - omissions that, if borne out, would place the designation outside "observance of procedure required by law" under 5 U.S.C. § 706(2)(D).

The complaint's strongest arbitrary-and-capricious argument, drawn from Motor Vehicle Manufacturers Ass'n v. State Farm, may be the internal contradiction it identifies: the same Secretarial Order that brands Anthropic's products a sabotage-and-subversion risk also directs that "Anthropic will continue to provide the Department of War its services for a period of no more than six months."¹¹ An agency that genuinely believed a contractor's technology could be subverted by a foreign adversary would not, in the same breath, order six more months of continued reliance on that technology for national-security missions. State Farm requires an agency to "articulate a satisfactory explanation for its action including a rational connection between the facts found and the choice made"; an unreconciled six-month carve-out sitting alongside a sabotage-risk finding is the kind of "unexplained inconsistency" reviewing courts have treated as evidence of arbitrariness rather than reasoned decision-making.

Count II reframes the same facts as a First Amendment retaliation claim, and it is here that the case moves from ordinary procurement law into more consequential constitutional territory. The Supreme Court's retaliation framework, most recently restated in National Rifle Ass'n of America v. Vullo and Nieves v. Bartlett, requires a plaintiff to show it engaged in constitutionally protected activity, that the government's action would chill a person of ordinary firmness from continuing that activity, and that the protected activity was a substantial or motivating factor in the government's conduct.¹²

Anthropic's complaint identifies several layers of protected expression: its lobbying and legislative advocacy on AI-safety bills; its published Usage Policy, which the complaint characterises as public speech embodying the company's "foundational commitment to the safe and responsible use of AI"; Amodei's public statements, including a June 2025 New York Times op-ed opposing a federal moratorium on state AI regulation and the February 26, 2026 statement described above; and Anthropic's direct petitioning of the Department during contract negotiations, which the complaint grounds in the First Amendment's Petition Clause rather than treating as ordinary commercial back-and-forth.¹³

What distinguishes this case from the run of retaliation litigation, where motive must typically be inferred from timing and pretext, is that the complaint can point to direct statements from the alleged retaliators. President Trump's Truth Social post derided Anthropic as a "RADICAL LEFT, WOKE COMPANY" engaged in "selfishness"; Secretary Hegseth's own post accused the company of "corporate virtue-signaling," "defective altruism," and being insufficiently "patriotic," and declared that "Anthropic's stance is fundamentally incompatible with American principles."¹⁴ Retaliatory-motive cases rarely come with this degree of contemporaneous, on-the-record explanation from the decision-makers themselves - which is precisely why the complaint treats causation as effectively conceded rather than merely inferable.

Because the retaliation is alleged to target Anthropic's viewpoint on a matter of public concern - the safe and responsible use of frontier AI - the complaint argues strict scrutiny applies, and that the government cannot satisfy the "least restrictive means" requirement of McCullen v. Coakley when an unrestrictive alternative was sitting in plain view: simply declining to renew the contract and procuring from a different vendor, an option Anthropic says it repeatedly offered to facilitate.¹⁵ If terminating the relationship without the designation, the blacklist language, and the public denunciations would have served the government's stated interest just as well, the additional punitive measures become difficult to justify as narrowly tailored to anything other than punishing Anthropic's expression.

Count III proceeds independently of the First Amendment, arguing that the Presidential Directive exceeds any authority the Constitution or Congress has conferred on the President. The complaint invokes Justice Jackson's tripartite framework from Youngstown Sheet & Tube Co. v. Sawyer: presidential power "must stem either from an act of Congress or from the Constitution itself," and here Anthropic says there is neither.¹⁸ No statute authorizes a directive ordering every federal agency to cease using a single company's products because that company declined to alter its own product's usage restrictions in contract negotiations, and the complaint catalogs the detailed procurement framework in Titles 10 and 41 of the U.S. Code — including the specific, procedurally bounded debarment regime in 48 C.F.R. Subpart 9.4, which is "not a remedy for mere contract failure" and "may never be used for purposes of punishment" — as evidence that Congress has already occupied this field with safeguards the Directive bypassed entirely.¹⁹

The complaint goes further, characterizing the Directive as functionally resembling a bill of attainder: a "prepared and proclaimed government blacklist" naming one company and imposing consequences on it without investigation, trial, or process, language borrowed from Justice Black's concurrence in Anti-Fascist Refugee Committee v. McGrath.²⁰ Because the Bill of Attainder Clause of Article I formally constrains Congress rather than the President, this is pled as an ultra vires and due process theory rather than a freestanding attainder claim — but the analogy does useful work, framing the Directive's central defect as its individualized, punitive, process-free character rather than any generally applicable rule.

Counts IV and V of the complaint concern due process and debarment. The Fifth Amendment due process claim rests on two protected interests: a liberty interest in Anthropic's reputation, harmed by the "Supply-Chain Risk to National Security" label itself, and a property interest in its existing government contracts and business relationships.²¹ The most concrete argument here is that the designation operates as a de facto 'debarment' (i.e. excluding Anthropic from federal contracting government-wide) without any of the procedural protections that formal debarment under FAR Subpart 9.4 would otherwise require, including notice, an opportunity to respond, and a reasoned written determination. Courts including the D.C. Circuit in Trifax Corp. v. District of Columbia have recognized that debarring a corporation from government contracting implicates a liberty interest triggering due process guarantees; the complaint argues the government cannot evade those guarantees simply by declining to call the exclusion "debarment."²²

Count V applies 5 U.S.C. § 558(b) to the non-Department agencies - GSA, Treasury, the Federal Housing Finance Agency, State, and HHS - that terminated or restricted Anthropic's access following the Presidential Directive. Section 558(b) prohibits imposing a "sanction" or substantive order "except within jurisdiction delegated to the agency and as authorized by law," and the complaint argues that none of these agencies has independent statutory authority for blacklisting a specific commercial vendor in response to a presidential social-media post - they simply followed the Directive's lead without their own legal basis for doing so.

Anthropic is not the first Trump-administration target to frame retaliatory government action as a First Amendment violation; the complaint itself cites Perkins Coie LLP v. U.S. Department of Justice, in which a court held an executive order retaliating against a law firm unconstitutional because its text made "clear that President Trump and his administration disfavor the specific messages conveyed by plaintiff."²³ What sets this case apart is the setting: a frontier AI developer that, by its own account, is the Department of War's most widely deployed model and the only frontier system authorized on its classified networks - a company the government simultaneously calls a national-security asset it "need[s] . . . now" and a sabotage risk requiring exclusion.²⁴ That tension is the throughline of every count in the complaint, and it is likely to be the government's most difficult fact to explain away, however the legal theories ultimately fare.

Anthropic has been careful to frame its position as narrow rather than obstructionist. In Anthropic's public statement on the dispute ↗, Amodei emphasized that the company continues to support the Department's "lawful foreign intelligence" work and partially autonomous weapons systems already fielded in Ukraine, and that its objection is limited to two applications - fully autonomous lethal targeting without human oversight, and mass domestic surveillance of Americans - that Anthropic says exceed what "today's technology can safely and reliably do." Whether that framing is legally sufficient to establish protected, non-obstructive speech, or whether a court instead treats Anthropic's refusal as an ordinary contract dispute dressed in constitutional language, will likely turn less on doctrine than on the factual record the parties develop: what, precisely, was said in the February 24 meeting, what alternatives were genuinely available to the Department, and whether the "supply chain risk" rationale can survive scrutiny once tested against the government's own six-month continued-use concession.

Anthropic v. Department of War compresses three distinct bodies of law - procurement and supply-chain-risk statutes, First Amendment retaliation doctrine, and the separation-of-powers limits on unilateral executive action - into a single dispute. For now, the complaint's more modest claim - that the government may not use procurement leverage and a repurposed supply-chain-risk statute to punish a contractor for maintaining safety restrictions it has publicly defended - is likely to be the terrain on which the case is actually decided.