from the when-the-ai-company-is-more-principled-than-the-government dept
When Pete Hegseth declared Anthropic a national security risk because it wouldn’t agree to his dangerously unethical demands for what Claude should be able to do, Anthropic sued to challenge the directives. One of the challenges was brought in the Northern District of California, where Anthropic has now notched another significant win.
While the previous victory resulted in a preliminary injunction being issued against Hegseth and his Department of Defense (unfortunately the court and Anthropic referred to it by the Trump Administration’s nickname, “Department of War,” but until Congress agrees to the renaming, we won’t), the court has now ruled on the merits, finding in favor of Anthropic on most of its claims and giving it all the relief it sought, namely both a permanent injunction and vacatur of Hegseth’s agency action.
In short, the court found that the action to “designate Anthropic a supply chain risk to national security, order all federal agencies to permanently stop using Anthropic’s products, and ban all defense contractors from doing any business with Anthropic, even if unrelated to the military” violated Anthropic’s First Amendment rights, as well as its due process rights, and it further violated the APA as an arbitrary and capricious action.
The undisputed record shows that the challenged actions constituted unlawful retaliation in violation of the First Amendment, and that Anthropic was denied the pre-deprivation process required under the Fifth Amendment. The record further shows no material dispute that Secretary Hegseth’s decision to designate Anthropic a supply chain risk violated the governing statutory scheme, 10 U.S.C. § 3252, and was arbitrary and capricious. Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless.
On the First Amendment claims, “The undisputed facts establish that Anthropic’s protected speech, on a matter of great public importance, was a substantial motivating factor for Defendants’ speech-chilling conduct, and that Defendants would not have taken the retaliatory action absent their desire to make an example of Anthropic for its public stance on the weighty issues at stake in the contracting dispute.” In reaching this conclusion the court found that Anthropic had been engaging in speech on matters of public concern—such as the safeguards built into an AI system—and that the Administration’s own social media posts made it clear that designating Anthropic as a national security risk was designed to punish it for this very expression articulating why it did not want to sell the government a version of Claude without those safeguards, rather than for any legitimate purpose.
Secretary Hegseth expressly tied Anthropic’s punishment to its attitude and rhetoric in the press. He stated that “Anthropic delivered a master class in arrogance.” (AR 255B.) Referring to Anthropic and Amodei, he further stated: “Cloaked in the sanctimonious rhetoric of ‘effective altruism,’ they have attempted to strong-arm the United States military” through their “corporate virtue-signaling” and “Silicon Valley ideology.” (Id.) “Anthropic’s stance is fundamentally incompatible with American principles.” (Id.) The President described Anthropic as a “RADICAL LEFT, WOKE COMPANY” and its employees as “Leftwing nut jobs,” who “made a DISASTROUS MISTAKE trying to STRONG-ARM the Department of War.” (AR 255A.) […] Furthermore, the decision to publicly broadcast Anthropic’s punishment via social media—even before the formal, administrative process of making the necessary findings to designate Anthropic a supply chain risk had begun—makes little sense except as an attempt to swiftly make a public example of Anthropic for daring to criticize the Administration.
In other words, the government did not have to buy Claude if it couldn’t agree with Anthropic on what it should be able to do, but designating it a supply chain risk ineligible for any government contract was a punishment inflicted because it did not like Anthropic’s viewpoint that AI should have the safeguards Hegseth did not want it to have.
On its First Amendment claim the court found that Anthropic had shown “that (1) it engaged in constitutionally protected activity; (2) the defendant’s actions would ‘chill a person of ordinary firmness’ from continuing to engage in the protected activity; and (3) the protected activity was a substantial motivating factor in the defendant’s conduct.” It decided that the alternative Pickering test did not apply (“The Pickering framework is inapplicable here because the Challenged Actions were an exercise of sovereign power, not contractual power. […] Furthermore, the public labeling of Anthropic as an adversary of the United States and an “out-of-control, Radical Left AI company” that was attempting to “seize veto power over the operational decisions of the United States military” reflects a concerted effort to make an example of Anthropic” for its viewpoint resisting government demands, and not part of ordinary contract negotiations.), but even if it did, Anthropic would have still prevailed.
Moreover, even if the more flexible Pickering framework were applied, Anthropic has still shown that it is entitled to summary judgment. Under the framework, Anthropic must show it engaged in expressive conduct about a matter of public concern; government officials took adverse action against it; and its expressive conduct was a substantial or motivating factor for the adverse action. Damiano v. Grants Pass Sch. Dist. No. 7, 140 F.4th 1117, 1137 (9th Cir. 2025). In other words, Anthropic’s prima facie showing under the traditional test satisfies its burden under the Pickering framework so long as Anthropic is speaking on a matter of public concern. As already explained, Anthropic satisfies this burden. The government argues that “Anthropic’s public airing of its objections to DoW’s contractual terms does not transform this into a matter of public concern protected by the First Amendment.” (Dkt. No. 214 at 10.) However, “attempt[s] to reach the general public” are “considered relevant in other public concern cases.” Havekost v. U.S. Dep’t of Navy, 925 F.2d 316, 319 (9th Cir. 1991). And as the Supreme Court explains in Janus, matters of “great public concern” can arise in the context of contract negotiations, and the government does not get a pass on upholding First Amendment protections simply because it is engaged in contract negotiations. Janus, 585 U.S. 878, 910–14 (“[I]t is impossible to argue that the level of . . . state spending for employee benefits,” the subject of the contract negotiations between the union and the government, “is not a matter of great public concern.”). Anthropic was not critiquing a “single contract” (Dkt. No. 238 at 8); it was discussing the appropriate limits on the government’s use of frontier AI technology. That is a matter of public concern.
And the government had nothing to rebut Anthropic’s case, including any sort of true national security argument.
Defendants’ asserted national security concerns are further contradicted by their actions shortly before, immediately after, and since the Supply Chain Designation. Shortly before, in the February 24 meeting, Secretary Hegseth raised the possibility of invoking the Defense Production Act, meaning Anthropic was essential to national security rather than a threat to it. (Dkt. No. 166-5 ¶ 17; Dkt. No. 166-9 at 3.) Immediately after the designation, Under Secretary Michael told Anthropic that a deal was “very close.” (Dkt. No. 166-5 ¶ 27.) Since the designation, the White House has “discussed opportunities for collaboration” with Anthropic utilizing its new Mythos model, and these discussions appeared to range across a variety of sensitive contexts. (Dkt. No. 166-4 ¶ 81.) Those actions are inconsistent with any genuine belief that Anthropic is an adversary of the United States who might secretly poison its model to undermine national security. As such, the government has failed, under even a deferential review, to show that a legitimate national security interest outweighed Anthropic’s speech rights.
The court also found that the government’s action violated Anthropic’s due process rights. “Due process requires notice ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of [a government] action and afford them an opportunity to present their objections,’” but here Anthropic had none before it was suddenly blacklisted and designated a supply chain risk. That action deprived it of a liberty interest unconstitutionally.
“[A]bsent exigent circumstances,” due process must happen “before [a] final deprivation.” Esparraguera v. Dep’t of the Army, 101 F.4th 28, 40 (D.C. Cir. 2024). The record reflects that the Challenged Actions were taken without any meaningful notice or pre-deprivation process (and, in the case of the Presidential Directive and the Hegseth Directive, without offering any post-deprivation agency process either). Although Anthropic was on notice that the government objected to its contracting terms, it had no notice or opportunity to object before Defendants publicly barred it from all federal government work and blacklisted it with defense contractors. It also had no notice or opportunity to object to the factual basis for its designation as a supply chain risk, which it learned of in this litigation.
And then, in addition to the constitutional violations, the court also found that the designation was an arbitrary and capricious act under the Administrative Procedure Act as well.
Under the APA, an agency action must be set aside and held unlawful if it is “arbitrary, capricious, an abuse of discretion,” “in excess of statutory jurisdiction, authority, or limitations, or short of statutory right,” or “without observance of procedure required by law.” 5 U.S.C. § 706(2)(A), (C), (D). Anthropic has shown that the Hegseth Directive and the Supply Chain Designation were in excess of statutory authority, contrary to law, and arbitrary and capricious. […] Secretary Hegseth’s February 27 order that “[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic” is a final agency action and thus is subject to APA review. (AR 255B.) On its face, the order is the “consummation” of a decision-making process and “legal consequences [] flow” from it. Bennett v. Spear, 520 U.S. 154, 178 (1997) (citations omitted). Absent recission, which has not occurred to this day, any company doing business with both Anthropic and DoW between the time of the post and when the preliminary injunction issued in this case would have been in violation of the order. Indeed, Anthropic submits evidence that several law firms sent client alerts “describing the potentially far-reaching nature of the government’s actions and suggesting that Department contractors may be best served by reevaluating their relationship with Anthropic.”
The court didn’t buy the government’s defense that “Secretary Hegseth could not have meant what he said because he concededly lacked the requisite authority to issue such a broad order.” To do so would have eviscerated the APA and its prohibition against arbitrary and capricious acts.
After all, if courts were to find agency actions unreviewable as non-final simply because the agency had not met its statutory obligations or did not have authority to take the action, that would defeat the entire purpose of APA contrary to law review. There is no way to read Secretary Hegseth’s words as anything other than a “consummation” of a decision-making process. (See Dkt. No. 238 at 17 (conceding in Defendants’ reply brief that “[w]hatever else, there is no doubt about the Secretary’s commitment to his course of action”).) And his Directive imposed “legal consequences” by declaring, effective immediately and in unqualified terms, that companies could not continue doing business with both Anthropic and DoW, with the implicit threat that DoW would stop contracting with violators. See San Francisco Herring Ass’n v. Dep’t of the Interior, 946 F.3d 564, 580 (9th Cir. 2019) (finding legal consequences flowed from Park Service orders where there was “no suggestion that compliance . . . was somehow optional”).
Furthermore, Anthropic did not meet the statutory definition for “supply chain risk” anyway.
The Administrative Record establishes that Anthropic’s conduct does not meet the requirements for finding a “supply chain risk” under Section 3252. The Michael Memo states: “By embedding unreasonably restrictive terms that restrict DoW’s warfighting operations beyond the limitations imposed by law, Anthropic seeks to grant itself an operational veto. This triggers the legal definition of supply chain risk at 10 U.S.C. § 3252(d)(4) . . . .” (AR 213.) But Section 3252 defines a supply chain risk as limited to “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert . . . a covered system.” 10 U.S.C. § 3252(d)(4). The plain text of the statute is directed at covert acts or hacks, not overt, public positions regarding contract terms. The legislative history similarly explains that the statute aims to address “increasing risk that systems and networks critical to [the Department of Defense] could be exploited through the introduction of counterfeit or malicious code and other defects introduced by suppliers of systems or components.” S. Rep. No. 111-201, at 162 (2010). Contrary to Under Secretary Michael’s conclusion, Anthropic’s contracting position does not appear to bear any relation to the conduct that Section 3252 is aimed at addressing.
And per the other statute in play, it also did not grant Hegseth the authority to do any of this either.
Agencies may not impose sanctions or issue orders “except within jurisdiction delegated to the agency and as authorized by law.” 5 U.S.C. § 558(b). The Court has already found that the Presidential Directive to “EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic’s technology” was a retaliatory act, taken without due process, meant to punish Anthropic for its protected speech. Supra § V.A–B. The record shows that the following Agency Defendants issued orders to terminate use of Anthropic’s products pursuant to the Presidential Directive, most within hours of the directive being issued: Treasury, FHFA, State, GSA, OPM, NRC, DHS, and Energy. Supra § II.G–H. DoW did the same, in reliance on the Hegseth Directive and Supply Chain Designation. Supra § II.E. These orders, in violation of Anthropic’s First Amendment and due process rights, were not “authorized by law,” and violate Section 558(b).
The court did not, however, find in favor of Anthropic’s ultra vires claim, because it hinged more on Trump, who was not named in this case, and seemed to have been underpled, compared to the other claims, but ultimately it was not necessary for Anthropic to prevail on to get all the relief it sought.
When a presidential order does not stem from powers granted through “an act of Congress or from the Constitution itself,” the order violates the separation of powers doctrine, and a district court may enjoin federal agencies from implementing the order as ultra vires. Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579, 584–86 (1952). Anthropic argues that the president lacks “statutory authority” or a “constitutional basis” to direct “EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic’s technology.” (Dkt. No. 166 at 30; AR 255A.) In passing, Anthropic cites four statutes regulating “exclusion from federal contracting.” (Dkt. No. 166 at 30 (citing as “examples” 10 U.S.C. §§ 3203(a)(1), 3204(a); 41 U.S.C. §§ 3303(a)(1), 3304(a)).) However, Anthropic is not asserting a claim for violation of a specific procurement statute, see, e.g., State v. Su, 121 F.4th 1, 5 (9th Cir. 2024), and “claims simply alleging that the President has exceeded his statutory authority are not ‘constitutional’ claims.” Dalton v. Specter, 511 U.S. 462, 473 (1994). Anthropic’s passing references to the statutory provisions and Congress’s “power of the purse” are insufficient to carry its burden of showing the President clearly exceeded “any background constitutional authority” to issue the Presidential Directive, thereby rendering the order ultra vires in violation of the separation of powers. Sierra Club v. Trump, 929 F.3d 670, 696 (9th Cir. 2019).
That the court found liability for both the constitutional claims and APA claims is why Anthropic was able to get all that relief, including both vacatur of the agency action and also a permanent injunction.
First, despite the government’s arguing that the matter should simply be remanded back to the agency for further action, rather than the court vacating what the agency had earlier done entirely, the court disagreed that such a remand would be adequate (“In light of Anthropic’s showing that the Supply Chain Designation violates the substance of Section 3252 and that Secretary Hegseth lacked any authority to order a secondary boycott, remand without vacatur would be an inadequate remedy.”). There was no point giving the government another bite of an apple it wasn’t entitled to eat in the first place.
Nor were the government’s claims it would be harmed by this more extreme remedy availing, given how the government had been coping just fine with its action already having been enjoined for quite some time (“[T]here has been no showing by the government that vacatur would result in a national security risk or any other harm—despite the fact that the Supply Chain Designation and the Hegseth Directive have been preliminarily enjoined for over five months.”). It is also why the court denied an automatic stay of its order, since the government had obviously not been harmed by the preliminary injunction already in place.
And as for why the court also granted a permanent injunction on top of vacatur, it found that vacatur alone would not redress the constitutional injury.
Furthermore, to the extent Defendants rely on their voluntary cessation of the challenged conduct, it is not “absolutely clear that the allegedly wrongful behavior could not reasonably be expected to recur.” Friends of the Earth, Inc. v. Laidlaw Env’t Servs., 528 U.S. 167, 189 (2000) (citation omitted); Enrico’s, Inc. v. Rice, 730 F.2d 1250, 1253 (9th Cir. 1984) (“We recognize that the voluntary cessation of allegedly illegal conduct does not deprive a court of the power to grant injunctive relief.”). Defendants continue to defend and have declined to stipulate to enjoin the Challenged Actions. For these same reasons, legal remedies would be inadequate. As to Defendants’ argument that Anthropic “continues to speak freely,” has experienced an increase in its valuation, and has not had its federal contracts terminated yet (Dkt. No. 214 at 33–34), that reflects the restoration of the status quo pursuant to the preliminary injunction in this case. The record shows no indication that, upon lifting the preliminary injunction, the harms at issue would still be averted.
In sum, the vindictive petulance of Hegseth and the Trump Administration has led to a particularly obvious constitutional injury, which no statute otherwise privileges. Per the court, the directives are now nullities and Hegseth and his agency are prohibited from trying again. Pursuant to the separate order, if they want to take any action, it can only be what they were lawfully allowed to do in the first place.
This Order does not bar any Defendant from taking any lawful action that would have been available to it on February 27, 2026, prior to the issuance of the Challenged Actions. For example, this Order does not require the Department of War to use Anthropic’s products or services and does not prevent the Department of War from transitioning to other artificial intelligence providers, so long as those actions are consistent with applicable regulations, statutes, and constitutional provisions.
Filed Under: 1st amendment, administrative procedure act, dario amodei, defense department, dos, free speech, pete hegseth, supply chain, supply chain risk
Companies: anthropic
You must be logged in to post a comment Login