ANTHROPIC PBC v. DEPARTMENT OF WAR (2026)

ORDER ON CROSS MOTIONS FOR SUMMARY JUDGMENT; GRANTING MOTION TO SUPPLEMENT THE ADMINISTRATIVE RECORD

Re: Dkt. Nos. 166, 169, 215

I. INTRODUCTION

On February 27 and March 3, 2026, President Trump and Secretary of War Hegseth designated Anthropic a supply chain risk to national security, ordered all federal agencies to permanently stop using Anthropic's products, and banned all defense contractors from doing any business with Anthropic, even if unrelated to the military. Defendants have now submitted the administrative record justifying those actions. The record is slim. A four-page memorandum, which post dates two of the three challenged actions, provides the entirety of the government's rationale. Defendants have now backed away from the thrust of their risk assessment, which relied on Anthropic having backdoor access to its technology once deployed in a national security system. It is now clear that Anthropic undisputedly lacks any such access and that, as Defendants concede, Anthropic's technology is itself no riskier to the national security than any other “black box” artificial intelligence model.

That leaves only one factor unique to Anthropic on which Defendants rely: “trust.” Defendants claim that because of Anthropic's “increasingly hostile manner through the press” and its criticism of the Department of War's views on AI use, Defendants “cannot trust Anthropic to ensure the integrity of its models.” Neither the Constitution nor the federal statute invoked by Defendants allows them to impose sweeping penalties based principally on Anthropic's critique of the Administration's views.

The government is certainly owed deference on weighty issues of national security. But Defendants' contemporaneous words and deeds confirm that the challenged actions were based on a desire to make a public example out of Anthropic for its “arrogance” in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model. A few days before the challenged actions began, Secretary Hegseth proposed applying the Defense Production Act to Anthropic, which would mean the company was essential to national security rather than a threat to it. Immediately after the challenged actions, the Department of War continued to pursue a contract with Anthropic, saying “we are very close here.” Even now, the government is discussing collaboration with Anthropic on its new model, Mythos, in an array of sensitive contexts. None of that is consistent with a genuine fear that Anthropic is a saboteur who would poison its software to harm national security.

The undisputed record shows that the challenged actions constituted unlawful retaliation in violation of the First Amendment, and that Anthropic was denied the pre-deprivation process required under the Fifth Amendment. The record further shows no material dispute that Secretary Hegseth's decision to designate Anthropic a supply chain risk violated the governing statutory scheme, 10 U.S.C. § 3252, and was arbitrary and capricious. Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless. Summary judgment is granted in Anthropic's favor on all claims, except for the ultra vires separation of powers claim and certain claims concerning Agency Defendants who undisputedly did not take any relevant action or who took only interim measures, on which judgment is entered in Defendants' favor. The empty invocation of national security is not a blank check to punish and retaliate against government critics.

TABLE OF CONTENTS

I. INTRODUCTION․––––

II. THE UNDISPUTED FACTS․––––

A. Anthropic's Working Relationship with the Federal Government Before February 27, 2026․––––

B. Defendants and Anthropic Publicly Disagree About Anthropic's Role in Ensuring AI Safety in the Military and Surveillance Context․––––

C. The President and Secretary Hegseth Publicly Announce that Anthropic is Barred from Working with the Federal Government or Defense Contractors․––––

D. Secretary Hegseth's Authority to Designate a “Supply Chain Risk” Under Section 3252․––––

E. Under Secretary Michael's Memorandum Justifying Anthropic's Designation as a Supply Chain Risk․––––

F. Administrative Record Regarding Concerns Raised in the Michael Memo․––––

G. Agency Defendants Followed the Presidential Directive․––––

H. The Challenged Actions Threaten to Cripple Anthropic and Have Chilled Speech․––––

III. PROCEDURAL HISTORY․––––

IV. LEGAL STANDARD․––––

V. DISCUSSION․––––

A. Anthropic Is Entitled to Summary Judgment on Its First Amendment Claim․––––

1. Anthropic Has Made Its Prima Facie Showing․––––

2. Defendants Do Not Meet Their Burden of Rebutting Anthropic's Prima Facie Showing․––––

3. The Pickering Framework Does Not Apply․––––

4. Applying Pickering Leads to the Same Result․––––

B. Anthropic Is Entitled to Summary Judgment on Its Due Process Clause Claim․––––

1. Anthropic Has a Protectible Liberty Interest․––––

2. A Serious Risk of Erroneous Deprivation Exists, and Defendants Have Not Shown Any Urgency Supporting the Need to Bypass Pre-Deprivation Process․––––

C. Anthropic Is Entitled to Summary Judgment on Its APA Challenge to the Hegseth Directive and the Supply Chain Designation․––––

1. The Secondary Boycott Instituted Through the Hegseth Directive Was a Final Agency Action in Excess of Statutory Authority and Contrary to Law․––––

2. Whether Considered Together or Separately, the Designation of Anthropic as a Supply Chain Risk in the Hegseth Directive and the Subsequent Supply Chain Designation Violate the APA․––––

3. Anthropic Does Not Meet the Definition of a Supply Chain Risk․––––

4. Secretary Hegseth and DoW Concede They Committed Procedural Errors, and the Errors Were Not Harmless․––––

5. The Supply Chain Designation Was Arbitrary and Capricious․––––

D. Anthropic Is Entitled to Summary Judgment on Its APA Challenge Pursuant to Section 558․––––

E. Anthropic's Ultra Vires Separation of Powers Challenge Fails․––––

F. Declaratory Relief, Vacatur, and Injunctive Relief Are Appropriate․––––

VI. CONCLUSION․––––

II. THE UNDISPUTED FACTS

A. Anthropic's Working Relationship with the Federal Government Before February 27, 2026

Except where noted, the following facts are undisputed. Plaintiff Anthropic PBC is a company focused on AI development, safety, and policy work. (Dkt. No. 166-1 ¶ 10, 12–13; Dkt. No. 166-5 ¶ 7.) Anthropic regularly publishes research on the societal impacts of large language models (“LLMs”), and Anthropic and its CEO, Dario Amodei, engage in public advocacy for AI safety. (Dkt. No. 166-1 ¶ 10; see also, e.g., AR 48–135.)¹ Anthropic's signature commercial product is a general-purpose LLM called “Claude.” (Dkt. No. 166-1 ¶ 14.) LLMs like Claude are algorithmic systems trained on massive datasets to identify patterns and associations in language and quickly generate outputs and take actions that resemble human responses and actions. (Id. ¶ 15.) When given access to tools, Claude can act as an agent of the user (“agentically”)—or even autonomously—executing tasks without requiring ongoing user direction. (Id. ¶ 16.)

U.S. intelligence and defense agencies have been using Claude since 2024. (Dkt. No. 166-4 ¶¶ 7–8.) Since March 2025, the Department of War (“DoW”)² has been using “Claude Gov,” dedicated models for national security users, through Anthropic partner platforms. (Id. ¶¶ 31–33.) Federal defense contractors also provide the U.S. government with products and services that integrate Claude or that were created using Anthropic's technology to various degrees. (Id. ¶¶ 61–62.)

LLMs, including Claude, can produce responses that diverge from the goals of the people that trained them or reflect skewed or mistaken judgments embedded in their training data. (Dkt. No. 166-1 ¶ 18.) Those risks are heightened when an LLM is acting agentically or autonomously out in the world with little or no human supervision. (Id. ¶ 16.) To address these risks, the commercially available version of Claude has three layers of protection, some of which also exist on Claude Gov. First, Anthropic uses various model training or “alignment” techniques to make Claude more reliably follow human values and intentions. (Id. ¶ 19; Dkt. No. 166-4 ¶¶ 19–22.) Second, the commercial model of Claude has safeguards that can detect in real time, and in some instances may intervene, when activity Anthropic considers to be harmful is identified. (Dkt. No. 166-4 ¶¶ 23–24.) Claude Gov operates with a limited monitoring safeguard that records risk scores for prompts, but the risk scores are not accessible to Anthropic, and the safeguard does not have intervention capabilities and cannot impact the behavior of the model. (Id. ¶¶ 24, 32.)

Third, Anthropic has a usage policy under which users agree not to use Claude for certain specified “applications for which Claude has not been developed or is not ready.” (Id. ¶ 25.) As of January 2026, the Anthropic usage policy to which DoW platform partners agreed had fewer restrictions than the commercial model's policy, and permitted activities including analysis of foreign intelligence, offensive cyber operations, and certain intelligence collection. (Id. ¶ 26.) However, at all times the DoW-specific usage policy has contained restrictions that “prohibited mass surveillance of Americans and lethal autonomous warfare.” (Dkt. No. 166-1 ¶¶ 29, 31.) The usage policy applicable to DoW work is a purely contractual limit; Anthropic is incapable of enforcing it technologically, and does not have direct visibility into how DoW uses its model. (Dkt. No. 166-4 ¶ 26.)

Before the challenged actions, DoW did not view the Claude Gov usage restrictions as indicating a national security risk. While these restrictions were in place, DoW's Defense Counterintelligence and Security Agency granted Anthropic Top Secret facility security clearance, enabling it to support classified national security projects, after an 18-month vetting process. (Id. ¶ 12.) In June 2025, the General Services Administration (“GSA”) and DoW granted Claude authorization through the Federal Risk and Authorization Management Program (“FedRAMP”) for use with FedRAMP High and DoD Impact Level 4 and 5 workloads, representing the highest levels of cloud security certification for unclassified and controlled unclassified information. (Id. ¶ 13.) In July 2025, Anthropic was awarded a two-year, up to $200 million agreement by DoW's Chief Digital and Artificial Intelligence Office to integrate and optimize AI capabilities across DoW. (Id. ¶ 9.) And in August 2025, Anthropic and GSA announced an agreement to deliver Claude Gov to all three branches of the government: civilian executive, legislative, and judiciary. (Id. ¶ 10.) As the Administrative Record reflects, before March 2, 2026, DoW did not identify any potential supply chain risk posed by Anthropic. (AR 255A–B.)

Furthermore, outside of the negotiations over the usage restrictions, Anthropic “only ever received positive feedback about Claude's performance from [its] governmental customers.” (Dkt. No. 166-4 ¶¶ 15, 35, 66.) Defendants' briefs do refer repeatedly to an incident in 2025 involving the Centers for Disease Control and Prevention (the “CDC Incident”). At that time, the CDC was using a general commercial model of Claude rather than a specially tailored Claude Gov model, and some prompts were therefore refused. (AR 8 (“The issue with the CDC, which was using our commercial model, is now almost resolved.”); AR 246 ¶ 14; AR 254 ¶¶ 17–18.) When “Anthropic became aware of the issue, [it] worked promptly with [ ] third-party partners and the government to enable use of the model in a manner appropriate to the CDC's mission and expertise.” (Dkt. No. 166-4 ¶ 63.) Nothing in the record indicates the CDC believed that the limitations had been introduced maliciously or even negligently, or that the CDC was dissatisfied with how Anthropic resolved the issue.

B. Defendants and Anthropic Publicly Disagree About Anthropic's Role in Ensuring AI Safety in the Military and Surveillance Context

In fall 2025, DoW and Anthropic began discussing a new deployment of Claude on the DoW's “GenAI.mil” platform, at which point DoW informed Anthropic that it must remove all usage restrictions to Claude and instead agree to a new contractual provision allowing DoW, its contractors, and its subcontractors, to use Claude “for all lawful uses.” (Dkt. No. 166-1 ¶ 32.) Anthropic agreed to eliminate most restrictions, but ultimately refused to drop restrictions of two uses: lethal autonomous warfare and mass surveillance of Americans. (Id. ¶ 33.) The record reflects that between December 4, 2025 and March 4, 2026, Amodei and Under Secretary of War for Research and Engineering Emil Michael exchanged a series of emails substantively engaging on these issues and trading draft contract language. (AR 1–46; Dkt. No. 166-6 at 2.)

Through emails, Amodei explained that Anthropic did not believe Claude was safe for use in lethal autonomous warfare or mass surveillance of Americans based on its training and testing. (AR 2–47; Dkt. No. 166-1 ¶¶ 34–36; Dkt. No. 166-5 ¶¶ 11–12.) For example, in the context of domestic mass surveillance, Anthropic believed that “AI fundamentally changes what is possible with surveillance on Americans in ways that existing law was not written to address,” and using Claude in this context could result in “collecting more information about U.S. persons than the user intended.” (AR 1; Dkt. No. 166-1 ¶ 34.) Anthropic further believed that lethal autonomous warfare was beyond Claude's current ability to carry out reliably, in light of the potentially grave consequences of a mistake. (AR 2; Dkt. No. 166-1 ¶ 35.) In a January 15, 2026 email, Amodei provided a detailed explanation of Anthropic's proposed guardrails, concluding that “we make these proposals with tremendous respect and deference for the D[oW]'s expertise in this domain. They arise from our understanding of how these particular models behave—their capabilities, edge cases, and failure modes—not second-guessing the D[oW]'s expertise in conducting its operations.” (AR 10–11.) However, Anthropic took the position that “[s]evering Claude from the usage limitations we have determined are essential would erode the very purpose for which our company was founded and contradict our deeply held values.” (Dkt. No. 166-1 ¶ 23.) Amodei repeatedly offered to assist in offboarding Claude from DoW's systems if DoW concluded Anthropic was not the right vendor for its needs. (AR 2; AR 29; Dkt. No. 166-5 ¶ 12.)

During this time, DoW and Anthropic both publicly aired their views. For example, in January 2026, Amodei posted a lengthy essay addressing, among other topics, the risk of using AI technology in surveillance and autonomous weapons. (AR 48–135.) That essay advocated for “draw[ing] a hard line against AI abuses within democracies,” and discussed the need for “bright red lines” and “guardrails” on those topics to prevent “AI-enabled totalitarianism.” (AR 98–100.) The essay also referenced Amodei's prior writings on the subject of AI safety. (AR 49.) On February 12, Amodei gave an interview to the New York Times on the same topic. (AR 152–200.) On January 9, Defendant Secretary of War Pete Hegseth issued a Memorandum containing a subsection titled “Clarifying ‘Responsible AI’ at the DoW—Out with Utopian Idealism, In with Hard-Nosed Realism,” where Secretary Hegseth instructed that the “any lawful use” provision must be incorporated into “any DoW contract through which AI services are procured.”³ News coverage in January and February outlined Anthropic and DoW's positions, based on information from “people familiar with the matter.” (AR 136–48.) The news coverage quotes Secretary Hegseth saying DoW would not “employ AI models that won't allow you to fight wars,” in reference to DoW's discussions with Anthropic. (AR 138–39.) The email communication during this period reflects concern over the news coverage, with both Under Secretary Michael and Amodei discussing “noise,” and Amodei referring with displeasure to public statements by “senior administration officials.” (AR 3–4.)

On February 24, representatives of Anthropic, including Amodei and Anthropic's Head of Policy Sarah Heck, met with representatives of DoW, including Secretary Hegseth. (Dkt. No. 166-5 ¶ 13.) Heck's description of the meeting is undisputed. The parties discussed Anthropic's ongoing concerns regarding the possible use of Claude in mass surveillance of Americans and lethal autonomous warfare. (Id. ¶¶ 13–15.) Secretary Hegseth stated that Claude had “exquisite capabilities,” and Anthropic's concerns were “understandable,” but that DoW “had many other vendors to choose from that have never raised” the concerns Anthropic was raising and who “would never hold any veto power over” DoW. (Id. ¶¶ 13, 16.) Secretary Hegseth did not say anything about Anthropic's AI models being unsafe, insecure, or subject to compromise. (Id. ¶ 18.) Nonetheless, at the end of the meeting, Secretary Hegseth told Anthropic's representatives that if Anthropic did not agree to “all lawful uses” of its products by 5:00 p.m. on February 27, DoW would immediately designate Anthropic a supply chain risk and would prevent Anthropic from partnering with DoW, anyone affiliated with DoW, or any other agency. (Id. ¶ 17.) Alternatively, Secretary Hegseth warned that DoW might invoke the Defense Production Act to designate Anthropic as essential to national security and thus compel Anthropic to provide its services without the restrictions. (Id.)

Following the meeting, on February 26, Amodei issued a public statement on behalf of Anthropic. (Dkt. No. 166-9.) Amodei stated that “Anthropic understands that [DoW], not private companies, makes military decisions,” and Anthropic had “never raised objections to particular military operations nor attempted to limit use of our technology in an ad hoc manner.” (Id. at 2.) However, Amodei said that “in a narrow set of cases ․ AI can undermine, rather than defend, democratic values,” and that some uses of AI are “simply outside the bounds of what today's technology can safely and reliably do.” (Id.) Amodei concluded that Anthropic “cannot in good conscience” provide DoW the type of access to Claude that it was requesting. (Id. at 3.)

C. The President and Secretary Hegseth Publicly Announce that Anthropic is Barred from Working with the Federal Government or Defense Contractors

At 3:47 p.m. on February 27, 2026, President Donald Trump posted the following statement on the social media platform Truth Social:

THE UNITED STATES OF AMERICA WILL NEVER ALLOW A RADICAL LEFT, WOKE COMPANY TO DICTATE HOW OUR GREAT MILITARY FIGHTS AND WINS WARS! That decision belongs to YOUR COMMANDER-IN-CHIEF and the tremendous leaders I appoint to run our Military.

The Leftwing nut jobs at Anthropic have made a DISASTROUS MISTAKE trying to STRONG-ARM the Department of War, and force them to obey their Terms of Service instead of our Constitution. Their selfishness is putting AMERICAN LIVES at risk, our Troops in danger, and our National Security in JEOPARDY.

Therefore, I am directing EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic's technology. We don't need it, we don't want it, and will not do business with them again! There will be a Six Month phase out period for Agencies like the Department of War who are using Anthropic's products, at various levels. Anthropic better get their act together, and be helpful during this phase out period, or I will use the Full Power of the Presidency to make them comply, with major civil and criminal consequences to follow.

WE will decide the fate of our Country—NOT some out-of-control, Radical Left AI company run by people who have no idea what the real World is all about. Thank you for your attention to this matter. MAKE AMERICA GREAT AGAIN!

PRESIDENT DONALD J. TRUMP

(AR 255A (the “Presidential Directive”).) A little over an hour later, Secretary Hegseth posted on the social media platform X:

This week, Anthropic delivered a master class in arrogance and betrayal as well as a textbook case of how not to do business with the United States Government or the Pentagon.

Our position has never wavered and will never waver: the Department of War must have full, unrestricted access to Anthropic's models for every LAWFUL purpose in defense of the Republic.

Instead, @AnthropicAI and its CEO @DarioAmodei, have chosen duplicity. Cloaked in the sanctimonious rhetoric of “effective altruism,” they have attempted to strong-arm the United States military into submission - a cowardly act of corporate virtue-signaling that places Silicon Valley ideology above American lives.

The Terms of Service of Anthropic's defective altruism will never outweigh the safety, the readiness, or the lives of American troops on the battlefield.

Their true objective is unmistakable: to seize veto power over the operational decisions of the United States military. That is unacceptable.

As President Trump stated on Truth Social, the Commander-in-Chief and the American people alone will determine the destiny of our armed forces, not unelected tech executives.

Anthropic's stance is fundamentally incompatible with American principles. Their relationship with the United States Armed Forces and the Federal Government has therefore been permanently altered.

In conjunction with the President's directive for the Federal Government to cease all use of Anthropic's technology, I am directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security. Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic. Anthropic will continue to provide the Department of War its services for a period of no more than six months to allow for a seamless transition to a better and more patriotic service.

America's warfighters will never be held hostage by the ideological whims of Big Tech. This decision is final.

(AR 255B (the “Hegseth Directive”).) Taken together, the Presidential Directive and the Hegseth Directive created an immediate, permanent, federal-government-wide bar on using any Anthropic technology (except during a six-month transition period), and also prohibited private companies who do business with the military from doing any business with Anthropic, even if unrelated to the military or national security.

On March 4, 2026, Anthropic received a letter on DoW letterhead, signed by Secretary Hegseth and dated one day prior, regarding Anthropic's designation as a “supply chain risk,” citing 10 U.S.C. § 3252. (AR 237–40.) The letter states that DoW:

has determined that (i) the use of [Anthropic and its subsidiaries and affiliates'] products or services in DoW covered systems presents a supply chain risk and that the use of the Section 3252 authority to carry out covered procurement actions is necessary to protect national security by reducing supply chain risk, and (ii) less intrusive measures are not reasonably available to reduce such supply chain risk.

(AR 237 (footnotes omitted).) In other words, the legal effect of the Supply Chain Designation was to “exclude[ ] Anthropic from supplying products or services, as a contractor or a subcontractor, for procurements involving national security systems.” (Dkt. No. 214 at 16.) The effect of the letter is “immediate” and permanent, and Anthropic was given thirty days to appeal the decision. (AR 237–38.) The Administrative Record also contains a March 3 “Determination” and related materials memorializing and operationalizing the designation, but the documents contained in the determination were not disclosed to Anthropic until after Anthropic filed this lawsuit. (AR 209–36; AR 241–42.) This Order refers to the March 3 determination and related materials, together with the March 4 letter, as the “Supply Chain Designation.” The Presidential Directive, the Hegseth Directive, and the Supply Chain Designation are referred to jointly as the “Challenged Actions.”

D. Secretary Hegseth's Authority to Designate a “Supply Chain Risk” Under Section 3252

In 2010, Congress was concerned that “the globalization of the information technology industry” left DoW vulnerable to “attacks on its systems and networks,” and gave the Secretary of Defense the “authority needed to address this risk” when procuring certain sensitive technology systems. S. Rep. No. 111-201, at 162 (2010). Congress therefore enacted the provision that became 10 U.S.C. § 3252, which allows the Secretary to exclude a source as a “supply chain risk.” S. Rep. No. 111-201, at 161–62. Congress defined “supply chain risk” as “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a [national security] system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system.” 10 U.S.C. § 3252(d)(4). DoW's implementing instructions for the predecessor provision, which were issued in 2012 in the wake of the law's passage, described the relevant risk as “sabotage or subversion” by “foreign intelligence, terrorists, or other hostile elements.”⁴

When a source is designated a “supply chain risk,” the Secretary may exclude that source from providing equipment for DoW's “covered systems,” which are certain sensitive information technology systems used for national security purposes.⁵ The exclusion can also extend to those who provide a “covered item of supply,” which is an “item of information technology that is purchased for inclusion in a covered system, and the loss of integrity of which could result in a supply chain risk for a covered system.” 48 C.F.R. § 239.7301; see also 10 U.S.C. § 3252(d)(6).⁶ Notably, nothing in Section 3252 authorizes the Secretary to exclude a company from providing services to other government agencies. Nor does Section 3252 contain any authorization to require all defense contractors—including those whose work does not involve covered systems—to stop working with the entity.

Section 3252 does not include the standard pre-deprivation procedures for suspension or debarment of a government contractor,⁷ presumably because most hostile adversaries are foreign actors who lack due process rights. Instead, Congress required a different set of procedural safeguards. Specifically, to exclude a company as a “supply chain risk,” the Secretary must first take the following steps: (1) “consult[ ] with procurement or other relevant officials of the covered agency”; (2)“mak[e] a determination in writing” that the exclusion “is necessary to protect national security by reducing supply chain risk,” and that “less intrusive measures are not reasonably available to reduce such supply chain risk”; and (3) provide notice to the appropriate congressional committees explaining the risk and bases for the determination. 10 U.S.C. § 3252(b). DoW's regulations further require that the consultation process include “a risk assessment by the Under Secretary of Defense for Intelligence” before a designation can be made. 48 C.F.R. § 239.7304(a).

E. Under Secretary Michael's Memorandum Justifying Anthropic's Designation as a Supply Chain Risk

As noted above, the Administrative Record contains a March 3, 2026 memorandum in which Secretary Hegseth formally designated Anthropic a supply chain risk based on a joint recommendation from the Under Secretary of War for Acquisition and Sustainment and DoW's Chief Information Officer. (AR 209–12.) The joint recommendation states that after consultation “with procurement and other relevant officials within DoW and, on the basis of a risk analysis provided by DoW [Chief Information Officer],” they “recommend that there is supply chain risk to DoW covered systems related to the use of Anthropic.” (AR 210–11 (footnote omitted).) The recommendation attaches a four-page memorandum authored by Under Secretary Michael, dated March 2, 2026. (AR 213–16 (the “Michael Memo”); see also Dkt. No. 210-1 at 2 (listing date of Michael Memo).)

The Michael Memo states that AI models “are acutely vulnerable to manipulation,” and Anthropic could “attempt to disable” or “alter the behavior of the model ․ in the middle of ongoing warfighting operations.” (AR 215.) Under Secretary Michael further describes the risk of AI “drift,” in which Claude could “degrade as new data is introduced” by Anthropic. (AR 214.) He asserts that “DoW would be forced to operate a black box controlled by a hostile party, which could contain hidden biases or backdoors.” (Id.) In conclusion, Under Secretary Michael states:

In the instant case, Anthropic's risk level escalated from a potentially manageable technical and business negotiation to an unacceptable national security threat over the course of the DoW's contract negotiation with them․ The supply chain risk level increased when Anthropic insisted on terms of service that would constrain the DoW beyond what is in the law. This risk further increased when Anthropic asserted in the negotiations that it have an approval role in the operational decision chain, which would require the DoW to accept significant operational risk. Then during the final weeks of negotiations, it became clear that Anthropic was leveraging DOW's ongoing good faith negotiations for Anthropic's own public relations, and they began engaging in an increasingly hostile manner through the press, despite the ongoing private negotiations with DoW leadership. Finally, this hostile posture was even further compounded when, during a time of active military operations, Anthropic leadership questioned the use of their technology in our warfighting systems clearly permitted under the Terms of Service of their existing contract with our Prime contractor.

(AR 215.)

On March 5, 2026, DoW's Chief Information Officer sent a memorandum to DoW leadership regarding the removal of Anthropic's products in DoW Systems. (AR 241–42.) The memorandum instructs that, within 180 days, DoW components should remove Anthropic's products “from all DoW systems and networks,” as well as from various lists and markets facilitating technology procurement for DoW. (Id.) The memorandum clarifies that the “prohibition applies to all [Defense Industrial Base partner] contracts,” and the restriction should be incorporated “into all current and future contracts.” (AR 242.)

Neither the Michael Memo, nor anything else in the record, addresses what less intrusive measures DoW considered. Concurrently with entering the supply chain risk designation, Secretary Hegseth sent letters to various congressional committees advising them of his action. (AR 231–36.) The letters do not describe what less intrusive measures DoW considered prior to making the designation. (Id.)

The record reflects that after the Michael Memo was completed and Secretary Hegseth formally designated Anthropic a supply chain risk, Under Secretary Michael and Amodei's email communications nonetheless continued. On the morning of March 4, 2026, Under Secretary Michael sent an email stating: “After reviewing with our attorneys and seeing your last draft (thanks for being fast), I think we are very close here.” (Dkt. No. 166-6 at 2.) The email appears to attach updated contract language, and Under Secretary Michael states that he “hopes this works as I am running out of time.” (Id.) It is difficult to square this correspondence with Under Secretary Michael's near-contemporaneous characterization of Anthropic as a “hostile” company presenting a “fully mature” and “unacceptable” supply chain risk. (AR 214–15.)

The government's ongoing discussions with Anthropic about Mythos raise similar questions. On April 7, 2026, Anthropic publicly announced “Project Glasswing, an initiative to deploy [its new Mythos model] for defensive cybersecurity work.” (Dkt. No. 166-4 ¶ 80.) Before making Mythos available outside the company, Anthropic briefed senior officials across multiple government agencies on Mythos and later extended access to Mythos to government partners, “committed substantial resources, at no cost to national security customers, to efforts to secure critical software infrastructure,” and remains “in frequent communication with representatives of multiple agencies and departments regarding how best to use Mythos to advance U.S. objectives.” (Id. ¶¶ 80–81.) On April 17, Amodei and senior White House officials had “productive and constructive” discussions about “opportunities for collaboration” related to Mythos. (Id. ¶ 81.) Around this same time, news reports indicated that the Office of Management and Budget began “setting up protocols that would allow their agencies to begin using” Mythos, and the National Security Agency and NASA began deploying Mythos. (Dkt. No. 166-10; Dkt. No. 166-11 at 3; Dkt. No. 166-14 at 2.) Defendants do not submit any evidence explaining why the government would seek to collaborate on these types of projects with a company believed to pose an intolerable national security risk.

F. Administrative Record Regarding Concerns Raised in the Michael Memo

The Administrative Record contains very little explaining the basis for the concerns raised in the Michael Memo. Nothing in the Administrative Record describes, even at a high level, what technological means would give rise to the so-called “backdoors,” or could otherwise allow Anthropic to “disable” or affect Claude during a DoW operation. Anthropic has submitted unrebutted evidence that it lacks any technological means to access or control deployed models. It is undisputed that “Anthropic's role in deploying models on [DoW] systems is limited to providing the model” to DoW or to a primary defense contractor. (Dkt. No. 166-4 ¶ 36.) Deployed models are static, in that they cannot “degrade or change on [their] own,” and once deployed, Anthropic cannot “access, alter, or shut down” the model. (Id. ¶¶ 48–49, 56, 59–61.) Claude models cannot be “updated” like conventional software; instead, a new model must be trained to completely replace the old model. (Id. ¶ 53.) Each time a new Claude model is to be deployed, third-party cloud providers and DoW conduct security testing and independent evaluations of the model before it is approved for operational use. (Id. ¶¶ 39–42.) Models are evaluated by testing their behavior in response to prompts that mimic real-world applications, and comparing that behavior to model baselines and human responses. (Id. ¶¶ 41–46.) Anthropic does not perform or supervise the evaluation; its role is limited to responding to DoW feedback and requests. (Id. ¶¶ 41, 43.) Anthropic also cannot view DoW's prompts to Claude. (Id. ¶ 51.) The Administrative Record does not discuss DoW and its contractors' ability to test each Anthropic model pre-deployment, or why such testing would be insufficient to identify AI drift or hidden biases.

The Michael Memo also does not specify the basis for the statement that “Anthropic asserted in the negotiations that it have an approval role in the operational decision chain.” (AR 215.) There is no evidence in the record that Anthropic sought to impose any restrictions on the operational decision chain other than the usage policies at issue. Under Secretary Michael's March 24 declaration submitted in this litigation describes his reference to an “approval role” as being based on Anthropic's offer to permit an exception to the usage policies: specifically, he refers to “a contract negotiation meeting on December 4, 2025, [where] Anthropic leadership expressed that DoW would have to call Anthropic in real time to seek authorization for a usage exception to one of their redlines.” (AR 252 ¶ 7.)

Under Secretary Michael further explains in a March 17, 2026 declaration submitted in this litigation that his reference to Anthropic leadership “question[ing] the propriety” of the technology's use during an operation referred to a comment made by an unnamed Anthropic executive to a DoW operational support software vendor (the “Operation Incident”). (AR 247 ¶ 15.) The Administrative Record does not reflect whether the “questioning” referred to concerns about Claude's ability to perform the required tasks, a concern over the morality or legality of the issue in question, or some other concern. Under Secretary Michael does not identify any action taken by Anthropic to stop the use that had been questioned. It is undisputed that Amodei confirmed to DoW before the Challenged Actions were taken that Anthropic had no objection to its tools' use in that situation. (Dkt. No. 166-5 ¶ 19.)

Under Secretary Michael's March 17 declaration also references an article from TheInformation.com, which claims to publish an internal memorandum sent by Amodei to his employees on February 27, 2026. (AR 246 ¶ 12; AR 205–08.) As described, Amodei's internal memorandum was highly critical of DoW and of Anthropic's rival, OpenAI “as OpenAI announced a deal to provide AI to the Pentagon” and “hours after the Pentagon said it would sever ties with Anthropic.” (AR 205.) Amodei stated that the “safety layer” that OpenAI and DoW had allegedly agreed to was “safety theater,” and that “a lot of OpenAI and DoW messaging” was “just straight up lies about these issues.” (AR 205–07.) The memo concluded that Anthropic is being disfavored by DoW for not supporting President Trump, for “support[ing] AI regulation,” and for “h[olding] our red lines with integrity.” (AR 208.) Although Defendants now rely on the article in this litigation, nothing in the March 3 determination references the internal memorandum. Moreover, nothing in the record suggests that Defendants or the public had knowledge of the internal memorandum at the time of the March 3 determination. Defendants' Administrative Record index identifies the article as being dated March 4, 2026, the day after the determination was finalized. (Dkt. No. 210 at 1.)

G. Agency Defendants Followed the Presidential Directive

Immediately on Friday, February 27, federal agencies began taking steps to comply with the Presidential Directive. GSA issued a public announcement that “GSA stands with the President in rejecting attempts to politicize work dedicated to America's national security” and sent an alert to federal agencies that “USAi will suspend availability of all Anthropic models immediately.” (AR 360; AR 394; see also AR 400–10.) The Office of Personnel Management (“OPM”) issued an agency-wide alert that it had blocked access to Claude “[e]ffective immediately.” (AR 361.) The director of the U.S. Federal Housing Financial Agency (“FHFA”) posted on X that the agency was “terminating all use of Anthropic products.” (AR 317.) Internal communications at the Department of State include instructions “to cancel everything with Anthropic ASAP and strip them out as a sub,” “[p]er POTUS.” (AR 321.) The Department of Health and Human Services (“HHS”) issued an alert that it “will be disabling enterprise Claude.” (AR 335–37; AR 334 (instructing HHS employees on March 2 to “understand dependencies and identify potential alternatives”).) On February 28, the Nuclear Regulatory Commission (“NRC”) denied a “request to authorize [an] Anthropic Claude AI model,” explaining that “use of the model is strictly prohibited.” (AR 385.) It later issued a general announcement to the same effect. (AR 387.) NASA similarly terminated at least some access to Anthropic's services around this time. (AR 388–90.)

The following Monday, March 2, Treasury Secretary Scott Bessent reposted the Presidential Directive on X, stating that “At the direction of @POTUS, the @USTreasury is terminating all use of Anthropic products ․ within our department․” (AR 256.) By the end of the week, Anthropic models were “no longer available within the [Department of] Treasury's environment.” (AR 262.) The Securities and Exchange Commission (“SEC”) issued instructions to “pull Claude off the website and make sure it is no longer visible or accessible to be used by anyone.” (AR 340.) The National Nuclear Security Administration of the Department of Energy instructed its teams to “pause work” funded by the agency “where Anthropic's AI model or AI capability is being used,” and issued “stop-work” orders to Anthropic. (AR 517–22.) On March 3, the Department of Veterans Affairs (“VA”) suspended access to “Claud[e] for Government until further guidance is received.” (AR 527.) Department of Homeland Security (“DHS”) leadership instructed to set up “firewall blocks to restrict all-DHS users from accessing Anthropic's tools.” (AR 1576.) In early March, various offices of the Department of Commerce (“Commerce”) removed Anthropic's products from their systems. (AR 581, AR 791, AR 1571.)

H. The Challenged Actions Threaten to Cripple Anthropic and Have Chilled Speech

On March 26, 2026, the Court issued a preliminary injunction enjoining the Challenged Actions, as further described below. Prior to that point, it is undisputed that defense contractors performing work under government contracts using Claude-integrated APIs began assessing—and in many cases looking to terminate—their reliance on Anthropic in light of the Challenged Actions. (Dkt. No. 166-3 ¶ 4; Dkt. No. 166-2 ¶¶ 12–13; see also Dkt. No. 196.)

The same was true of government contractors outside of the defense sector. One Anthropic partner, which had a multi-million-dollar annual contract with Anthropic, has switched from Claude to a competing generative AI model to service a contract with the U.S. Food and Drug Administration. (Dkt. No. 166-2 ¶ 14.) Anthropic “received inquiries regarding the [Challenged Actions] from over one hundred enterprise customers expressing deep fear, confusion, and doubt about Anthropic and the repercussions of associating with [the] company,” and has fielded similar concerns from investors. (Id. ¶ 20; Dkt. No. 166-3 ¶¶ 7–9.)

Although the preliminary injunction order has limited the immediate effects of the Challenged Action, Anthropic fears that if the full extent of the supply chain risk designation and associated business restrictions are permitted to stand—and it is no longer able to do any business with federal agencies and defense contractors—it will reduce its defense contractor and other DoW-related client revenue by “50–100 percent” and its “2026 revenue by multiple billions of dollars.” (Dkt. No. 166-3 ¶ 6.) This loss is in addition to the “direct attack on the company's reputation” by means of the supply chain risk designation and the social media statements from the President and Secretary Hegseth. (Dkt. No. 166-2 ¶¶ 7–10.)

Beyond Anthropic, the harm caused by the Challenged Actions has had ripple effects through the government contracting industry, risking significant chilling effects. As several trade associations representing government contractors explain in an amicus brief:

The consequences [of the Challenged Actions] have been swift: contracts terminated, partnerships frozen, workflows thrown into disarray, and amici member companies facing a compliance crisis with no clear guidance on applicable requirements in situations where Anthropic-assisted work product is embedded into their offerings.

․

These impacts range from the challenges in continuing to provide cutting-edge commercial products and services to the government to the need for amici's member companies to reengineer their government offerings to maintain their DoW contracts. These harms affect the entire technology industry, not just Anthropic.

(Dkt. No. 196 at 5.) The trade associations express their members' fear that they too could be subject to similar actions without any prior “findings or process.” (Id. at 11–12.) Similarly, 38 employees from major companies in the AI field explain that the Challenged Actions threaten to “chill open deliberation” and “professional debate” among the people best positioned to understand AI technology and its potential for “catastrophic misuse.” (Dkt. No. 176-1 at 7, 10, 12.)

III. PROCEDURAL HISTORY

Anthropic filed this action on March 9, 2026, seeking emergency preliminary injunctive relief. (Dkt. No. 6.) The Complaint alleges that the Challenged Actions were retaliatory and constituted content and viewpoint discrimination in violation of the First Amendment (Count II), that Defendants' failure to provide pre-deprivation process to Anthropic violated the Due Process Clause of the Fifth Amendment (Count IV), and that the Presidential Directive was ultra vires in violation of the separation of powers doctrine (Count III). (Dkt. No. 1.) The Complaint also brings Administrative Procedure Act (“APA”) challenges to the Hegseth Directive and Supply Chain Designation as contrary to law and arbitrary and capricious (Count I). (Id.) Finally, the Complaint brings an APA claim against the Agency Defendants on the basis that terminating their relationship with Anthropic violated 5 U.S.C. § 558(b) (Count V). (Id.)

On March 26, the Court issued a preliminary injunction order, which enjoined Defendants' implementation of the Challenged Actions. (Dkt. No. 135); see also Anthropic PBC v. U.S. Dep't of War, 825 F. Supp. 3d 1101 (N.D. Cal. 2026). The preliminary injunction order restored the status quo as it existed prior to the Challenged Actions, and expressly did not “bar any Defendant from taking any lawful action that would have been available to it on February 27, 2026, prior to the issuances of the Presidential Directive and the Hegseth Directive and entry of the Supply Chain Designation.” (Dkt. No. 135 at 3.) It did “not require the Department of War to use Anthropic's products or services” or “prevent the Department of War from transitioning to other artificial intelligence providers, so long as those actions are consistent with applicable regulations, statutes, and constitutional provisions.” (Id.) Defendants appealed the preliminary injunction order but did not seek an emergency stay. Anthropic, PBC v. United States Department of War, No. 26-2011 (9th Cir.) (appeal filed April 2, 2026). The appeal has been stayed at the parties' mutual request pending a ruling from the D.C. Circuit in a related case. Id. at Dkt. Nos. 13, 17; see also Anthropic PBC v. United States Department of War, No. 26-1049 (D.C. Cir.).

Defendants have compiled and certified an administrative record, and the parties have filed cross-motions for summary judgment on each of Anthropic's claims. For the reasons explained below, Anthropic is entitled to summary judgment on its First Amendment and Due Process Clause claims, on its claims that the Hegseth Directive and Supply Chain Designation were contrary to law and arbitrary and capricious under the APA, and on its claim against the majority of the Agency Defendants that their actions to terminate their relationship with Anthropic violated 5 U.S.C. § 558(b). Defendants are entitled to summary judgment as to the ultra vires claim, and with respect to the Agency Defendants who undisputedly did not take any relevant action, or took only interim measures with respect to the Section 558 claim.

IV. LEGAL STANDARD

Federal Rule of Civil Procedure 56 provides that a “court shall grant summary judgment [to a moving party] if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). An issue of fact is genuine only if there is sufficient evidence for a reasonable jury to find for the nonmoving party. See Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248–49 (1986). “The mere existence of a scintilla of evidence ․ will be insufficient; there must be evidence on which the jury could reasonably find for the [nonmoving party].” Id. at 252. At the summary judgment stage, evidence must be viewed in the light most favorable to the nonmoving party and all justifiable inferences are to be drawn in the nonmovant's favor. See id. at 255.

When a plaintiff moves for summary judgment on claims that it has brought (i.e., for which it has the burden of proof), it “must come forward with evidence which would entitle it to a directed verdict if the evidence went uncontroverted at trial.” Houghton v. South, 965 F.2d 1532, 1536 (9th Cir. 1992) (citations omitted). When a defendant moves for summary judgment based on a claim for which the plaintiff bears the burden of proof, the defendant need only point to the plaintiff's failure “to make a showing sufficient to establish the existence of an element essential to [the plaintiff's] case.” Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986).

As to the APA claims, judicial review of agency action applies a deferential standard of review. An agency action may be set aside only if it is “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. § 706(2)(A). An agency action is arbitrary and capricious where “the agency has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, [or] offered an explanation for its decision that runs counter to the evidence before the agency.” Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983). The party challenging the agency's action carries the burden of persuasion. Ctr. for Cmty. Action & Env't Just. v. Fed. Aviation Admin., 18 F.4th 592, 599 (9th Cir. 2021). “Summary judgment is an appropriate procedure for deciding challenges under the APA.” Ecological Rts. Found. v. Fed. Emergency Mgmt. Agency, 384 F. Supp. 3d 1111, 1119 (N.D. Cal. 2019) (citation omitted). Reviewing the administrative record, the district court “is to determine whether or not as a matter of law the evidence in the administrative record permitted the agency to make the decision it did.” Occidental Engineering Co. v. Immigr. & Naturalization Serv., 753 F.2d 766, 769 (9th Cir. 1985).

V. DISCUSSION

A. Anthropic Is Entitled to Summary Judgment on Its First Amendment Claim

Anthropic is entitled to summary judgment on its First Amendment claim. The undisputed facts establish that Anthropic's protected speech, on a matter of great public importance, was a substantial motivating factor for Defendants' speech-chilling conduct, and that Defendants would not have taken the retaliatory action absent their desire to make an example of Anthropic for its public stance on the weighty issues at stake in the contracting dispute.

1. Anthropic Has Made Its Prima Facie Showing

On its First Amendment claim, Anthropic carries the burden to establish “that (1) it engaged in constitutionally protected activity; (2) the defendant's actions would ‘chill a person of ordinary firmness' from continuing to engage in the protected activity; and (3) the protected activity was a substantial motivating factor in the defendant's conduct.” Ariz. Students' Ass'n v. Ariz. Bd. of Regents, 824 F.3d 858, 867 (9th Cir. 2016). Anthropic has made the necessary showing that there is no material dispute of fact as to each of these elements.

First, Anthropic has shown that it engaged in protected activity. Consistent with a longstanding practice of public speech on AI safety, Amodei—on behalf of Anthropic—engaged in a public debate over DoW's views of the safety restrictions required for Claude and the role of Anthropic in setting those safety restrictions. Supra § II.A–B. He communicated Anthropic's position face-to-face to Secretary Hegseth, and then publicly discussed that conversation. Id. This “speech on matters of public concern” is at “the heart of the First Amendment's protection.” Snyder v. Phelps, 562 U.S. 443, 451–52 (2011) (cleaned up) (citation omitted). Such speech “is more than self-expression; it is the essence of self-government,” and it “occupies the highest rung of the hierarchy of First Amendment values.” Id. at 452 (citations omitted).

Defendants nonetheless insist that speech with any nexus to contract negotiations cannot be protected speech at all. (Dkt. No. 214 at 18 (“[N]o speech or expressive conduct is at issue.”).) This position is unsupported. It is well established that contract negotiations may give rise to “controversial subjects” of great public importance, and “that such speech occupies the highest rung of the hierarchy of First Amendment values and merits special protection.” Janus v. Am. Fed'n of State, Cty. & Mun. Emps., Council 31, 585 U.S. 878, 913–14 (2018) (cleaned up) (citing Snyder, 562 U.S. at 451–52). In Nat'l Rifle Ass'n of Am. v. Vullo, 602 U.S. 175 (2024), the Supreme Court expressly rejected the notion that the government's attempt to suppress speech by targeting “business practices and relationships” meant that matter involved only “nonexpressive activity” that could not give rise to a First Amendment claim. Id. at 196–97. By repeatedly informing DoW, privately and publicly, of its redlines and the practical and moral reasons for those redlines, Anthropic was engaging in protected speech.

The second prong is also satisfied, as Defendants do not dispute. Anthropic has submitted evidence that the Challenged Actions threaten to cripple the company and chill public debate. Supra § II.H. Several amicus briefs reinforce this conclusion. A group of 38 individuals working on AI technology assert that the Challenged Actions “chill[ ] professional debate on the benefits and risks of frontier AI systems and various ways that risks can be addressed to optimize the technology's deployment.” (Dkt. No. 176 at 10.) Trade associations discuss how their government contractor members face deep uncertainty and fear that they could be subject to similar actions in the future. (Dkt. No. 196 at 5, 11.) In short, the Challenged Actions easily qualify as ones which would chill a person of ordinary firmness from continuing to engage in further protected speech.

Finally, both the form and the timing of the Challenged Actions show that the measures were a direct response to Anthropic's public repudiation of DoW's contracting request and its perceived use of public scrutiny to “strong arm” DoW into changing its mind. See Alpha Energy Savers, Inc. v. Hansen, 381 F.3d 917, 929 (9th Cir. 2004) (explaining that proximity in time between protected expression and retaliation, and the fact that “defendants expressed opposition to [plaintiff's] speech” are classic evidence of motive). Secretary Hegseth expressly tied Anthropic's punishment to its attitude and rhetoric in the press. He stated that “Anthropic delivered a master class in arrogance.” (AR 255B.) Referring to Anthropic and Amodei, he further stated: “Cloaked in the sanctimonious rhetoric of ‘effective altruism,’ they have attempted to strong-arm the United States military” through their “corporate virtue-signaling” and “Silicon Valley ideology.” (Id.) “Anthropic's stance is fundamentally incompatible with American principles.” (Id.) The President described Anthropic as a “RADICAL LEFT, WOKE COMPANY” and its employees as “Leftwing nut jobs,” who “made a DISASTROUS MISTAKE trying to STRONG-ARM the Department of War.” (AR 255A.) Read in the context of these repeated references to rhetoric and ideology, the term “strong-arm” in the Presidential Directive and the Hegseth Directive is best read as characterizing Anthropic as applying public pressure. That is the most straightforward interpretation of the record, given the undisputedly staid and respectful nature of the long-running private contract negotiations, as well as Anthropic's offer to facilitate an orderly transition to another vendor if the parties could not come to terms. (AR 2–47; Dkt. No. 166-5 ¶ 12.) Furthermore, the decision to publicly broadcast Anthropic's punishment via social media—even before the formal, administrative process of making the necessary findings to designate Anthropic a supply chain risk had begun—makes little sense except as an attempt to swiftly make a public example of Anthropic for daring to criticize the Administration.

Like the Directives, the Supply Chain Designation materials contain repeated references to Anthropic's public airing of its dispute with DoW as the reason that it is no longer trustworthy and therefore suitable to be designated a supply chain risk. (AR 213–14 (describing how Anthropic “opted to publicly spat with DoW” as a basis to distrust it); id. at 214–15 (same with respect to “the public statements of Anthropic's CEO and others associated with the company”).) The memo finds that Anthropic's “risk level escalated” into a “supply chain risk” principally because it was “leveraging the DoW's ongoing good faith negotiations for Anthropic's own public relations” and its “increasingly hostile manner through the press.” (Id. at 215.) These specific references to Anthropic's viewpoint and public stance are direct evidence that Anthropic's speech was a substantial motivating factor in Defendants' decision-making.

2. Defendants Do Not Meet Their Burden of Rebutting Anthropic's Prima Facie Showing

Because Anthropic has made its prima facie showing, “the burden shifts to [Defendants] to demonstrate that even without the impetus to retaliate [they] would have taken the action complained of.” Hartman v. Moore, 547 U.S. 250, 260 (2006); CarePartners, LLC v. Lashway, 545 F.3d 867, 877 (9th Cir. 2008) (“[A] defendant must show ․ that it would have reached the same decision; it is insufficient to show merely that it could have reached the same decision.” (emphasis in original)). Defendants argue that even if Anthropic's public statements constitute protected speech, “[h]ad Anthropic refused to accept DoW's contractual term without making any public statements, DoW still would have assessed the same risk.” (Dkt. No. 238 at 10; see also Dkt. No. 214 at 20–23.) They point out that while Anthropic and Amodei have long advocated for AI safety, Defendants took the Challenged Actions only after Anthropic refused to remove its usage restrictions.

Defendants, however, have not carried their burden to show that Anthropic's contracting position alone would have brought about the Challenged Actions. First, in a filing contemporaneous with the summary judgment briefing, Defendants assert that “DoW is concerned about the risk that, regardless of DoW's contractual rights․, Anthropic ‘could ․ preemptively and surreptitiously alter the behavior of the model in advance’ to reflect ‘its moral and policy judgments’ without DoW's knowledge or consent.” (Dkt. No. 213 at 4 (emphasis added).) In other words, Defendants concede that Anthropic could not have avoided the Challenged Actions by simply accepting DoW's terms on February 27, 2026.

Second, Anthropic's preferred usage restrictions were the status quo for two years, during which it is undisputed Anthropic was given high levels of security clearance and was consistently praised. The parties' private negotiations over the usage restrictions likewise remained consistently respectful. Nothing about the parties' historic relationship indicates a lack of trust by DoW towards Anthropic. Defendants point to a single, elliptical reference to “the threat environment” and the general need for “trust” in one of Under Secretary Michael's contract negotiation emails as evidence that DoW's “trust” in Anthropic came into question during the contract negotiations. (Dkt. No. 238 at 10 (citing AR 7).) The message that Defendants reference asks that Anthropic trust DoW and its “principle of all lawful use cases,” not the other way around. (AR 7.) There is no discussion of Anthropic's untrustworthiness or of a potential supply chain risk anywhere in the record until after the parties' discussions became public (AR 3–4; AR 136–51), at which point Secretary Hegseth first raised the possibility of a supply chain risk designation (Dkt. No. 166-5 ¶ 17.)⁸ Then, the day after Amodei publicly addressed Anthropic's dispute with DoW, Defendants adopted the punitive measures at issue, expressly tying them to the company's rhetoric and ideology.

Defendants say that “if this were really about speech, DoW would not have continued negotiations after Anthropic's public statements.” (Dkt. No. 238 at 9.) The record supports the opposite conclusion. It shows two separate courses of action taking place within the government in early 2026. First, contract negotiations were unfolding via email through March 4, 2026, with apparent optimism that a deal could be reached. Simultaneously, in the midst of extensive media coverage of Anthropic's criticism of the government's position, Secretary Hegseth threatened to designate Anthropic a supply-chain risk, and then Defendants publicly announced punitive measures the day after Amodei's public post criticizing the government's position. These parallel tracks indicate that Defendants viewed the public nature of Anthropic's speech, not its private contracting position, as the “strong arm” tactics that merited a public punishment. While the record plausibly supports that Defendants would have quietly made a deal with Anthropic after meting out its public punishment, this fact only supports the retaliatory nature of the Challenged Actions.

3. The Pickering Framework Does Not Apply

The Supreme Court has recognized that the government may impose “certain restraints on the speech of its employees” that would be “unconstitutional if applied to the general public.” City of San Diego v. Roe, 543 U.S. 77, 80 (2004) (per curiam). When the government is acting as an employer, rather than as a sovereign, its “interest in achieving its goals as effectively and efficiently as possible is elevated from” that interest's otherwise “relatively subordinate” position with respect to the free speech rights of employees. Bd. of Cty. Comm'rs, Wabaunsee Cty., Kan. v. Umbehr, 518 U.S. 668, 676 (1996). The same principles have been extended to independent government contractors in circumstances where the government is exercising its “contractual power.” Id. at 678, 684–85. Where such additional deference is triggered, courts balance the competing interests using the “Pickering framework” as laid out in Pickering v. Bd. of Ed. of Twp. High Sch. Dist. 205, 391 U.S. 563 (1968) and its progeny.

The Pickering framework is inapplicable here because the Challenged Actions were an exercise of sovereign power, not contractual power. Pickering traditionally applied to adverse employment actions and equivalent contractual actions, like contract terminations or refusal to award a contract. See, e.g., Umbehr, 518 U.S. at 671 (contract termination); Riley's Am. Heritage Farms v. Elsasser, 32 F.4th 707, 718 (9th Cir. 2022) (contract termination and policy of refusing to patronize business); Alpha Energy Savers, Inc., 381 F.3d at 923 (refusal to award contracts). In each of these cases, the government was clearly exercising its contractual powers. The same cannot be said of the Challenged Actions, which extend far beyond the limited scope of preparing to terminate a government contract. Not only was Anthropic permanently debarred from contracting with any federal agency, the Challenged Actions also included imposing a secondary boycott that by its terms extends far beyond the government supply chain. As Defendants' counsel conceded at oral argument, actions outside of maintaining or terminating contractual relationships are not subject to the Pickering framework. (Dkt. No. 247 at 19.)

Furthermore, the public labeling of Anthropic as an adversary of the United States and an “out-of-control, Radical Left AI company” that was attempting to “seize veto power over the operational decisions of the United States military” reflects a concerted effort to make an example of Anthropic. (AR 255A–B.) A public example, by definition, operates by deterring third-party behavior; here, the audience would presumably be other AI companies and defense contractors. Broader regulation of activity is a classic exercise of sovereign power and bears no apparent relationship to the “requirements of the government as employer.” Engquist v. Oregon Dep't of Agr., 553 U.S. 591, 600 (2008) (instructing courts to analyze whether the “claimed right can more readily give way to the requirements of the government as employer”). Viewed holistically, as Defendants concede the Challenged Actions must be viewed (Dkt. No. 247 at 19–20), the Pickering framework does not apply.

4. Applying Pickering Leads to the Same Result

Moreover, even if the more flexible Pickering framework were applied, Anthropic has still shown that it is entitled to summary judgment. Under the framework, Anthropic must show it engaged in expressive conduct about a matter of public concern; government officials took adverse action against it; and its expressive conduct was a substantial or motivating factor for the adverse action. Damiano v. Grants Pass Sch. Dist. No. 7, 140 F.4th 1117, 1137 (9th Cir. 2025). In other words, Anthropic's prima facie showing under the traditional test satisfies its burden under the Pickering framework so long as Anthropic is speaking on a matter of public concern. As already explained, Anthropic satisfies this burden. The government argues that “Anthropic's public airing of its objections to DoW's contractual terms does not transform this into a matter of public concern protected by the First Amendment.” (Dkt. No. 214 at 10.) However, “attempt[s] to reach the general public” are “considered relevant in other public concern cases.” Havekost v. U.S. Dep't of Navy, 925 F.2d 316, 319 (9th Cir. 1991). And as the Supreme Court explains in Janus, matters of “great public concern” can arise in the context of contract negotiations, and the government does not get a pass on upholding First Amendment protections simply because it is engaged in contract negotiations. Janus, 585 U.S. 878, 910–14 (“[I]t is impossible to argue that the level of ․ state spending for employee benefits,” the subject of the contract negotiations between the union and the government, “is not a matter of great public concern.”). Anthropic was not critiquing a “single contract” (Dkt. No. 238 at 8); it was discussing the appropriate limits on the government's use of frontier AI technology. That is a matter of public concern.

Next, the burden shifts to the government to show that it has “legitimate administrative interests” that “outweigh [Anthropic's] right to engage in the expressive activity at issue.” Damiano, 140 F.4th at 1138.⁹ Defendants' asserted interest relies on the following logic: Due to Anthropic's “questioning” of DoW's position around use of Claude, the ongoing limits imposed by Anthropic's usage policy, the CDC Incident, and Operation Incident, DoW lost trust in Anthropic. To be clear, Defendants had not, and have not, identified an articulable basis to believe that Anthropic has actually tried to interfere with DoW's operations or that it plans to do so. However, because it determined that Anthropic was untrustworthy, DoW concluded that “ ‘there is a substantial risk’ that Anthropic” might interfere with “warfighting operations” or might otherwise subvert national security systems. (Dkt. No. 214 at 20 (citing AR 214–15).) Therefore, Defendants argue, in furtherance of its compelling legitimate interest in protecting national security, DoW took the Challenged Actions, notwithstanding the chilling effect it would have on Anthropic and others' speech.

This justification fails as a matter of law. The Challenged Actions far exceed the scope of what could reasonably be interpreted as an effort to mitigate the undisputedly hypothetical risk that Anthropic might secretly poison its model. The Presidential Directive ordered a permanent federal-government-wide bar (extending to agencies that play no role in national security operations), and the Hegseth Directive, on its face, blacklisted Anthropic by purporting to bar anyone from doing business with both the U.S. military and Anthropic, even if the relationship between the two private companies was entirely unrelated to any U.S. military work. Defendants point to no evidence suggesting that such broad actions were necessary to protect national security. Furthermore, Defendants' conclusions underlying the Supply Chain Designation about the unique technological risks Anthropic posed were undisputedly incorrect. Infra Section V.B.2.

Defendants' asserted national security concerns are further contradicted by their actions shortly before, immediately after, and since the Supply Chain Designation. Shortly before, in the February 24 meeting, Secretary Hegseth raised the possibility of invoking the Defense Production Act, meaning Anthropic was essential to national security rather than a threat to it. (Dkt. No. 166-5 ¶ 17; Dkt. No. 166-9 at 3.) Immediately after the designation, Under Secretary Michael told Anthropic that a deal was “very close.” (Dkt. No. 166-5 ¶ 27.) Since the designation, the White House has “discussed opportunities for collaboration” with Anthropic utilizing its new Mythos model, and these discussions appeared to range across a variety of sensitive contexts. (Dkt. No. 166-4 ¶ 81.) Those actions are inconsistent with any genuine belief that Anthropic is an adversary of the United States who might secretly poison its model to undermine national security. As such, the government has failed, under even a deferential review, to show that a legitimate national security interest outweighed Anthropic's speech rights.

This case bears no resemblance to American Federation of Government Employees, AFL-CIO v. Trump, 178 F.4th 456 (9th Cir. 2026). There, the challenged executive order had no retaliatory language and had a “legitimate grounding in national security concerns.” Id. at 466–67. As a result, the Ninth Circuit found that stray hostile remarks in a sheet of talking points that accompanied the order were insufficient to show retaliation because the government “would have[ ] issued [the executive order] in the absence of the asserted retaliatory animus.” Id. at 467–68. By contrast, the Challenged Actions themselves contain retaliatory language. Their retaliatory nature appears to be the principal purpose of the actions, rather than constituting stray remarks. And Defendants have not identified legitimate national security justifications for the sweeping prohibitions at issue.

Although courts owe deference to the government on issues of national security, “concerns of national security and foreign relations do not warrant abdication of the judicial role.” Holder v. Humanitarian L. Project, 561 U.S. 1, 34 (2010). Courts cannot “defer to the Government's reading of the First Amendment, even when such interests are at stake,” and “the Government's ‘authority and expertise in these matters do not automatically trump the Court's own obligation to secure the protection that the Constitution grants to individuals.’ ” Id. (citation omitted); see also Twitter, Inc. v. Garland, 61 F.4th 686, 699 (9th Cir. 2023) (same). Defendants' counsel's position at oral argument betrays the slippery slope ahead if the government is permitted to retaliate against those who dissent, in the name of national security, based only on a purported lack of trust. When asked whether terminating a contract for the undisputed sole purpose of “stop[ping] public criticism of the President” would violate the First Amendment, counsel was “reticent to offer” a yes or no answer or “foreclose a potential argument” in a future case. (Dkt. No. 247 at 16–17.) But the argument is already foreclosed. “Criticism of government is at the very center of the constitutionally protected area of free discussion.” Rosenblatt v. Baer, 383 U.S. 75, 85 (1966).

No reasonable factfinder could conclude that the Challenged Actions were a “reasonable and effective” means of serving that interest Defendants have asserted. Edgar v. Haines, 2 F.4th 298, 314–15 (4th Cir. 2021).¹⁰ Anthropic is entitled to summary judgment on its First Amendment claim as to all Defendants other than those for whom Anthropic concedes there is no evidence that they participated in carrying out the Challenged Actions: National Endowment for the Arts, the Social Security Administration, the Federal Reserve Board of Governors, the Executive Office of the President, and their respective heads, and as to Does 1–10 (together, “Non-Participating Defendants”). (Dkt. No. 234 at 29 n 6.) Defendants' motion for summary judgment on the First Amendment claim is granted as to the Non-Participating Defendants and otherwise denied.

B. Anthropic Is Entitled to Summary Judgment on Its Due Process Clause Claim

“Due process requires notice ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of [a government] action and afford them an opportunity to present their objections.’ ” Al Haramain Islamic Found., Inc. v. U.S. Dep't of Treasury, 686 F.3d 965, 985 (9th Cir. 2012) (quoting United Student Aid Funds, Inc. v. Espinosa, 559 U.S. 260, 272 (2010)). Anthropic argues that Defendants violated Anthropic's procedural due process rights when they summarily blacklisted it and designated it a supply chain risk. Defendants respond that their actions did not impair any protectible interest Anthropic might have and that even if they did, pre-deprivation process was not necessary.

The Mathews v. Eldridge, 424 U.S. 319 (1976) balancing test governs this claim. Al Haramain, 686 F.3d at 985. Under Mathews, the Court “must weigh (1) [Anthropic's protected] interest, (2) the risk of an erroneous deprivation of such interest through the procedures used, as well as the value of additional safeguards, and (3) the Government's interest in maintaining its procedures, including the burdens of additional procedural requirements.” Foss v. Nat'l Marine Fisheries Serv., 161 F.3d 584, 589 (9th Cir. 1998) (citing Mathews, 424 U.S. at 334–35). This case raises interests that could potentially weigh heavily on both sides of the scale. Anthropic's interest in its reputation and in its continued eligibility to compete for federal work is undoubtedly significant. On the other hand, the importance of a genuine and urgent government interest in national security “cannot be understated.” Al Haramain, 686 F.3d at 980. “Striking a balance between those two strong competing interests cannot be done in the abstract.” Id. Therefore, this Order “carefully assess[es] the precise ‘procedures used’ by the government, ‘the value of additional safeguards,’ and ‘the burdens of additional procedural requirements.’ ” Id. (quoting Foss, 161 F.3d at 589).

1. Anthropic Has a Protectible Liberty Interest

Anthropic has shown that it has a protectible liberty interest under the “stigma-plus” doctrine. Under that doctrine, a plaintiff must show both a reputational harm, and that “the government has deprived the plaintiff of some benefit to which it has a legal right.” Hesai Tech. Co., Ltd v. United States Dep't of Def., No. 25-5256, ––– F.4th ––––, 2026 WL 2409540, at *3 (D.C. Cir. Aug. 18, 2026) (cleaned up) (citing Gen. Elec. Co. v. Jackson, 610 F.3d 110, 121 (D.C. Cir. 2010)); see also Fikre v. Fed. Bureau of Investigation, 35 F.4th 762, 776 (9th Cir. 2022) (“[R]eputational harm caused by the government can constitute the deprivation of a cognizable liberty interest if a plaintiff was stigmatized in connection with the denial of a more tangible interest.” (cleaned up)), aff'd, 601 U.S. 234 (2024).¹¹ Applying this doctrine, the Supreme Court found a protectible liberty interest where a law permitted public postings that identified individuals as “excessive drink[ers]” and barred others from selling them liquor. Wisconsin v. Constantineau, 400 U.S. 433, 434–37 (1971). Because the posting attached a “stigma or badge of disgrace” to the identified individual and contained a legal prohibition, it triggered due process protection. Id. at 436. Similarly, the D.C. Circuit recently found that the government's labeling of a company as a “Chinese military company” on a public list constituted a “blow to [the] company's reputation” and made Hesai “automatically ineligible for certain government contracts and forms of financial assistance.” Hesai Tech., 2026 WL 2409540, at *4. When these two factors were taken together, Hesai had been deprived of a protectible liberty interest. Id.

Like Hesai's labeling, the Challenged Actions deprive Anthropic of a protected liberty interest. First, Anthropic has shown that it suffered a reputational injury when Secretary Hegseth “direct[ed] the Department of War to designate Anthropic a Supply-Chain Risk to National Security.” (AR 255B; AR 209–12.) The designation officially labeled Anthropic an “adversary” of the United States, and was accompanied by contemporaneous public statements from the President calling Anthropic a company that puts “AMERICAN LIVES at risk, our Troops in danger, and our National Security in JEOPARDY.” (AR 255A.) Defendants argue that Anthropic has not experienced actual stigma, citing sources from April and June 2026 discussing Anthropic's revenue growth during that period. (Dkt. No. 214 at 23.) However, there is little evidentiary value to analyzing Anthropic's financial viability after entry of the order preliminarily enjoining the Challenged Actions. Furthermore, these news stories do not create a material dispute with respect to the objective meaning of formally designating a company an “adversary” and a risk to national security. No reasonable factfinder could conclude that Anthropic's “good name, reputation, honor, or integrity” were not “at stake” due to the designation and the directives. Constantineau, 400 U.S. at 437.

Anthropic has also shown that the reputational harm was accompanied by the loss of benefits to which it has a legal right. The Presidential Directive ordered “EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic's technology. We don't need it, we don't want it, and will not do business with them again!” (AR 255A.) The Hegseth Directive ordered that, “[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.” (AR 255B.) The Supply Chain Designation rendered Anthropic permanently ineligible to be a defense contractor or subcontractor. (AR 209–12.) In other words, before February 27, 2026, Anthropic had the right to be considered for federal government work (whether as a contractor or subcontractor), and to work with other defense contractors, but it lost that right as a result of the Challenged Actions. Regardless of whether Anthropic had any protectible interest in its existing contracts, depriving someone of the “ ‘right to be considered for government contracts in common with all other persons’ is the prototypical example of a sufficient change in legal status.” Hesai Tech., 2026 WL 2409540, at *4 (emphasis added) (citing Gen. Elec. Co., 610 F.3d at 121).

Finally, Defendants argue that because the record does not establish that every federal agency immediately complied with the Challenged Actions prior to the entry of the preliminary injunction, Anthropic has not shown that it experienced the necessary deprivation. (Dkt. No. 214 at 23.) This is the wrong inquiry. The proper focus is on the Challenged Actions and the scope of conduct the agencies were instructed to take, not how quickly those instructions were implemented across the board. The record shows that the Challenged Actions facially prohibited Anthropic from working directly with any federal agency, or with defense contractors in any capacity, which Anthropic estimates would have cost it billions of dollars in lost revenue in 2026 alone. (Dkt. No. 166-3 ¶ 6.)

Thus, the undisputed facts establish that Anthropic has a significant protectible liberty interest.¹²

2. A Serious Risk of Erroneous Deprivation Exists, and Defendants Have Not Shown Any Urgency Supporting the Need to Bypass Pre-Deprivation Process

“[A]bsent exigent circumstances,” due process must happen “before [a] final deprivation.” Esparraguera v. Dep't of the Army, 101 F.4th 28, 40 (D.C. Cir. 2024). The record reflects that the Challenged Actions were taken without any meaningful notice or pre-deprivation process (and, in the case of the Presidential Directive and the Hegseth Directive, without offering any post-deprivation agency process either). Although Anthropic was on notice that the government objected to its contracting terms, it had no notice or opportunity to object before Defendants publicly barred it from all federal government work and blacklisted it with defense contractors. It also had no notice or opportunity to object to the factual basis for its designation as a supply chain risk, which it learned of in this litigation. (Dkt. No. 115 ¶ 5.)

Anthropic has also shown that meaningful pre-deprivation notice of DoW's concerns and an opportunity to respond were necessary to avoid the risk of erroneous deprivation here, because DoW's risk assessment was based on a core misunderstanding about how Anthropic's technology works, which it could have readily dispelled. Ralls Corp. v. Comm. on Foreign Inv. in the U.S., 758 F.3d 296, 318 (D.C. Cir. 2014). As the Administrative Record reflects, the Michael Memo is the sole analysis on which the Supply Chain Designation is based. The primary risk discussed in the Michael Memo is the possibility that Anthropic would “cause [its] software to stop working or cause some other disastrous action that would put our warfighters lives in danger.” (AR 213.) The Michael Memo states that Anthropic could “disable its technology,” or “alter the behavior of the model ․ in the middle of ongoing warfighting operations, if it feels that its ‘redlines’ are crossed.” (AR 214–15.) Under Secretary Michael therefore asserts that “DoW would be forced to operate a black box controlled by a hostile party, which could contain hidden biases or backdoors.” (AR 214.) The Administrative Record contains no evidence substantiating the technological means by which Anthropic could take such action.

Anthropic has submitted declarations from its Chief Science Officer and its Head of Public Sector providing a detailed and undisputed explanation of Anthropic's relevant technological capabilities. (Dkt. Nos. 166-1, 166-4.)¹³ As the declarations state, each new Claude model deployed in a DoW system is independently tested by DoW and third-party cloud providers before the model can be approved and deployed. (Dkt. No. 166-4 ¶¶ 39–46.) Deployed models are static: They cannot “degrade or change on [their] own,” and once deployed, Anthropic cannot “access, alter, [ ] shut down” the model, or control it in any way. (Id. ¶¶ 48–49, 56, 59–61.) Claude models also cannot be “updated” like conventional software; instead, a new model must be trained to completely replace the old model, after testing and approval by DoW. (Id. ¶ 53.)

Defendants do not claim that any evidence supports that Anthropic has the ability to disrupt or otherwise affect deployed models mid-operation, thereby conceding that this risk was entirely unfounded. Instead, Defendants' summary judgment briefing focus exclusively on what appears to be a secondary purported technological concern described in the Michael Memo: that because AI “technology itself” is inherently “opaque,” new models from Anthropic could include an “unapproved, vendor-side modification” that might introduce hard to detect “vulnerabilities” into DoW systems. (AR 214.) However, as to the version of Anthropic's tools currently in use, the unrebutted record shows that DoW extensively tests Anthropic's models before each one is deployed, including by prompting them with the very scenarios DoW intends to use the models for. Supra § II.F. Defendants do not introduce any evidence to counter Anthropic's evidence that the existing testing regime would be sufficient to identify “vulnerabilities” introduced by Anthropic. Nor do they claim that their “audit for any malicious or unintended software intrusions to existing Anthropic technology” has turned up any evidence of malfeasance. (AR 254 ¶ 16.) To the extent the concern is whether hypothetical future models might contain vulnerabilities, DoW does not contest that it controls when future Anthropic models would be deployed. Accordingly, concerns about future models are not exigent and would not exempt Defendants from providing Anthropic with pre-deprivation process.

Defendants argue that the post-deprivation opportunity to seek reconsideration of the Supply Chain Designation, or to seek judicial review via an APA challenge or breach of contract claim, offer Anthropic sufficient process. (Dkt. No. 214 at 24.) But Defendants have not shown that a “strong justification” existed for bypassing pre-deprivation process. Garza v. Woods, 150 F.4th 1118, 1130 (9th Cir. 2025) (citation omitted). Genuine exigency, such as the risk of “asset flight” when the government intends to freeze the resources of a suspected terrorist group, can justify post-deprivation process. Al Haramain, 686 F.3d at 985. However, where the government has not made a “showing of particularized need” for urgency and labels an organization a national security risk, it must first “notify the organization[ ] ․, disclose the unclassified materials on which [it] proposed to rely, and afford them an opportunity, at least in written form, to rebut ․ [or] negate the basis for designation.” Hesai Tech., 2026 WL 2409540, at *5 (cleaned up); Nat'l Council of Resistance of Iran v. Dep't of State (“NCRI”), 251 F.3d 192, 207–08 (D.C. Cir. 2001) (same); People's Mojahedin Org. of Iran v. U.S. Dep't of State (“PMOI”), 613 F.3d 220, 227 n.4 (D.C. Cir. 2010) (explaining that a deprivation without advance notice requires an “adequate showing that earlier notification would impinge upon the security and other foreign policy goals of the United States” (cleaned up)). The D.C. Circuit has applied this requirement to the “Chinese military company” designation in Hesai and to Foreign Terrorist Organization designations in NCRI and PMOI. There is no principled basis to distinguish the Section 3252 designation from the designations in those cases, and Defendants identify none. Defendants' general invocation of “national security” is an insufficient reason to strip Anthropic of pre-deprivation process. Hesai Tech., 2026 WL 2409540, at *5–6.

Finally, Defendants argue that because Section 3252 permits DoW “to limit disclosure of information” related to designations in some circumstances, “[d]ue process was satisfied.” (Dkt. No. 214 at 24 (quoting 10 U.S.C. § 3252(c)).)¹⁴ It is true that Section 3252 will often involve a “supply chain risk designation” without pre-deprivation process, and in many instances, this will not run afoul of the Constitution because the government has shown exigent circumstances or the target is either a foreign actor lacking due process rights or a hostile party that does not significantly rely on federal contracting. Here, though, Anthropic is a domestic company with a significant federal contracting business, and no exigency has been shown. Compliance with the statutory requirements does not relieve the government of its due process obligations under the Constitution. See, e.g., United States v. Rivera-Valdes, 157 F.4th 978, 989 (9th Cir. 2025); NCRI, 251 F.3d at 196 (“While we determine that the designation was in compliance with the statute, we further determine that the designation does violate the due process rights of the petitioners under the Fifth Amendment.”). As to the argument that Section 3252 permits limitation of disclosures, Defendants have not submitted any evidence indicating that concerns about sensitive information prevented them from providing Anthropic with notice. Indeed, Defendants filed the entire Administrative Record on the Court's public docket.

The record shows that, except for the Non-Participating Defendants, Agency Defendants began complying with the Presidential Directive—or in the case of DoW, began complying with the Supply Chain Designation—before Anthropic had been provided with any notice or opportunity to challenge the decisions. Supra § II.G. Therefore, Anthropic has shown that the Agency Defendants' actions violate due process for the same reasons discussed above.

Anthropic is entitled to summary judgment on its Due Process Clause claim as to all Defendants other than Non-Participating Defendants. Defendants' motion for summary judgment on the Due Process Clause claim is granted as to Non-Participating Defendants, and otherwise denied.

C. Anthropic Is Entitled to Summary Judgment on Its APA Challenge to the Hegseth Directive and the Supply Chain Designation

Under the APA, an agency action must be set aside and held unlawful if it is “arbitrary, capricious, an abuse of discretion,” “in excess of statutory jurisdiction, authority, or limitations, or short of statutory right,” or “without observance of procedure required by law.” 5 U.S.C. § 706(2)(A), (C), (D). Anthropic has shown that the Hegseth Directive and the Supply Chain Designation were in excess of statutory authority, contrary to law, and arbitrary and capricious.

1. The Secondary Boycott Instituted Through the Hegseth Directive Was a Final Agency Action in Excess of Statutory Authority and Contrary to Law

Secretary Hegseth's February 27 order that “[e]ffective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic” is a final agency action and thus is subject to APA review. (AR 255B.) On its face, the order is the “consummation” of a decision-making process and “legal consequences [ ] flow” from it. Bennett v. Spear, 520 U.S. 154, 178 (1997) (citations omitted). Absent recission, which has not occurred to this day,¹⁵ any company doing business with both Anthropic and DoW between the time of the post and when the preliminary injunction issued in this case would have been in violation of the order. Indeed, Anthropic submits evidence that several law firms sent client alerts “describing the potentially far-reaching nature of the government's actions and suggesting that Department contractors may be best served by reevaluating their relationship with Anthropic.” (Dkt. No. 166-3 ¶ 4.)

Defendants ask the Court to ignore the plain language of the directive, and instead to assume that Secretary Hegseth could not have meant what he said because he concededly lacked the requisite authority to issue such a broad order. (Dkt. No. 238 at 12–13.) But final agency action analysis is “pragmatic.” F.T.C. v. Standard Oil Co. of California, 449 U.S. 232, 239 (1980). It is relevant to this inquiry that Secretary Hegseth, not a “subordinate official,” issued a directive that “definitively stated [DoW's] position” and “mandates compliance now.” Planned Parenthood of Greater New York v. U.S. Dep't of Health & Hum. Servs., No. 25-cv-2453, 2025 WL 2840318, at *17–19, *23 (D.D.C. Oct. 7, 2025) (citations omitted). It is also relevant that DoW has broad authority to choose which defense contractors to work with, Perkins v. Lukens Steel Co., 310 U.S. 113, 127 (1940), allowing it to enforce the Directive by quietly declining to enter into future contracts with defense contractors who violate it.

Therefore, “the fact that the underlying process may be ‘informal’ or otherwise deficient does not make the [Hegseth Directive] any less a final agency action.” Planned Parenthood, 2025 WL 2840318, at *18; cf. CropLife Am. v. EPA, 329 F.3d 876, 881 (D.C. Cir. 2003) (a press release articulating the agency's bar on considering third-party human studies in evaluating the safety of pesticides was a binding regulation subject to judicial review because it “create[d] a ‘binding norm’ ” “directly aimed at and enforceable against petitioners,” who “are now barred from relying on third-party human studies”). After all, if courts were to find agency actions unreviewable as non-final simply because the agency had not met its statutory obligations or did not have authority to take the action, that would defeat the entire purpose of APA contrary to law review. There is no way to read Secretary Hegseth's words as anything other than a “consummation” of a decision-making process. (See Dkt. No. 238 at 17 (conceding in Defendants' reply brief that “[w]hatever else, there is no doubt about the Secretary's commitment to his course of action”).) And his Directive imposed “legal consequences” by declaring, effective immediately and in unqualified terms, that companies could not continue doing business with both Anthropic and DoW, with the implicit threat that DoW would stop contracting with violators. See San Francisco Herring Ass'n v. Dep't of the Interior, 946 F.3d 564, 580 (9th Cir. 2019) (finding legal consequences flowed from Park Service orders where there was “no suggestion that compliance ․ was somehow optional”).

Defendants concede that there is no statutory basis for Secretary Hegseth's order that “no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic,” and have not subsequently sought to defend the order. (Dkt. No. 238 at 13.) As such, Defendants concede that this portion of the Hegseth Directive was in excess of and contrary to his statutory authority and contrary to law. Anthropic is therefore entitled to summary judgment on this claim.

2. Whether Considered Together or Separately, the Designation of Anthropic as a Supply Chain Risk in the Hegseth Directive and the Subsequent Supply Chain Designation Violate the APA

As a threshold matter, the parties dispute whether the Hegseth Directive designating Anthropic as a supply chain risk, standing alone, was a final agency action in its own right or whether the Supply Chain Designation—which Defendants cast as the implementation of the Hegseth Directive—is the only final agency action at issue.

It is a close call whether Secretary Hegseth's order “directing the Department of War to designate Anthropic a Supply-Chain Risk to National Security” and setting a six-month transition period is a final agency action. (AR 255B.) Anthropic persuasively argues that Secretary Hegseth's decision was facially final, he informed both DoW and the public simultaneously of his determination to designate Anthropic a supply chain risk and offboard its services, and his “direct[ion]” to DoW was no more than an instruction to formalize his order with the necessary paperwork. Notably, he did not request that DoW “consider” or “determine” whether to enact the designation. Defendants, for their part, take the position that the “ ‘plain language’ of the post” is not “dispositive,” and that the Court should look to context, specifically that DoW “subsequently undertook § 3252's formal designation process, and only then did legal consequences flow.” (Dkt. No. 214 at 25.)

The Court need not resolve this dispute. Even assuming the Supply Chain Designation represents the culmination of Secretary Hegseth's order to DoW to “designate Anthropic a Supply-Chain Risk to National Security” and is the act from which legal consequences flowed, the combined action would still be contrary to the substance and procedure of Section 3252 and would be arbitrary and capricious.¹⁶

3. Anthropic Does Not Meet the Definition of a Supply Chain Risk

The Administrative Record establishes that Anthropic's conduct does not meet the requirements for finding a “supply chain risk” under Section 3252. The Michael Memo states: “By embedding unreasonably restrictive terms that restrict DoW's warfighting operations beyond the limitations imposed by law, Anthropic seeks to grant itself an operational veto. This triggers the legal definition of supply chain risk at 10 U.S.C. § 3252(d)(4)․” (AR 213.) But Section 3252 defines a supply chain risk as limited to “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert ․ a covered system.” 10 U.S.C. § 3252(d)(4). The plain text of the statute is directed at covert acts or hacks, not overt, public positions regarding contract terms. The legislative history similarly explains that the statute aims to address “increasing risk that systems and networks critical to [the Department of Defense] could be exploited through the introduction of counterfeit or malicious code and other defects introduced by suppliers of systems or components.” S. Rep. No. 111-201, at 162 (2010).¹⁷ Contrary to Under Secretary Michael's conclusion, Anthropic's contracting position does not appear to bear any relation to the conduct that Section 3252 is aimed at addressing.

Defendants point to Anthropic's “hostile public statements” in the press and its questioning of DoW's use of Claude as raising a risk that Anthropic might turn to sabotage if it was unable to get its way in the contract negotiations. (Dkt. No. 214 at 27.) But Defendants do not explain their inferential leap from Anthropic's forthright insistence on the usage restrictions, coupled with a single incident where an Anthropic employee “questioned” a particular use of Claude but took no further action, to the concern that Anthropic would become a saboteur and “poison[ ]” its models. (Id. at 27–28.) Indeed, sabotage would ordinarily be a surprising culmination to months of “cordial” negotiations between DoW and one of its defense contractors. (Dkt. No. 166-5 ¶ 20.) In support of summary judgment on the APA claim, Defendants do not take the position that any technological capabilities unique to Anthropic drove their risk assessment. (Dkt. No. 214 at 27–28.)¹⁸

At bottom, then, DoW's stated concern is not specific to Anthropic's technology and access—many defense IT vendors could update their systems to attempt to introduce unwanted functions without detection, if they wanted to. The only characteristic that is unique to Anthropic is that it asked questions of DoW and publicly discussed the reasons for its refusal to accept DoW's contract terms. An IT vendor does not become a potential adversary of the United States whenever it asks probing questions or stubbornly insists on particular contracting terms, even if doing so causes DoW to doubt its trustworthiness. Such a breathtakingly broad interpretation of Section 3252 would make its restrictions on the Secretary's discretion meaningless. Supply chain risk designations are permissible only when “necessary to protect national security by reducing supply chain risk.” 10 U.S.C. § 3252(b)(2)(A) (emphasis added). Permitting the Secretary to affix that label to suppliers simply because he deems them too arrogant or difficult to “trust” would effectively gut that statutory requirement. Such an approach would also eviscerate the longstanding statutory and regulatory protections for government contractors in this field. See, e.g., 41 U.S.C. § 1121; 40 U.S.C. § 121(c); 48 C.F.R. §§ 9.406-3, 9.407-3. Nothing in Section 3252's text, structure, or legislative history supports such radical interpretation of its scope.

Defendants argue that “making predictions about supply chain risk [is] within its area of special expertise, [so] this Court's review must be most deferential.” (Dkt. No. 214 at 28 (cleaned up).) But even according maximum deference, there is no basis for finding the statutory definition in Section 3252 satisfied given the lack of any articulable basis to suspect that Anthropic would engage in a covert act of sabotage. This is especially true given DoW's undisputed ability to—with Anthropic's willing participation—use normal-course procurement authority to remove Anthropic's products from its national security systems. DoW claims that such authority would not sufficiently address the risk that Anthropic poses as a subcontractor. (Dkt. No. 238 at 16.) The Michael Memo makes no mention of this concern as a basis for the designation. Moreover, ordinary procurement regulations appear to have mechanisms addressing risks posed by subcontractors. See, e.g., 48 C.F.R. § 9.405-2(b) (“Contractors are prohibited from entering into any subcontract in excess of $45,000, other than a subcontract for a commercially available off-the-shelf item, with a contractor that has been debarred, suspended, proposed for debarment, or voluntarily excluded, unless there is a compelling reason to do so.”). Nothing in the record explains why DoW believed those less restrictive means to be inadequate to address its ostensible national security concerns.

4. Secretary Hegseth and DoW Concede They Committed Procedural Errors, and the Errors Were Not Harmless

Section 3252 allows the Secretary of War to skip the usual procedural requirements for suspending or debarring federal contractors so long as constitutional guarantees of due process are otherwise satisfied. That approach makes sense, given Congress's focus on preventing sabotage and subversion by foreign intelligence agencies, terrorists, and other hostile actors who generally lack due process rights or would be unlikely to take advantage of them. Instead, Section 3252 and its enabling regulations create institutional safeguards—which the Secretary must complete before making a designation—to ensure that the designation is applied properly. The Supply Chain Designation failed to comply with these mandated procedural safeguards.

One of the central safeguards of Section 3252 is the requirement that the Secretary of War make “a determination in writing” that “less intrusive measures are not reasonably available to reduce such supply chain risk.” 10 U.S.C. § 3252(b)(2)(B). To ensure that this first requirement is not an empty letter, the Secretary must provide the appropriate congressional committees with “a discussion of less intrusive measures that were considered and why they were not reasonably available to reduce supply chain risk.” Id. § 3252(b)(3)(B). The second requirement ensures that the Secretary's analysis is preserved for the record and is subject to Congressional oversight. Only after those steps are complete may the Secretary of War designate a source as a supply chain risk.

The Administrative Record reflects that Secretary Hegseth failed to make the required reasoned determination regarding less intrusive measures, as required under Section 3252(b)(2)(B). The record does contain various boilerplate statements from Secretary Hegseth that “less intrusive measures are not reasonably available to reduce such supply chain risk.” (AR 209; AR 231–37; see also AR 248 ¶ 20 (Under Secretary Michael's declaration submitted in this litigation asserts without any elaboration that “DoW considered whether less restrictive means than exclusion and removal could mitigate the” risk).) But nothing in the record actually discusses less intrusive measures or otherwise indicates that DoW engaged in the consideration that would be necessary for Secretary Hegseth to reach such a determination. Nor did Secretary Hegseth's six identical notices to various congressional committees contain any “discussion of less intrusive measures that were considered and why they were not reasonably available,” as required under 10 U.S.C. § 3252(b)(3)(B). (AR 231–36.) Taking these facts together, the most reasonable inference is that Secretary Hegseth merely stated that less intrusive measures were unavailable but failed to make the required reasoned determination. See Nat. Res. Def. Council, Inc. v. Pritzker, 828 F.3d 1125, 1135 (9th Cir. 2016) (“An agency acts contrary to the law when it gives mere lip service or verbal commendation of a standard but then fails to abide the standard in its reasoning and decision.” (citation omitted)).

As a further safeguard, DoW regulations require “a joint recommendation” from specified officials “on the basis of a risk assessment by the Under Secretary of Defense for Intelligence” before a designation can be made. 48 C.F.R. § 239.7304(a). However, the risk assessment submitted by DoW does not come from the Under Secretary of Defense for Intelligence. Instead, the risk assessment was provided by Under Secretary of War for Research and Engineering Emil Michael, the same person who was simultaneously engaged in contract negotiations with Anthropic. The Administrative Record contains a declaration from Under Secretary Michael, submitted in this litigation, stating that due to various DoW reorganizations in 2025, and because of its “institutional and subject matter expertise,” his office “has assumed responsibility for providing [ ] supply chain risk assessments relating to AI.” (AR 244–45 ¶ 8.) However, Under Secretary Michael does not state that the Under Secretary of Defense for Intelligence was unavailable or that the relevant regulations were amended to permit him to prepare the risk assessment. Therefore, the Supply Chain Designation violated DoW's own regulations implementing Section 3252.

Defendants argue that all these procedural irregularities amount to harmless error. In the context of agency review, the harmless error doctrine “may be employed only when a mistake of the administrative body is one that clearly had no bearing on the procedure used or the substance of decision reached.” Nat. Res. Def. Council v. U.S. Forest Serv., 421 F.3d 797, 807 (9th Cir. 2005) (emphasis in original); 5 U.S.C. § 706. An agency's “utter failure to comply” with required procedures “cannot be considered harmless if there is any uncertainty at all as to the effect of that failure.” Sprint Corp. v. FCC, 315 F.3d 369, 376 (D.C. Cir. 2003) (citation omitted). Harmlessness has not been established here. The requirements discussed above are central to the supply chain risk designation, and bear on both the process and substance of the decision. Furthermore, Secretary Hegseth's “commitment to his course of action” (Dkt. No. 238 at 17) based on the information available does not foreclose the possibility that he might have changed his mind with more complete information. Likewise, Congress's failure to request further information does not indicate what it would have done if briefed as required. “On this record, [the Court] ‘cannot presume’ that an opportunity to respond before the Secretary's decision became final would have had no effect.” Hesai Tech., 2026 WL 2409540, at *6.

In sum, Anthropic has shown that the Supply Chain Designation was contrary to law, both because Anthropic's conduct did not meet the statutory criteria for a supply chain risk and because the action violated the institutional checks and balances required under Section 3252 and its implementing regulations.

5. The Supply Chain Designation Was Arbitrary and Capricious

An agency decision is unlawfully arbitrary and capricious

if the agency has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise.

Motor Vehicle Mfrs. Ass'n, 463 U.S. at 43. Where the official “explanation for agency action [ ] is incongruent with what the record reveals about the agency's priorities and decisionmaking process,” and there is a “disconnect between the decision made and the explanation given,” an agency has not provided a reasoned explanation, and its action is arbitrary and capricious. See Dep't of Com. v. New York, 588 U.S. 752, 783–85 (2019).

The Administrative Record shows that Secretary Hegseth and DoW's proffered reasons for designating Anthropic a supply chain risk are both implausible and contrary to the evidence for the reasons already discussed. Supra § V.A–B. Likewise, Secretary Hegseth and DoW's apparent failure to consider less intrusive measures indicates that they likely “failed to consider an important aspect of the problem” that Congress required them to consider. Supra § V.C.4.

Moreover, the proffered reasons appear pretextual. The timing of the Administrative Record raises an inference that it was generated after the fact to justify the foreordained conclusion ordered in Secretary Hegseth's mandate to “designate Anthropic a Supply-Chain Risk to National Security” on February 27. (AR 255B.) Defendants argue that there is nothing wrong with Secretary Hegseth expressing an “ex ante preference for” Anthropic being so designated, citing Biden v. Texas, 597 U.S. 785, 812 (2022). In Texas, however, the agency took six weeks to reach the challenged determination, which the Supreme Court found to be “a substantial window of time for the agency to conduct a bona fide reconsideration” of the issue in question, which it had already considered once before. Id. at 813. Here, by contrast, the purported factual basis for the designation was prepared one business day after Secretary Hegseth issued his instructions, and the designation was issued two business days later. And in contrast to the thin record made to support the designation, the remainder of the Administrative Record reflects a multi-year working relationship between Anthropic and many federal agencies during which there was not a single documented supply chain risk concern. DoW appears to have raised such concerns for the very first time in conjunction with the February 27 instruction. Indeed, all Defendants' records introduced in support of the designation are dated March 2 or 3, 2026, or were prepared for purposes of this litigation and subsequently added to the Administrative Record. (AR 255A–B; AR 209–55; see also supra n. 18.)¹⁹

Furthermore, the Administrative Record and Defendants' position in this litigation reflect shifting justifications for the supply chain risk designation. In opposition to Anthropic's request for preliminary injunctive relief, Under Secretary Michael submitted a March 17, 2026 declaration asserting that it was “reasonably likely that Anthropic's leadership would alter or even shut off DoW's use of Claude ․ before or during a military operation.” (AR 247 ¶ 15.) He warned of grave risks if “Anthropic were to interfere during an operation, whether by shutting off access to the model or altering its functionality.” (Id. ¶ 16 (emphasis added).) If credited, such an obvious risk would presumably be central to Defendants' justification for the designation under Section 3252. Yet Under Secretary Michael's next declaration, dated March 24, 2026, no longer makes any such claims, and instead discusses only the risk inherent in model updates. (AR 253–54 (declaration section titled “Anthropic's Access to and Control of Its AI Model on DoW Systems”).) Defendants' opposition to summary judgment likewise focuses on the risk that Anthropic might provide an “updated version[ ] of its model” that is “subvert[ed]” or “poisoned” as the basis for the Section 3252 findings. (See, e.g., Dkt. No. 214 at 26–29; id. at 27 (stating that the threat is “model poisoning” (emphasis added)); see also Dkt. No. 213 at 4 (“[W]hether Anthropic has real-time access to its AI model after it is deployed on DoW's systems is not DoW's true concern.” (citation omitted)).)

In short, this is not a simple inquiry into “agency closemindedness”; rather, there is an “accumulation of unusual circumstances that demonstrated an explanation for agency action that was incongruent with what the record revealed about the agency's priorities and decisionmaking process.” Texas, 597 U.S. at 811, 813 (cleaned up) (citing Dep't of Com., 588 U.S. at 785). The contradictory positions, the procedural defects, and the rushed process following a public declaration of the foreordained conclusion all indicate that the actions were arbitrary and capricious. See, e.g., Nat'l TPS All. v. Noem, 166 F.4th 739, 774 (9th Cir. 2026) (Mendoza, J., concurring) (“Taken together, these deficiencies paint a picture of agency action that was not the product of reasoned decision-making, but of a rushed and pre-determined agenda masked by pretext.”). While arbitrary-and-capricious review is deferential, it is not an “empty ritual.” Dep't of Com., 588 U.S. at 785. Agencies must “offer genuine justifications for important decisions, reasons that can be scrutinized by courts and the interested public. Accepting contrived reasons would defeat the purpose of the enterprise.” Id.

While not necessary to the above conclusion, evidence of pretext is further reinforced by contemporaneous acts taken by Under Secretary Michael that are inconsistent with the justification for the designation. The day after the designation was finalized, Under Secretary Michael emailed Anthropic to say that he thought they were “very close” to a deal on a new contract. (Dkt. No. 166-6 at 2 (“Michael Email”).) This overture appears wholly inconsistent with Under Secretary Michael's determination, two days earlier, that Anthropic was a “hostile” company that presented an “unacceptable national security threat.” (AR 215.)

The Michael Email is not part of the Administrative Record, but is properly considered as evidence of pretext. Courts may consider extra-record evidence “when plaintiffs make a showing of agency bad faith,” Lands Council v. Powell, 395 F.3d 1019, 1030 (9th Cir. 2005) (citation omitted), and “[p]retext is the paradigm of agency bad faith” for purposes of deciding whether to supplement the record under the Lands Council exception. Sweet v. DeVos, 495 F. Supp. 3d 835, 844 (N.D. Cal. 2020). As already discussed, the Administrative Record, standing alone, has significant evidence of pretext. Under Secretary Michael's continued effort to reach a deal with Anthropic after he claimed to have found a “mature[d]” risk to national security (AR 215) further reinforces that the Supply Chain Designation was imposed in retaliation for Anthropic's speech, and not to protect national security. Therefore, while the Michael Email is not necessary to the Court's conclusion, it is properly admitted as evidence of pretext and further reinforces that finding.²⁰

Anthropic is entitled to summary judgment on its APA claim against Secretary Hegseth and DoW. Defendants' motion for summary judgment on that claim is denied.

D. Anthropic Is Entitled to Summary Judgment on Its APA Challenge Pursuant to Section 558

Agencies may not impose sanctions or issue orders “except within jurisdiction delegated to the agency and as authorized by law.” 5 U.S.C. § 558(b). The Court has already found that the Presidential Directive to “EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic's technology” was a retaliatory act, taken without due process, meant to punish Anthropic for its protected speech. Supra § V.A–B. The record shows that the following Agency Defendants issued orders to terminate use of Anthropic's products pursuant to the Presidential Directive, most within hours of the directive being issued: Treasury, FHFA, State, GSA, OPM, NRC, DHS, and Energy. Supra § II.G–H. DoW did the same, in reliance on the Hegseth Directive and Supply Chain Designation. Supra § II.E. These orders, in violation of Anthropic's First Amendment and due process rights, were not “authorized by law,” and violate Section 558(b).

The Agency Defendants listed above argue that they were “merely engaged in internal IT housekeeping, choosing amongst optional AI models” and their actions were, therefore, not final agency actions nor were they “sanction[s]” or “order[s]” within the meaning of Section 558. (Dkt. No. 214 at 11.)²¹ But context matters. Agency after agency stated that they were implementing the Presidential Directive by cutting ties with Anthropic immediately after the directive issued. (See, e.g., AR 256; AR 317; AR 321; AR 419–20.) Furthermore, the decision to remove Anthropic's products from agency systems—as represented by the communications and instructions in the Administrative Record—are final orders with immediate legal implications for Anthropic. After all, Anthropic could no longer count the agency among its clients or seek future business with the agency. See Bennett, 520 U.S. at 178; 5 U.S.C. § 551(6). Therefore, the actions pass muster under the APA finality test and constitute a violation of Section 558(b). However, Anthropic has not shown that Agency Defendants HHS, Commerce, VA, SEC, and NASA took a final agency action. While each of these Agency Defendants took steps to comply with the Presidential Directive, the Administrative Record does not sufficiently demonstrate that their actions were a consummation of their decision-making processes. (See AR 335–37; AR 584; AR 527; AR 340; AR 388.)

Defendants separately argue that the “Court [ ] lacks jurisdiction to enjoin the director of the Federal Housing Finance Agency in his capacity as conservator for Fannie Mae and Freddie Mac.” (Dkt. No. 214 at 34 n.6) (citing 12 U.S.C. § 4617(f).) Anthropic has waived any objection to this argument by failing to respond to it. Therefore, the permanent injunctive relief will be limited to the FHFA itself, and will not extend to any acts taken by FHFA in a conservator capacity. Finally, as to the Non-Participating Defendants, Anthropic concedes that it has not raised a dispute of material fact as to whether these Agency Defendants violated Section 558.

E. Anthropic's Ultra Vires Separation of Powers Challenge Fails

When a presidential order does not stem from powers granted through “an act of Congress or from the Constitution itself,” the order violates the separation of powers doctrine, and a district court may enjoin federal agencies from implementing the order as ultra vires. Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579, 584–86 (1952). Anthropic argues that the president lacks “statutory authority” or a “constitutional basis” to direct “EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic's technology.” (Dkt. No. 166 at 30; AR 255A.) In passing, Anthropic cites four statutes regulating “exclusion from federal contracting.” (Dkt. No. 166 at 30 (citing as “examples” 10 U.S.C. §§ 3203(a)(1), 3204(a); 41 U.S.C. §§ 3303(a)(1), 3304(a)).) However, Anthropic is not asserting a claim for violation of a specific procurement statute, see, e.g., State v. Su, 121 F.4th 1, 5 (9th Cir. 2024), and “claims simply alleging that the President has exceeded his statutory authority are not ‘constitutional’ claims.” Dalton v. Specter, 511 U.S. 462, 473 (1994). Anthropic's passing references to the statutory provisions and Congress's “power of the purse” are insufficient to carry its burden of showing the President clearly exceeded “any background constitutional authority” to issue the Presidential Directive, thereby rendering the order ultra vires in violation of the separation of powers. Sierra Club v. Trump, 929 F.3d 670, 696 (9th Cir. 2019).²²

F. Declaratory Relief, Vacatur, and Injunctive Relief Are Appropriate

Anthropic is entitled to the relief it seeks, which shall issue via a separate order. However, this section addresses the objections to relief that Defendants raise.

First, Defendants assert that the Court may not declare the Presidential Directive unlawful because it “cannot issue a declaratory judgment against the President.” (Dkt. No. 214 at 34.) However, the President is not a party to this action, and the requested relief is directed at stopping Agency Defendants from implementing unlawful actions. Therefore, the requested relief is not improper. See Youngstown, 343 U.S. at 585–86.

Second, Defendants argue that, should the Court find an APA violation, the proper remedy would be remand of the Supply Chain Designation and the Hegseth Directive without vacatur. (Id. at 33.) “Whether agency action should be vacated depends on how serious the agency's errors are and the disruptive consequences of an interim change that may itself be changed.” California Communities Against Toxics v. U.S. E.P.A., 688 F.3d 989, 992 (9th Cir. 2012) (cleaned up). For example, where vacatur would be “economically disastrous,” and could result in regional blackouts, the Ninth Circuit found the “limited circumstances” precluding vacatur existed. Id. at 993–94. By contrast, this case involves serious substantive and procedural errors and there has been no showing by the government that vacatur would result in a national security risk or any other harm—despite the fact that the Supply Chain Designation and the Hegseth Directive have been preliminarily enjoined for over five months. This case also differs from NCRI, PMOI, and Hesai, where the D.C. Circuit found only procedural errors and thus remanded the designations without vacating them. PMOI, 613 F.3d at 230 (citing NCRI, 251 F.3d at 209); Hesai Tech., 2026 WL 2409540, at *6 (similar). In light of Anthropic's showing that the Supply Chain Designation violates the substance of Section 3252 and that Secretary Hegseth lacked any authority to order a secondary boycott, remand without vacatur would be an inadequate remedy.

Third, Defendants argue that Anthropic has not shown that it is entitled to injunctive relief, and even if it has made the necessary showing, that the Court may not grant both vacatur and an injunction to remedy the same harm. Before the Court may order permanent injunctive relief, Anthropic “must satisfy a four-factor test”: “(1) that it has suffered an irreparable injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for that injury; (3) that, considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public interest would not be disserved by a permanent injunction.” eBay Inc. v. MercExchange, LLC, 547 U.S. 388, 391 (2006). Additionally, in the context of a statutory challenge, the Supreme Court has stated in dicta that if the “less drastic remedy” of vacatur sufficiently redresses the injury, “no recourse to the additional and extraordinary relief of an injunction [i]s warranted.” Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 165–66 (2010)).

As to the first requirement, Anthropic has made a sufficient showing. Anthropic has shown that the Challenged Actions constitute a constitutional deprivation, and the record also shows that, in the absence of equitable relief, the chilling effects of the Challenged Actions will only continue to mount. See supra § II.H; see also Riley's Am. Heritage Farms, 32 F.4th at 731 (“[T]he deprivation of constitutional rights unquestionably constitutes irreparable injury.” (cleaned up)). Furthermore, the unrebutted record is that, should the preliminary injunction be lifted and the Challenged Actions reinstated, defense contractor and other DoW-related client revenue would decline by “50–100 percent” and Anthropic's “2026 revenue by multiple billions of dollars.” (Dkt. No. 166-3 ¶ 6); Riley's Am. Heritage Farms, 32 F.4th at 723, 731 (remanding a First Amendment claim for analysis as to injunctive relief where plaintiff argued that it had been deprived of an “established business relationship with” the government). Furthermore, to the extent Defendants rely on their voluntary cessation of the challenged conduct, it is not “absolutely clear that the allegedly wrongful behavior could not reasonably be expected to recur.” Friends of the Earth, Inc. v. Laidlaw Env't Servs., 528 U.S. 167, 189 (2000) (citation omitted); Enrico's, Inc. v. Rice, 730 F.2d 1250, 1253 (9th Cir. 1984) (“We recognize that the voluntary cessation of allegedly illegal conduct does not deprive a court of the power to grant injunctive relief.”). Defendants continue to defend and have declined to stipulate to enjoin the Challenged Actions.

For these same reasons, legal remedies would be inadequate. As to Defendants' argument that Anthropic “continues to speak freely,” has experienced an increase in its valuation, and has not had its federal contracts terminated yet (Dkt. No. 214 at 33–34), that reflects the restoration of the status quo pursuant to the preliminary injunction in this case. The record shows no indication that, upon lifting the preliminary injunction, the harms at issue would still be averted.

The balance of equities and the public interest analyses merge when the government is the opposing party, Nken v. Holder, 556 U.S. 418, 435 (2009), and likewise favor granting injunctive relief. While national security is a weighty interest, there is no evidence that the Challenged Actions would avert any specific articulable risk to national security. This is especially the case because the relief ordered does not bar Defendants from lawfully terminating their contractual relationships with Anthropic. On the other hand, permitting the Challenged Actions to stand would subject Anthropic to ongoing constitutional violations, and would have chilling effects that harm the general public.

Finally, assuming without deciding that Monsanto applies when constitutional and statutory claims are brought together in one action, injunctive relief is appropriate here because that relief is not coextensive with vacatur. For example, vacatur would not provide Anthropic relief as to its First Amendment and Due Process Clause claims concerning the Presidential Directive. Nor would it prevent agencies from resuming carrying out that directive, or guard against further retaliatory actions in violation of the First Amendment. This is not a case where vacatur sufficiently redresses Anthropic's injuries, and permanent injunctive relief is appropriate.

VI. CONCLUSION

For the foregoing reasons, Anthropic's motion for summary judgment is GRANTED IN PART and DENIED IN PART and Defendants' motion for summary judgment is GRANTED IN PART and DENIED IN PART as follows:

1. As to the First Amendment claim (Count II), Anthropic's motion is GRANTED and Defendants' motion is DENIED with respect to all Defendants except the Non-Participating Defendants.

2. As to the Due Process Clause claim (Count IV), Anthropic's motion is GRANTED and Defendants' motion is DENIED with respect to all Defendants except the Non-Participating Defendants.

3. As to the APA Challenge to the Hegseth Directive and the Supply Chain Designation (Count I), Anthropic's motion is GRANTED and Defendants' motion is DENIED with respect to Secretary Hegseth and DoW.

4. As to the APA Challenge pursuant to Section 558 (Count V), Anthropic's motion is GRANTED and Defendants' motion is DENIED with respect to DoW, Treasury, FHFA, State, GSA, OPM, NRC, DHS, and Energy, and their respective agency heads. Anthropic's motion is DENIED and Defendants' motion is GRANTED with respect to HHS, Commerce, VA, SEC, NASA, and their respective agency heads, and the Non-Participating Defendants.

5. As to the ultra vires challenge (Count III), Defendants' motion is GRANTED and Anthropic's motion is DENIED with respect to all Defendants.

6. As to all claims, Defendants' motion is GRANTED and Anthropic's motion is DENIED with respect to the Non-Participating Defendants.

The Motion to Consider Evidence Outside the Administrative Record is GRANTED, and the alternative Motion to Complete the Administrative Record is DENIED AS MOOT. (Dkt. No. 169.)

An order addressing relief will issue separately. Defendants' request to administratively stay the permanent injunction for a period of seven days is DENIED. Defendants have not shown irreparable harm, even though they have been complying with the Court's Preliminary Injunction Order for more than five months and had ample opportunity to identify any harms caused by it.

IT IS SO ORDERED.

FOOTNOTES

1.   Cites to “AR _” refer to the bates stamps on the certified Administrative Record compiled by Defendants. (Dkt. Nos. 210, 233.) All other citations to page numbers refer to ECF pagination.

2.   In the complaint, motion papers, and evidence, the parties refer to the Department of Defense as the “Department of War” or “DoW.” Compare National Security Act Amendments of 1949, Pub. L. No. 81-216 § 4, 63 Stat. 578, 579 (1949), with Exec. Order No. 14347, 90 Fed. Reg. 43893 (Sep. 5, 2025). This Order adopts the parties' phrasing for consistency and ease of reference.

3.   Sec'y of War, Artificial Intelligence Strategy for the Department of War (Jan. 9, 2026), https://perma.cc/52KE-X7VQ?type=image.

4.   Dep't of Def., Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN) (Nov. 5, 2012), https://perma.cc/TW3D-735M.

5.   National security systems include, for example, information systems used for “intelligence activities,” “command and control of military forces,” or “equipment that is an integral part of a weapon or weapons system.” 44 U.S.C. § 3552(b)(6)(A)(i); see also 10 U.S.C. § 3252(d)(5) (defining “covered system” as “a national security system”).

6.   The definition covers “equipment [ ] used by the agency directly or [ ] used by a contractor [for enumerated purposes] under a contract with the agency that requires—(i) [i]ts use; or (ii) [t]o a significant extent, its use in the performance of a service or the furnishing of a product.” 48 C.F.R. § 239.7301. It “does not include any equipment acquired by a contractor incidental to a contract.” Id.

7.   See, e.g., 48 C.F.R. §§ 9.400(a)(1), 9.406-3, 9-407-3; see also Friedler v. GSA, 271 F. Supp. 3d 40, 43–45 (D.D.C. 2017).

8.   Declarations and associated evidence are properly considered in review of Anthropic's constitutional claims, which is not limited to the administrative record. See Nat'l TPS All. v. Noem, No. 25-cv-05687-TLT, 2025 WL 2419266, at *2 (N.D. Cal. Aug. 21, 2025) (collecting cases and finding that “courts in this Circuit typically permit discovery on constitutional claims where they diverge in some meaningful way from the APA claims”); see also Am. Fed'n of Gov't Emps., AFL-CIO v. Trump, 155 F.4th 1082, 1093 (9th Cir. 2025) (“Review of an ultra vires challenge would not be limited to an administrative record.”).

9.   As with the traditional test, Defendants may also meet their burden by showing that they would have taken the same actions in the absence of Anthropic's expressive conduct. Damiano, 140 F.4th at 1137. They have failed to do so for the reasons already discussed. Supra Section V.A.2.

10.   This Order does not reach Anthropic's content and viewpoint discrimination theories, or its Petition Clause retaliation theory.

11.   Alternatively, a plaintiff may show that “the government-imposed stigma is so severe that it broadly precludes the plaintiff from pursuing a chosen trade or business.” Hesai Tech., 2026 WL 2409540, at *3 (cleaned up). This Order does not reach this possible basis for finding a liberty interest.

12.   Because this Order finds Anthropic likely to succeed on its due process claim based on its protectible liberty interest, it does not reach Anthropic's property interest theory.

13.   Defendants do not claim that the Michael Memo creates a material dispute as to Anthropic's ability to access, alter, or introduce latent biases or backdoors into its deployed models. Even if they had, the conclusory assertions in the Michael Memo are not supported by any “evidence in the record” and cannot defeat summary judgment. White v. Lee, 227 F.3d 1214, 1241 (9th Cir. 2000).

14.   Defendants' argument relates only to the Supply Chain Designation. (Dkt. No. 214 at 24 (“As for the Secretary's designation ․”).)

15.   At the preliminary injunction hearing, counsel for Defendants refused to stipulate to entry of an injunction enjoining this portion of the Hegseth Directive and stated that DoW “will take action as needed.” (Dkt. No. 128 at 18–19.)

16.   Nothing in the Supply Chain Designation withdraws or rescinds the Hegseth Directive. Therefore, the statements made in the Hegseth Directive are part of the “context” in which the Supply Chain Designation must be read.

17.   Section 3252 was originally enacted as Section 806 of the 2011 National Defense Authorization Act. Pub. L. No. 111-383, § 806, 124 Stat. 4137, 4260–63 (2011).

18.   This conclusion is reinforced by the declaration of Anthropic's Head of Public Sector Thiyagu Ramasamy, which describes relevant features of Anthropic and DoW's technology, including that Anthropic cannot access its models post-deployment in national security systems and that each new model is comprehensively tested by DoW and its prime contractors pre-deployment. (Dkt. No. 166-4 (“Ramasamy Declaration”).) Despite being extra-record evidence, the Ramasamy Declaration is properly considered to assist the Court in effectively “evaluat[ing] the integrity of the agency's analysis.” San Luis & Delta-Mendota Water Auth. v. Locke, 776 F.3d 971, 993 (9th Cir. 2014). To be clear, the Ramasamy Declaration is not being admitted “to determine the correctness or wisdom of the agency's decision” under the APA, but simply to “develop a background” regarding relevant features of Anthropic's technology—a topic on which the Administrative Record is entirely silent. Id. In fact, Defendants themselves rely on the Ramasamy Declaration's description of DoW's testing regime in seeking summary judgment on Anthropic's APA claim. (Dkt. No. 214 at 29.) Likewise, Defendants have added to the Administrative Record two post-decisional declarations from Under Secretary Michael that were initially submitted in this litigation to “offer a fuller explanation of the agency's reasoning at the time of the agency action” (id. at 14 n.2 (cleaned up)), another indication that the pre-decisional record alone provides insufficient background for effective APA review. (AR 243–55.) However, while the declaration provides additional clarity, it is not necessary to the Court's conclusion.Defendants separately argue Anthropic should have submitted the Ramasamy Declaration to DoW directly rather than file it in this action. (Dkt. No. 213 at 5.) This argument makes little sense, given that Anthropic had no notice of the basis for the Challenged Actions until after filing suit.

19.   The only exception is a “Due Diligence Preliminary Report” prepared by a vendor, dated February 26, 2026, two days after Secretary Hegseth issued the ultimatum to Anthropic threatening to designate it a supply chain risk. (AR 217–29.) The due diligence report does not provide evidence of the risks that purportedly resulted in the supply chain risk designation.

20.   The Ramasamy Declaration is also admissible as evidence of pretext for the reasons already discussed. See Supra n. 18.

21.   Defendants argue that Anthropic waived its Section 558 argument as to any agency not specifically discussed in its opening brief. (Dkt. No. 238 at 18.) Anthropic sufficiently raised the issue, and even if it had not, the Court's discretion is properly exercised to consider the arguments in light of Defendants' opportunity to respond in both briefing and oral argument. Lane v. Dep't of Interior, 523 F.3d 1128, 1140 (9th Cir. 2008).

22.   To the extent Anthropic argues that the Presidential Directive is a retaliatory punishment, that argument has been considered in the context of Anthropic's First Amendment claim.

RITA F. LIN, United States District Judge