Anthropic won. That is not the same as getting the customer back.

What the order does

Three things, and the third is the one that matters legally.

It vacates the designation — the label is void, not merely unenforceable. It permanently enjoins the government from giving it effect, replacing the interim protection that had been running since spring. And it reaches beyond the Pentagon to the presidential directive that told federal agencies to stop using Claude altogether, which is what made this a government-wide problem rather than a defence-procurement one.

The findings are unusually blunt for an administrative-law opinion. Lin described the government’s evidence that Anthropic posed a national-security risk as “slim,” and concluded the designation was “based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model.” She held that neither constitutional nor statutory authority allows the government to “impose sweeping penalties based principally on Anthropic’s critique of the Administration’s views,” and summarised the whole exercise in a line the wires have quoted all day: “the empty invocation of national security is not a blank check to punish and retaliate against government critics.”

She was equally careful about what she was not holding. “Though the Department of War is undisputedly free to select the AI vendor of its choice,” she wrote, “the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless.” The government can still decline to buy Claude. It cannot brand the company a national-security threat for saying no.

Anthropic’s response was one sentence of welcome and one of continuity: “We welcome the court’s ruling that this supply chain risk designation was unlawful,” followed by a statement that the company remains focused on working productively with the government on national security. The White House did not immediately respond. The department is widely expected to appeal.

The part the coverage is skipping

Anthropic already had an injunction. It did not work.

Lin granted a preliminary injunction on 26 March 2026, finding Anthropic likely to succeed on all of its claims. A seven-day administrative stay expired on 2 April and the injunction took effect while the government’s Ninth Circuit appeal proceeded. On the civilian side it worked as designed: the GSA restored Anthropic to USAi.gov and to its Multiple Award Schedule.

On the defence side it did not. The Pentagon’s chief technology officer, Emil Michael, publicly said Lin’s order contained “dozens of factual errors” and asserted that the designation remained “in full force and effect,” on the theory that a Northern District of California ruling did not reach the separate government-wide exclusion authority. Whatever the merits of that reading, the effect was immediate: contractors received no reliable signal that the ban had lifted.

Five weeks later, on 1 May, the department cleared eight AI vendors for its IL6 and IL7 classified networks — SpaceX, OpenAI, Google, Nvidia, Microsoft, AWS, Reflection AI and Oracle. Anthropic, under a court order protecting it from exactly this treatment, was not on the list.

That is the load-bearing fact for anyone building a vendor-risk model. A court order is a slow instrument against a fast administrative one. The designation took effect in days. Unwinding it has taken six months and is not finished.

What six months of exclusion actually cost

The abstraction hides how ordinary the damage was. Per FedScoop’s reporting on the agency fallout: the Department of State moved immediately to implement the directive. HHS disabled enterprise Claude access department-wide, reversing a December 2025 rollout that had put Claude in front of every HHS staff member for $1 a year. Commerce dropped it for analytical report generation and data visualisation. The Energy Department’s Idaho National Laboratory dropped it for coding assistance. CBP dropped it for document summarisation.

None of those are classified weapons programmes. They are the exact mundane workloads any large organisation runs, and they were migrated off a working tool for reasons that had nothing to do with the tool. The GSA OneGov agreement that had made Claude available across the federal civilian, legislative and judicial branches for $1 ran through 10 August 2026 — it expired during the ban, unrenewed.

Migration costs, once paid, are not refunded by a favourable judgment. The agencies that rebuilt on ChatGPT or Gemini are not going to un-rebuild this quarter because a judge in San Francisco vacated a label.

The mechanism is still on the books

This is the part worth understanding in detail, because the mechanism outlives the case.

The designation invoked 10 U.S.C. § 3252, which lets the Secretary exclude sources from defence procurements involving national security systems, and the Federal Acquisition Supply Chain Security Act, applied government-wide through FAR 52.204-30. On the defence side, DFARS 252.239-7017 and 252.239-7018 put contractors under an affirmative duty to mitigate supply-chain risk. The FASCSA clause flows down to all subcontractors.

Those clauses carry a compliance cadence: review SAM.gov at least quarterly, report a covered article within three business days of identifying it, submit a mitigation plan within ten. The designation applied to “all Anthropic affiliates and all products and services” for covered contracts.

Here is the gap that did the real work. Outside counsel reading the authority concluded it “does not prohibit a contractor from having commercial business relationships with Anthropic” outside defence work — Anthropic argued the same thing, that a § 3252 designation “can only extend to the use of Claude as part of [DoD] contracts.” Hegseth’s public statement said something much broader: no contractor, supplier or partner doing business with the US military “may conduct any commercial activity with Anthropic.”

Contractors complied with the broad version. Of course they did. A three-business-day reporting clock and a flow-down obligation to every subcontractor make the cost of guessing wrong enormous, and the cost of switching chat vendors small. The chilling effect was the enforcement mechanism, and it required no legal authority at all. Lin’s order removes the designation. It does not remove the asymmetry that made a contested label behave like a settled ban.

What this means for how you pick AI tools

For consumer and small-business readers: nothing changed. Claude and Claude Code remain where they were on the best AI chatbots and best AI coding tools lists, and the Claude vs. ChatGPT call turns on the same capability and price questions it did last week. Federal procurement fights are not quality signals in either direction.

For enterprise buyers, one genuinely new item earns a place in the vendor review — and it is not “is Anthropic risky.” It is vendor political exposure, asked of every provider:

• Single-provider workloads. Which production paths have no tested fallback, and what is the measured time-to-migrate? The agencies above found out under a deadline. That is the expensive way to learn it.
• Portability of the work, not just the model. Prompts, evaluation suites and fine-tuning artefacts are the switching cost. Contract for export rights before you need them.
• Which list your vendor could land on. This year has produced several: the export-control action that pulled Fable 5 and Mythos 5 offline for 18 days and then lifted them; the covered-frontier-model designations under Executive Order 14409; the approved-customer gating that limited GPT-5.6 Sol at launch. Different vendors, same shape.
• Ask what your vendor refuses to do. Anthropic’s exclusion followed directly from contractual limits on autonomous weapons and mass surveillance it declined to waive. Those limits are a feature for most buyers and a liability for one customer. Know which of your providers has them, because it predicts where each one is politically exposed.

What to watch

Three markers, in order of how much they tell you.

Whether the Ninth Circuit stays the permanent injunction. If it does, the practical position reverts to spring and the vacatur becomes symbolic pending appeal. If it does not, defence-side procurement has to explain why Anthropic is still absent from awards.

Whether the GSA and the civilian agencies move as fast as they did in March. That restoration took days last time. A slow response now would say the chilling effect has outlived its legal basis.

Whether the D.C. case converges or diverges. Two courts have taken different postures on the same dispute since April. A split raises the odds this ends somewhere higher than a circuit.

The White House’s own frontier-AI framework remains unpublished despite being declared complete on 1 August, and the government-equity-stake discussion has gone quiet without resolving. The through-line across all of it is that US AI policy in 2026 is being made through procurement instruments and informal pressure rather than published rules — which is precisely why a vendor can be removed from the federal supply chain in a day and take six months to come back.

Anthropic won the legal argument comprehensively. The operative question for buyers was never whether the label was lawful. It was how long an unlawful one can keep working, and the answer so far is: longer than the litigation.

Questions or corrections? Email Pick Right. Want the full list? See all news.