Trump officials' own words could sink the Anthropic blacklist case

The Trump administration is heading into a federal courtroom Tuesday to defend its decision to blacklist Anthropic as a supply chain risk. But the government has a problem it helped create. Anthropic's lawsuit does not ask a judge to infer political retaliation — it cites it, in the complaint, in Hegseth's own words.

The case is Anthropic v. Department of Defense, filed March 9 in the Northern District of California (No. 3:26-cv-01996). Judge Rita Lin is hearing the preliminary injunction motion March 24. At stake is whether Anthropic's supply-chain risk designation stays in effect while the litigation proceeds — a designation that company executives say could cost it multiple billions of dollars in 2026 revenue.

The complaint opens by framing the claim precisely: "These actions are unprecedented and unlawful. The Constitution does not allow the government to wield its enormous power to punish a company for its protected speech. No federal statute authorizes the actions taken here. Anthropic turns to the judiciary as a last resort to vindicate its rights and halt the Executive's unlawful campaign of retaliation."

That is not inference. That is the theory of the case, in the pleading, filed March 9.

The retaliation claim rests on a specific legal argument: that the Pentagon's supply-chain designation was not a security assessment but punishment for Anthropic's publicly stated positions on AI safety — positions that constitute protected speech under the First Amendment. The complaint characterizes the government's conduct as "viewpoint-based" and contends it was driven by "pure ideological disagreement" rather than "any legitimate procurement or security concern."

The evidence Anthropic cites to support that claim is the record the administration built in public.

When Hegseth issued the blacklist order, the complaint quotes him denouncing what he called Anthropic's "Silicon Valley ideology," "defective altruism," "corporate virtue-signaling," and "master class in arrogance" — and criticizing the company for not being "more patriotic." Trump added to that record on social media, calling Anthropic a "RADICAL LEFT WOKE COMPANY" run by "Leftwing nut jobs" and directing the entire government to "immediately cease" use of its technology.

Those statements, entered into the record as exhibits to the complaint, are doing the legal work. A plaintiff proving First Amendment retaliation must show that protected speech was a substantial or motivating factor in the government's action. When a defense secretary announces a national security designation while attacking a company's ideology and patriotism — in the same breath — the plaintiff's burden gets substantially lighter.

"A lot of things Hegseth has said and the Pentagon has done undermine their case and suggest there was personal animus and bad blood between the parties, and that the Pentagon had it out for Anthropic," Vanderbilt law professor Joel Dodge told Reuters.

The complaint also cites Anthropic's own track record at the agency as corroborating evidence. "While operating under the terms of the Usage Policy, the Department [of Defense] never previously raised any issues with its use of Claude or concerns about Anthropic's potential interference," it reads. "Anthropic had only ever received positive feedback about Claude's capabilities from its government customers." Under a straightforward security rationale, that history is hard to explain.

The expert basis for the retaliation angle is grounded in the specific elements of what the complaint alleges, not just the political atmosphere. Attorney Sean Timmons, speaking to Breaking Defense, used the term "admissions against interest" to describe the Trump and Hegseth statements — a precise legal concept that applies when a party's own prior statements contradict the rationale they are now advancing in court. The government's position is that the designation was a sober national security call. The complaint's exhibits are public statements, by the officials who made the designation, calling Anthropic a radical left organization that isn't patriotic enough. Courts can treat that kind of direct contradiction as evidence of pretext.

Chris Mattei, a First Amendment attorney and former Justice Department lawyer, told TechCrunch the government is "relying completely on conjectural, speculative imaginings" to justify the designation, and that its "nonsensical arguments are themselves the best evidence that the administration's conduct was plainly a retaliatory punishment."

Amos Toh, a national security law expert at the Brennan Center for Justice, told Reuters the designated threat does not match what the statute was built for: "These are basically safety protocols. You can debate whether these protocols are acceptable or not, but they run directly counter to the risk that the law is designed to regulate."

The Statute Has Never Been Used Like This

The legal hook the Pentagon used is Section 3252, a supply chain risk law that allows the defense secretary to exclude companies from certain contracts when an adversary might "sabotage, maliciously introduce unwanted function" or otherwise "subvert" a military information system. The law was designed for adversary infiltration — not for domestic AI policy disputes.

According to a Reuters review of legal databases, the statute has never been applied to a U.S. company and has never been tested in court.

University of Minnesota Law School professor Alan Rozenshtein told Reuters: "It's not at all clear that the statute can even apply to an American company where there's no foreign entanglement."

The government's 40-page filing, submitted March 17, rejects the First Amendment framing entirely. DOJ attorneys wrote: "The First Amendment is not a license to unilaterally impose contract terms on the government, and Anthropic cites nothing to support such a radical conclusion." The government's position is that Anthropic's usage restrictions — prohibiting autonomous weapons and domestic surveillance uses — were a business decision, not protected speech, and that the designation was a legitimate national security call. The specific security concern the government asserts: that Anthropic might "attempt to disable its technology or preemptively alter the behavior of its model" before or during "warfighting operations" if it felt its "corporate red lines" were being crossed.

Mattei's response to that framing: there is no investigation supporting those concerns. Without one, the government has not explained how Anthropic's negotiating position rendered it an "adversary" rather than a vendor the Pentagon simply declined to renew.

What the Filings Actually Show

Anthropic submitted two sworn declarations Friday alongside its reply brief — from Sarah Heck, the company's head of policy and former Obama-era National Security Council official who was personally present at the February 24 meeting between Amodei and Hegseth, and Thiyagu Ramasamy, Anthropic's head of public sector and a former six-year Amazon Web Services government deployments veteran.

Heck's declaration addresses what she calls a "central falsehood" in the government's filings: that Anthropic demanded an approval role over military operations. "At no time during Anthropic's negotiations with the Department did I or any other Anthropic employee state that the company wanted that kind of role," she writes. She also notes that the government's concern about Anthropic potentially disabling its technology mid-operation — now the centerpiece of the DOD's security argument — never came up during months of negotiations. It appeared for the first time in the government's court filings.

The more striking exhibit is a contemporaneous email. Under Secretary Emil Michael emailed CEO Dario Amodei on March 4 — the day after the Pentagon formally finalized the supply-chain risk designation — telling Anthropic the two sides were "very close" on the two issues the government now cites as evidence that Anthropic poses a national security threat: its positions on autonomous weapons and mass domestic surveillance.

The sequencing of what followed is documented across Heck's declaration and public posts. March 5: Amodei published a statement saying the company had been having "productive conversations" with the Pentagon. March 6: Michael posted on X that "there is no active Department of War negotiation with Anthropic." A week later: Michael told CNBC there was "no chance" of renewed talks.

Heck stops short of alleging the designation was used as a bargaining chip. But the timeline she lays out — nearly aligned on March 4, designation finalized that same day, negotiations declared dead within a week — sits in the record next to a government security argument built on claims that never came up during the negotiations that preceded the designation.

Ramasamy's declaration takes on the government's technical claim: that Anthropic could theoretically disrupt military operations by remotely disabling or altering Claude. His answer is that this is not technically possible. Once Claude is deployed inside a government-secured, air-gapped system operated by a third-party contractor, Anthropic has no access to it — no kill switch, no back door, no mechanism to push unauthorized updates. Any "operational veto" is a fiction. Anthropic employees, he says, cannot see what government users are typing into the system, let alone extract that data.

He also disputes the government's claim that Anthropic's hiring of foreign nationals constitutes a security risk, noting that Anthropic employees have undergone U.S. government security clearance vetting — and that, to his knowledge, Anthropic is the only AI company where cleared personnel actually built the AI models designed to run in classified environments.

What Tuesday Decides

The immediate question before Judge Lin is not who wins the case. It is whether Anthropic gets a preliminary injunction staying the supply-chain designation while litigation proceeds. That requires showing likelihood of success on the merits, irreparable harm, and that the balance of equities favors a stay.

On the merits, the evidence stacks in Anthropic's favor on paper. The statute may not apply to an American company at all. The complaint enters Hegseth's own language — attacking Anthropic's ideology and patriotism — as evidence of viewpoint-based retaliation, leaving the government in the position of arguing that a designation announced with that rhetoric was actually a neutral security call. The internal timeline shows the designation was finalized the same day the government's own official said the two sides were nearly aligned on the exact issues cited as the security basis. And the technical premise — that Anthropic poses an operational security risk — has been directly rebutted under oath by someone who spent six years building government AI deployments, on the grounds that those concerns never came up in negotiations and are not technically plausible anyway.

The government will argue military necessity and judicial deference. Historically, those arguments win. But as type0 reported last week (https://type0.ai/stories/warren-anthropic-pentagon-blacklist), Senator Warren's letters to Hegseth and Altman have added congressional scrutiny to the same timeline — creating a public record of the sequence that Anthropic's lawyers are now citing in court.

"Admissions against interest" is a legal term of art. When a party claims in court it acted for neutral, lawful reasons, and the record contains statements by the same officials announcing the action while attacking the target's politics and patriotism, courts can treat those statements as evidence that the official rationale is pretext. The government filed its own exhibits. The complaint just quoted them back.