The Memo Was Supposed to Prove Sabotage. It Proved Retaliation.

The public docket in Anthropic PBC v. U.S. Department of War, before US District Judge Rita F. Lin (Northern District of California, no. 3:26-cv-01996-RFL), records “Date Terminated: Aug. 27, 2026”, with the last filing the following day. The case, opened on 9 March, closed on 27 August: that much we verified on the docket ourselves.

What the order closing it actually says, we have not read. It is not, as of today, in the freely accessible public docket, and what is known of it comes from the outlets that reported it: on their account, Lin granted summary judgment to Anthropic, holding the company’s designation as a supply chain risk unlawful on three grounds — First Amendment retaliation, a due-process violation, and administrative-law defects. We write it as what it is: a date verified on the docket, contents reported by the press. None of the quoted passages below comes from that order.

The document we did read in full has been public since March, and it is what makes the episode instructive regardless of how it ends. We covered earlier stages in April and in July. The point is not who won: it is what the Pentagon’s memo, written to justify the designation, actually contains.

The facts, in order

27 February 2026: President Trump posts on Truth Social ordering every federal agency to “IMMEDIATELY CEASE all use of Anthropic’s technology,” branding the company “some out-of-control, Radical Left AI company” (later entered into the record as Dkt. No. 6-20, the “Presidential Directive”).
An hour later: Defense Secretary Pete Hegseth posts on X that “Anthropic delivered a master class in arrogance and betrayal,” and orders anyone doing business with the Pentagon to sever all commercial ties with the company (Dkt. No. 6-21, the “Hegseth Directive”).
3–4 March 2026: Anthropic receives two letters from the Department of War. The first cites 41 U.S.C. § 4713 (FASCSA), challenged in a separate proceeding before the D.C. Circuit (No. 26-1049); the second cites 10 U.S.C. § 3252, a Defense-specific statute, and is the “Section 3252 Letter” at the heart of the case before Lin.
26 March 2026: Lin grants a preliminary injunction, finding Anthropic likely to prevail on the merits on all three claims; her order (Document 134 on the docket) makes the internal memo behind the designation public for the first time.
2–3 April 2026: the government files its appeal of the injunction with the Ninth Circuit; the docket assigns it number 26-2011.
8 April 2026: the D.C. Circuit denies a stay of the § 4713 designation, leaving it in force. By late August, case No. 26-1049 still has no decision.
30 July 2026: at the hearing on cross-motions for summary judgment before Lin, she remarks from the bench — according to an observer’s account of the hearing — that “it seems like the record, in some ways, has gotten worse for the government” since March.
27 August 2026: the docket records the case as terminated. On the account of the outlets that reported it, Lin grants summary judgment to Anthropic and permanently enjoins the Presidential Directive, the Hegseth Directive and the § 3252 designation; the order itself is not yet available.

The memo that was supposed to prove a technical risk

The 3 March designation rests on a joint recommendation from the Under Secretary for Acquisition and the Department’s Chief Information Officer, attaching a memorandum signed by Under Secretary Emil Michael — the same official who had led the contract negotiations with Anthropic. Filed on the docket as an exhibit (Dkt. No. 96-2), the memo opens on technical ground: AI models are “acutely vulnerable to manipulation,” Anthropic could exploit privileged access to “subtly poison the training data to maliciously introduce unwanted function,” and the Pentagon risked being left to operate “a black box controlled by a hostile party, which could contain hidden biases or backdoors.”

Read to the end, though, the same memo explains on its own why that technical framing does not hold up. In its conclusion, Michael writes that “Anthropic’s risk level escalated from a potentially manageable technical and business negotiation to an unacceptable national security threat” — not because of any evidence of tampering that had come to light, but because the company “asserted in the negotiations that it have an approval role in the operational decision chain,” and because, during the talks, it “began engaging in an increasingly hostile manner through the press, despite the ongoing private negotiations with DoW leadership.” It is this sentence — filed by the government itself, not leaked — that the judge cites as direct evidence of motive: the supply-chain-risk designation, by its own author’s admission, grew out of how Anthropic discussed the contract terms in public, not out of any demonstrated risk of sabotage.

The memo never explains on what basis Anthropic would have privileged access to models already delivered. Anthropic filed a declaration from its own engineer, Ramasamy, stating that once deployed in the Department’s air-gapped environments, “Anthropic has no ability to access, alter, or shut down the deployed model”; at the hearing, government counsel admitted he was not aware of any evidence to the contrary. The Department did not dispute that declaration on the merits: it announced an internal audit to check whether such a risk exists.

Winning in one court does not end the fight in the other

Whatever Lin decided on 27 August, it could not reach the § 4713 designation: FASCSA channels judicial review of its own designations exclusively to the D.C. Circuit, and the March order says as much about its own reach. That second designation — narrower, since it is limited to the Defense Department’s “covered” procurements, but issued under a different statute — is untouched by Lin’s ruling and remains, formally, in force while case No. 26-1049 stays pending. A company can therefore, on the very same day, have one court rule that its designation as a national security risk was unlawful retaliation, and remain, under a different law and before a different court, still officially designated exactly that.

Anthropic, in a statement carried by the outlets that reported the ruling — we did not find it on the company’s own site — said: “We welcome the court’s ruling that this supply chain risk designation was unlawful. We remain focused on working productively with the government to harness AI for our national security so all Americans benefit from this technology.” The Pentagon and the White House did not respond to requests for comment from the outlets that broke the story; several sources report that the Department of Justice intends to appeal, though no notice of appeal appears to have been filed as of this writing.

What it leaves behind, for anyone assessing a vendor or counterparty

The first point concerns internal documents. A memo written to satisfy a legal requirement — here the obligation to give written reasons for a designation — is not automatically evidence in favour of whoever wrote it: if it contains the real reason for the decision, that reason becomes the evidence used against its author. The same holds for a Pentagon memo as for an internal report justifying a vendor’s exclusion: the full text outweighs the summary that ends up in a press release.

The second concerns the boundaries of a statute. In the March order the judge traces § 3252 back to technical sabotage by hostile actors, and observes that the conduct charged to Anthropic does not appear to bear any relation to it. Anyone applying a power to exclude or suspend — in a tender, a compliance clause, an internal policy — should check that the case at hand fits the written definition, not the convenient one.

These are the two axes on which we build controls: the discipline needed to document a decision so that it can be defended produces the same record that will later show, if the decision was wrong, that it was.

Want to check whether your vendor-exclusion or access-suspension process would survive a full read, not just its headline? Half an hour with one of our experts to map the contractual and documentary risk.

The facts, in order

The memo that was supposed to prove a technical risk

Winning in one court does not end the fight in the other

What it leaves behind, for anyone assessing a vendor or counterparty

Sources