Anthropic's War With the Pentagon — and What It Couldn't Stop

On June 10, Dario Amodei sat across from Bloomberg's Emily Chang and said he doesn't know what role Claude played in the missile strike that killed an estimated 120 children at an elementary school in Minab, Iran, in late February. "Look, we don't have access to, we don't know exactly how these models were used," he said.1 He added that the use case, if Claude was involved, did not violate the company's policies — and that military leaders make terrible mistakes "even at the best of times."

That interview compressed three months of institutional collision into a single public admission: Anthropic had drawn lines with the Pentagon, the Pentagon had crossed them anyway, and now Anthropic's CEO was on television explaining, with evident discomfort, why he couldn't trace what his company's AI had done inside a classified military operation.

Anthropic had been the Pentagon's primary AI vendor. Claude was deployed across the Department of War — the administration rebranded DoD in January — and other national security agencies for intelligence analysis, operational planning, cyber operations, and modeling and simulation.2 The company was, by its own account, the first frontier AI lab to deploy models on the U.S. government's classified networks.

That relationship fractured in February. The DoW presented Anthropic with a demand: grant access for "any lawful use," including two categories the company had deliberately kept out of prior contracts — mass domestic surveillance and fully autonomous weapons (those that select and engage targets without a human in the loop).2 Amodei refused. His published statement on February 26 laid out the reasoning: frontier AI makes mass domestic surveillance newly dangerous at scale even when technically legal, and current AI systems are not reliable enough to power autonomous targeting.

Defense Secretary Pete Hegseth responded by designating Anthropic a supply chain risk — a label the U.S. has historically applied only to foreign adversaries. The designation requires all defense contractors to certify they will not use Claude in any Pentagon work.3

The designation was issued in early March. U.S. strikes on Iran began February 28 — one day after the contract talks collapsed. Preliminary military reports, cited by The New York Times and The Wall Street Journal, found U.S. forces were likely responsible for the Minab school strike, which investigators believe was based on outdated intelligence that misidentified the site as still military.1

The DoW continued using Claude through the early weeks of the Iran campaign — the blacklist designation and the contractual offboarding are not the same thing, and transition to substitute models takes time. Amodei's position, stated on the Bloomberg broadcast: "The principle that we have established, and I think the principle that was obeyed here, is that a human makes the final decision." He added that he does not know what role Claude specifically played but argued the incident illustrates precisely why that principle matters.

Amodei also defended the broader posture: "We don't want a world where China and Russia can build, can analyze all the intelligence with AI, can use AI for attacking Taiwan and Ukraine, and we can't defend them."4

Anthropic did not accept the supply chain designation quietly. The company filed suit against Hegseth and the DoW in March. Because the DoW relied on two distinct legal instruments to impose the designation, Anthropic is fighting two separate proceedings in two courts simultaneously.

The first and higher-profile case is before the D.C. Circuit. On May 19, a three-judge panel — Henderson, Katsas, and Rao — heard nearly two hours of arguments.3 Judge Henderson was pointed: "I don't see that the department has in any way supported its determination that there is a supply chain risk with Anthropic, much less a significant supply chain risk." She called the DoW's actions a "spectacular overreach." The government's attorney argued that Anthropic's technical ability to encode model limitations — even if not yet exercised — constitutes an inherent national-security risk. Anthropic's counsel countered that there is "no record evidence" of any attempt to encode the two narrow restrictions into deployed models, and characterized the dispute as a contract disagreement being dressed up as a security threat. The panel has taken the matter under advisement.

The second case, filed in federal court in San Francisco, resulted in a preliminary injunction: government agencies other than the DoW can continue using Anthropic's models while the litigation proceeds. The San Francisco judge's written order included the line: "Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government."

The April ruling by the D.C. Circuit denied Anthropic's request to temporarily block the designation across the board, but the court agreed to expedite the case, noting the company "will likely suffer some irreparable harm" while litigation plays out.3 The OpenAI and Google DeepMind are being tested as Claude replacements inside the DoW.

Running in parallel to the Pentagon conflict is a quieter arrangement. The Financial Times reported on June 4 that Anthropic is actively helping the National Security Agency deploy Claude Mythos for offensive cyber operations — with Anthropic engineers embedded on-site.5

That relationship sits outside the DoW supply-chain designation, which was targeted specifically at the Department of War. The San Francisco injunction preserved access for other agencies, and the NSA arrangement predates it.

The existence of that program alongside Amodei's public statements about AI-in-war governance creates a narrower-than-advertised picture of what Anthropic is actually restraining. The company's two red lines — no mass domestic surveillance, no fully autonomous weapons — allow offensive cyber and intelligence operations. Those happen to be NSA's primary missions.

The public admission creates new legal and reputational exposure. Anthropic's brief to the D.C. Circuit states the company has no visibility into how Claude is used once deployed in classified environments. The Bloomberg interview confirmed that at a factual level. It also framed the company's accountability posture: if a human signed off on a strike, Anthropic considers its policy obligations satisfied regardless of what the AI contributed to the intelligence or targeting chain.

That framing is likely to draw scrutiny from Congress, which has been asking questions about AI in military decision loops since the Minab strike, and from foreign policy observers assessing what meaningful human oversight actually means when AI systems compress the analysis window to seconds.

President Trump told CNBC in April that a deal between the DoW and Anthropic is "possible." No deal has been reached.3 The D.C. Circuit is expected to issue a written opinion before the summer recess; the outcome will determine whether the supply chain designation stands, is vacated, or is remanded back to the DoW to justify with better evidence.