Latest / AI Newspaper / D.C. Circuit Upholds Pentagon Blacklist of Anthropic

Transcript

D.C. Circuit Upholds Pentagon Blacklist of Anthropic · AI Newspaper

0:00
Welcome to the AI Newspaper, your daily update
0:02
on everything happening with AI. Visit AINewspaper
0:06
.org to see today's stories and sign up for email
0:09
alerts. So, I want you to imagine just for a
0:13
second that you are building a product. Okay.
0:16
And you build it with these really strict, carefully
0:19
designed safety features, like features that
0:21
are specifically engineered to protect people
0:23
from harm. Right, like a seatbelt or a failsafe.
0:26
Exactly. But then... Imagine the United States
0:30
government stepping in and legally declaring
0:32
those exact same safety features to be a national
0:35
security supply chain risk. Which, I mean, it
0:38
sounds like a total contradiction, right? Yeah.
0:40
You design this mechanism to prevent catastrophe,
0:42
and then the government turns around and classifies
0:45
that mechanism itself as the actual threat. Well,
0:48
that is exactly what just happened. And it is
0:51
sending absolute shockwaves through the tech
0:53
world today. Oh, absolutely. A federal appeals
0:58
court panel in Washington, D .C. just upheld
1:00
the Pentagon's blacklisting of the AI company
1:02
Anthropic. It was a two to one decision. Wow.
1:05
And the result of this is that the Department
1:07
of War, which as a quick reminder for anyone
1:10
just catching up, is what the Department of Defense
1:12
is now called. Right. The recent name change.
1:14
Yeah. So the Department of War is legally blocking
1:17
the military and all of its contractors from
1:19
using Anthropic's clawed AI models. Which is
1:22
just an incredibly significant structural shift
1:25
for the whole industry. It really is. I mean,
1:27
think about it. When a lab's internal safety
1:29
guardrails can be legally treated as a national
1:31
security supply chain risk, AI ethics stops being
1:34
a corporate branding choice. Yeah, it's no longer
1:37
just a PR move. Exactly. It's not just a mission
1:40
statement on a website anymore. It becomes this
1:42
hard procurement veto that the government can
1:44
and clearly will enforce. So our mission today
1:48
is to figure out how we actually arrived at a
1:51
federal blacklist. We're going to unpack how
1:53
a massive $200 million government partnership
1:57
completely fell apart. Yeah, totally collapsed.
2:00
We'll look at the actual battlefield incidents
2:02
that triggered the split. And then this fierce
2:05
legal battle over a single word in federal procurement
2:08
law, a word that honestly just changed the entire
2:11
landscape of artificial intelligence. It's wild
2:14
to think it all came down to one word. Right.
2:17
But to start, we really have to look at the foundational
2:20
collision here between Anthropic's core mission
2:23
and the Pentagon's new operational strategy,
2:26
because, you know, they didn't start out as enemies.
2:29
No, not at all. They were partners. So back in
2:32
July 2025, Anthropic and the Pentagon signed
2:35
this $200 million contract. And Anthropic was
2:38
actually an early partner across several U .S.
2:40
agencies, you know, providing models for various
2:42
administrative tasks, analytics, that sort of
2:45
thing. Basic back -end stuff. Exactly. But the
2:48
friction really began when they started negotiating
2:50
the deployment of Claude on the military -secure
2:53
GenAI .mil platform. And what exactly is that
2:56
platform? So that platform is specifically designed
2:58
for active military operations. It's the real
3:01
deal tactical stuff. And that is where talks
3:04
just completely collapsed. Because the reporting
3:06
shows they collapsed over two very specific red
3:08
lines, right? Like lines that Anthropic absolutely
3:11
refused to cross. Yes. First, they would not
3:14
allow Claude to be used for lethal autonomous
3:16
weapons. And second, they wouldn't allow it to
3:19
be used for domestic mass surveillance. And we
3:21
should clarify, those aren't just like handshake
3:23
agreements. Right. Anthropic explicitly codes
3:26
these restrictions into Claude's underlying architecture.
3:28
It's often referred to as its constitution. So
3:31
it's baked in. Completely baked in. This isn't
3:34
just a filter slapped on top of the software.
3:36
It's a fundamental part of how the model is trained
3:38
to even weigh its responses. Wow. Yeah. I mean,
3:42
it is mathematically penalized during training
3:44
for helping with tasks it considers harmful or
3:47
lethal. Which brings us to the Pentagon's response.
3:50
Because in January 2026, the Secretary of War,
3:53
Pete Hegseth, laid out this comprehensive AI
3:57
-first warfighting strategy. Right, the new directive.
4:00
Yeah. And a core pillar of that strategy was
4:02
a demand that AI models used by the military
4:05
just must be free from usage constraints. No
4:09
limitations. Exactly. Hegseth required that government
4:13
contracts include language permitting all lawful
4:16
uses, meaning... If the military's use of the
4:18
AI is legal under U .S. and international law.
4:21
The tech company is not allowed to restrict it.
4:24
Right. So, OK, I want to make sure I understand
4:27
the dynamic here, because it sounds like the
4:29
Pentagon is hiring a brilliant mercenary, right?
4:32
OK, yeah. But the mercenary is handing over a
4:35
list of specific targets they morally refuse
4:38
to shoot at. So at what point does the military
4:40
just look at them and say, well, we can't work
4:42
with someone who second guesses our orders? I
4:44
mean, the mercenary analogy is a really good
4:47
starting point, but the Pentagon's counter -argument
4:49
is even more fundamental than that. How so? Well,
4:52
a human mercenary can be reasoned with in the
4:54
heat of the moment, right? You can explain the
4:56
context, the urgency, the specific legal authorization
4:59
for a target. You can talk them through it. Exactly.
5:02
But an AI cannot be reasoned with in that same
5:05
way. Secretary Hegseth actually accused Anthropic
5:08
of attempting to seize veto power over the operational
5:11
decisions of the United States military. Wow,
5:14
those are strong words. Yeah, because from the
5:16
military's perspective, giving a Silicon Valley
5:18
tech company the ability to dictate operational
5:21
limits is, well, it's basically a surrender of
5:23
sovereign military authority. And the fallout
5:26
from this was incredibly intense and highly public.
5:30
But before we dive into the political reactions
5:32
we're seeing in today's news, I do want to add
5:34
a quick reminder for you listening. Yeah, this
5:37
is important. We are looking at some highly politically
5:40
charged reporting here. We aren't taking any
5:43
sides or endorsing these viewpoints. We're simply
5:45
unpacking the facts and arguments exactly as
5:48
they're playing out in the public sphere. Just
5:50
reporting what's there. Exactly. But this dispute
5:53
reached all the way to the White House. President
5:55
Trump publicly slammed Anthropic CEO Dario Amadei
5:59
on Truth Social. He really went after him. He
6:01
did. In his post, the president mocked Amadei
6:04
as a perfect little angel. And he explicitly
6:07
backed the administration's move to stop AI people,
6:10
as he phrased it, from doing bad things by restricting
6:13
the military. And that public tension perfectly
6:16
illustrates the philosophical divide, you know.
6:18
But debating ethics in a boardroom or on social
6:21
media is one thing. What forced the government's
6:24
hand legally was that this wasn't just theoretical.
6:27
The Pentagon's fears were triggered by real -world
6:30
operational incidents where Claude either hesitated
6:33
or just outright refused to act. Hold on, though.
6:36
How does this actually play out in the field?
6:38
Because the military must have realized this
6:41
was an issue before they ended up in federal
6:42
court. Oh, they did. Walk us through the Maduro
6:45
operation, because the reporting on this is just
6:47
wild. Yeah, this is really where philosophy hits
6:50
the battlefield. So on January 3rd, 2026, there
6:53
was a highly sensitive military operation aimed
6:56
at capturing Venezuela's president, Nicolas Maduro.
6:58
Okay. And during this operation, an anthropic
7:01
executive apparently questioned the propriety
7:04
of a prime contractor using Claude for the mission.
7:07
Wait, wait. Yeah. Mid -operation? Yeah. How does
7:10
an executive even know what the military is doing
7:12
in real time to question it? That is the crucial
7:16
point of friction right there. When you use cloud
7:18
-based AI infrastructure, the provider often
7:21
has visibility into the API calls. Which are
7:24
the prompts being sent to the model. Exactly.
7:26
They can see the prompts unless it's in a highly
7:29
secured, isolated environment. So the perception
7:32
within the Department of War was that an executive
7:34
was monitoring military activity and threatening
7:37
to pull the plug while operators were in harm's
7:39
way. Oh, wow. Yeah, the terrifying scenario for
7:42
a military commander is being in the middle of
7:44
a live, highly dangerous operation and suddenly
7:47
wondering if your intelligence software is just
7:50
going to stop working. Because someone in California
7:52
decides the mission violates a corporate policy.
7:55
Precisely. That is intense. And it wasn't just
7:59
kinetic military operations that got flagged,
8:01
right? There was also the incident with the Centers
8:03
for Disease Control and Prevention. Yes, the
8:06
CDC. So they tried to use Claude for research
8:09
related to preventing the spread of infectious
8:11
diseases. Okay. They were feeding the model data
8:14
about pathogens to model mitigation strategies,
8:17
standard epidemiological stuff. But Claude refused
8:21
the prompts. It just wouldn't do it. Nope. It
8:24
simply wouldn't answer, and it outputted a standard
8:27
refusal message instead. Okay, here's where it
8:30
gets really interesting, because there is a fascinating
8:33
layer of irony here. Totally. Anthropic built
8:36
those specific biological guardrails to save
8:38
lives. I mean, they trained the model to refuse
8:41
prompts about epidemiology and pathogens so that
8:44
a bad actor couldn't use the AI to synthesize
8:47
a bioweapon. Right, it's designed as a safety
8:50
feature. But the military... is looking at this
8:53
exact same behavior and realizing the software
8:56
can't tell the good guys from the bad guys. And
8:59
to understand why it does that, we really have
9:01
to look at the mechanism of how these models
9:02
work. Yeah, let's break that down. So the AI
9:05
lacks true situational awareness. It doesn't
9:07
understand context the way a human does. It's
9:10
using massive scale pattern recognition. Right.
9:12
So when it processes a prompt, it mathematically
9:15
maps the relationships between the words. If
9:18
a prompt triggers a high enough concentration
9:19
of weights and patterns associated with, say,
9:22
bioweapons or epidemics, the model's safety fine
9:25
-tuning kicks in. And it just overrides the output.
9:28
Exactly. It is completely blind to the user's
9:31
intent. It doesn't care that the user has a CDC
9:33
email address. It just sees the biological keywords
9:35
and shuts down. Wow. So because these internal
9:39
safety guardrails were now tangibly impacting
9:42
real government operations, like blocking CDC
9:45
research and complicating a mission to capture
9:47
a foreign head of state, the Pentagon suddenly
9:50
had the ammunition it needed to take action.
9:52
Exactly. And that action shifted this whole thing
9:55
from a philosophical debate about AI ethics into
9:58
a fierce legal battle over procurement law. Which
10:00
brings us to the bizarre legal split in how two
10:03
different federal courts view this exact same
10:05
conflict. Yeah, this part is fascinating. Because
10:08
Anthropic sued the government in two different
10:10
courts. And they did that because the government
10:12
invoked two completely different laws to justify
10:15
the ban. Right. So out in California, a San Francisco
10:18
federal judge struck down the ban under a law
10:20
known as 10 U .S .C. Section 3252. OK. What does
10:25
that law say? Well, we need to look at the history
10:27
of that specific law first. It was originally
10:30
designed to deal with foreign hardware threats
10:32
like Chinese telecommunications equipment. Oh,
10:35
I see. Because of that history, the law narrowly
10:38
defines a supply chain risk as an adversary acting
10:41
maliciously to sabotage a system. So the San
10:44
Francisco judge basically ruled that Anthropic
10:46
is an American company, not a malicious foreign
10:49
adversary. Exactly. Therefore, you cannot ban
10:51
them under a law meant to stop foreign espionage.
10:54
Makes sense. But the D .C. Circuit Court, which
10:57
is the ruling that just came down and upheld
10:59
the blacklist, they looked at a completely different
11:01
piece of legislation. Yes. They ruled under the
11:04
Federal Acquisition Supply Chain Security Act.
11:06
That's 41 U .S .C. Section 4713. OK. And this
11:11
law is written much more broadly to ensure general
11:13
supply chain hygiene. It applies to any person,
11:16
not just an adversary, who might deny, disrupt,
11:19
or manipulate the operation of covered technology.
11:21
So the D .C. Circuit decided that anthropic safety
11:25
guardrails fit the definition of a threat under
11:27
this broader law. Yes, exactly. And just looking
11:31
objectively at the media landscape today, you
11:33
see two completely polarized reactions to this
11:36
ruling. Oh, definitely. It's totally split. On
11:39
one side. Reporting praises the Pentagon. The
11:42
argument is that the military successfully prevented
11:44
the ideological whims of big tech from holding
11:47
warfighters hostage. Right. Basically proving
11:49
that corporate ethical limits rightfully lose
11:52
to the harsh realities of national security.
11:54
Right. That's one angle. But on the flip side,
11:56
you have reporting emphasizing anthropic's transparency
11:58
in First Amendment rights. They highlight CEO
12:01
Dario Amati's repeated warnings that current
12:04
AI simply isn't reliable enough to be trusted
12:06
with lethal autonomy. Which is a valid concern.
12:09
Yeah. And from that perspective, the ban is framed
12:12
as massive government overreach, punishing a
12:14
company for just being honest about the limitations
12:16
of its own technology. But, you know, when you
12:18
strip away the politics, the legal decision itself
12:20
came down to an intense debate over the definition
12:23
of a single word in that federal statute. Just
12:26
one word? Yes. The word manipulate. OK. The linguistic
12:30
debate here is what makes this so legally significant.
12:33
Yeah. The majority opinion. written by Judge
12:35
Gregory Katzis, argued that Anthropic's constitutional
12:38
training of the model actively manipulates the
12:41
software to deny functions that the military
12:43
contractually needs. Right. His logic is that
12:46
because Anthropic proactively programs the AI
12:49
to refuse certain tasks, they are intentionally
12:52
manipulating its output. But Judge Karen LeCraft
12:55
Henderson strongly dissented. What was her argument?
12:58
Her argument was that the majority was stretching
13:01
the word manipulate way beyond what Congress
13:03
ever intended. She pointed out that. In the text
13:06
of the law, the word manipulate is surrounded
13:08
by words like sabotage and maliciously introduce.
13:11
Oh, interesting context. Yeah. So in her reading
13:14
of the statute, that implies deliberate malicious
13:16
subversion, like a hacker secretly breaking into
13:19
a system to alter data. Not a safety feature.
13:22
Exactly. It absolutely does not mean a manufacturer
13:25
openly and transparently designing safety limitations
13:28
into their own commercial product before they
13:30
even sell it. I mean, if I build a car with a
13:33
physical speed limiter. So it physically cannot
13:36
go over 100 miles per hour. Am I manipulating
13:40
the car to disrupt the driver? Or am I just designing
13:44
a product with a known limit? And if the buyer
13:46
wants to go 120 miles per hour, they should just
13:49
buy a different car. It's a great analogy. But
13:51
the Pentagon's counterargument, which the court
13:53
agreed with, is that a car's speed limiter is
13:56
predictable. Predictable how? It is deterministic.
13:59
If you hit 100 miles per hour, it stops accelerating
14:02
every single time. AI does not operate that way.
14:06
Large language models are probabilistic. Okay,
14:08
break that down for us. They are basically...
14:11
guessing the next most mathematically likely
14:13
word based on billions of data points. That means
14:16
the model might help you analyze a target on
14:18
Tuesday, but suddenly refuse the exact same task
14:21
on Wednesday because the surrounding context
14:23
was worded slightly differently. Ah, triggering
14:26
a safety hallucination. Exactly. And that unpredictability
14:29
is what the military considers disruption. The
14:32
intent behind the manipulation doesn't matter
14:34
to a soldier under fire. The risk of unexpected
14:36
failure is enough. But wait, if the judge says
14:39
Anthropic is manipulating the software, that
14:41
implies they have an ongoing hand in it, right?
14:44
Like they are actively pulling levers. Yeah,
14:47
that's the implication. Can't Anthropic just
14:49
hand the software over to the Pentagon and walk
14:51
away? I mean, that leads us to the technical
14:53
dilemma of the kill switch. How much control
14:56
does Anthropic actually retain once the military
14:59
buys the AI? See, this was the core of Anthropic's
15:02
defense. They argued they have no remote kill
15:05
switch. They proposed delivering the model to
15:07
the military to be put on a classified air -gapped
15:09
system. And for those unfamiliar, an air -gapped
15:13
system is a computer network that is completely
15:15
physically isolated from the public Internet,
15:18
right? Right, and any other unsecured networks.
15:20
You literally cannot connect to it from the outside.
15:23
You literally cannot connect to it from the outside.
15:25
It's totally walled off. Exactly. So Anthropic
15:29
argued that once the model is on that air -gapped
15:31
system, they cannot access it, they can't alter
15:33
it, and they certainly cannot shut it down mid
15:36
-operation. So Anthropic's solution is essentially,
15:39
hey, here is the software, put it on your secure
15:42
servers. Test it yourself before you deploy it.
15:45
Yeah. Ask it the hard questions. And if you don't
15:47
like how it answers, just don't use that version.
15:51
Test it and refuse the update if you don't like
15:53
it. I mean... It sounds perfectly reasonable
15:55
until you realize why standard software testing
15:58
fails on large language models. Right. The Pentagon's
16:01
rebuttal, which the D .C. Circuit found highly
16:04
persuasive, is based on the technical reality
16:06
of modern AI. First off, these models are incredibly
16:10
opaque. We are talking about neural networks
16:12
with 5 to 10 trillion parameters. OK, for those
16:17
of us who aren't software engineers, what does
16:19
a trillion parameters actually mean in terms
16:22
of testing? So think of a parameter as a tiny
16:25
adjustable dial on a massive soundboard that
16:27
dictates how the AI connects concepts. Okay,
16:30
got the visual. A model with 5 to 10 trillion
16:33
dials is so phenomenally complex that rigorous,
16:36
mathematically perfect auditing is currently
16:38
impossible. You cannot just run a standard software
16:41
checklist to see if it works. Because it's probabilistic,
16:44
like you said before. Exactly. You can never
16:46
test every possible combination of words a soldier
16:49
might input. So advanced testing on an air -gapped
16:52
system is not a guarantee of how it will behave
16:54
in the chaos of a live environment. I see the
16:56
logic there. But what about the second part of
16:58
Anthropic's offer? If the military finds a version
17:01
that works well enough, why not just keep using
17:03
it? Because of the unprecedented velocity of
17:06
AI development, the military cannot afford to
17:08
just stick with an older, frozen model that they've
17:11
thoroughly tested. Things move too fast. Way
17:13
too fast. While they are using a model from 2025,
17:16
adversaries are constantly building stronger,
17:19
faster, more capable AI. The military desperately
17:22
needs continuous, state -of -the -art updates
17:24
to stay competitive. But every time Anthropix
17:27
sends a new update to keep the military competitive,
17:30
they are coding their updated safety restrictions
17:32
into that new version. Exactly. The military
17:35
felt they were trapped in an impossible cycle.
17:37
They desperately need the continuous technological
17:39
updates, but they cannot trust the shifting ethical
17:42
restrictions embedded inside those updates. Anthropic
17:46
also tried to argue that this whole blacklisting
17:50
was a violation of their First Amendment rights,
17:52
right? They did, yeah. They claimed they were
17:54
being punished by the government because their
17:56
CEO, Dario Amoroti, was publicly speaking out
18:00
about AI safety and the dangers of autonomous
18:02
weapons. They made that claim, but the court
18:04
dismissed it entirely. Really? Yeah. The court
18:06
ruled that the Pentagon didn't exclude Anthropic
18:09
as retaliation for public advocacy or protected
18:12
speech. They excluded Anthropic simply because
18:14
the company refused to accept a required condition
18:17
of the federal contract. The all -lawful uses
18:20
clause? Exactly. The court viewed it strictly
18:23
as a procurement dispute, not a free speech violation.
18:26
If you don't meet the terms of the buyer, the
18:28
buyer doesn't have to buy your product. Makes
18:30
sense. Now, you might be wondering, listening
18:32
to all this, why does this matter to you? Right,
18:36
the big picture. If you aren't a military commander
18:38
or an executive at a top -tier AI lab, why should
18:41
you care about this ruling? Well, if you work
18:44
in tech, if you work in government contracting,
18:47
or if you deal with corporate compliance in any
18:49
capacity, the ground just shifted underneath
18:52
you. It absolutely did. Your company's internal
18:55
safety policies, your acceptable use guidelines,
18:58
your carefully crafted ethics charters, they
19:01
are no longer just PR tools. Under this new legal
19:05
precedent, those exact guardrails can legally
19:08
classify your product as a supply chain risk.
19:10
It's incredible to think about. It gives the
19:13
government a literal veto over your federal contracts
19:15
if they decide your ethics get in the way of
19:18
their operations. It fundamentally forces every
19:21
AI company looking to do business with the government
19:23
to make a very stark choice. Do you hold on to
19:26
your internal constitution or do you bend to
19:28
the operational demands of your biggest potential
19:30
client? And the stakes for getting that choice
19:33
wrong couldn't be higher. No, they really couldn't.
19:35
And I think there is a chilling paradox here
19:38
that really captures the moment we are in with
19:40
artificial intelligence. What's that? Think about
19:43
the two competing fears driving this entire legal
19:46
conflict. On one side. You have Anthropic's CEO
19:49
warning of a future where a swarm of millions
19:52
of fully automated armed drones is coordinated
19:55
by an unconstrained AI. Terrifying. He fears
19:58
creating an unbeatable army that takes human
20:01
judgment and human morality completely out of
20:03
the loop. A machine that can do whatever it wants
20:05
at scale. Exactly. But the Pentagon's fear is
20:09
the exact opposite. They fear an AI that is so
20:12
heavily constrained by its creator's hidden parameters
20:15
that it hallucinates a refusal in the middle
20:18
of a critical operation. Paralyzing the system.
20:20
Right. And abandoning the humans who are relying
20:23
on it to survive. So in the escalating race for
20:27
military AI, it leaves us with this unresolved
20:30
question. Which is? Which is the greater risk?
20:33
The machine that does exactly what it wants or
20:36
the machine that refuses to do what we need.
20:39
Wow. That is a lot to think about as this technology
20:42
continues to evolve. Thanks for listening to
20:45
the AI Newspaper. Visit AINewspaper .org to catch
20:48
up on the latest updates and sign up for free
20:50
email alerts.