March 24, 2026 | San Francisco
The preliminary injunction hearing in *Anthropic PBC v. U.S. Department of War* began at 1:30 p.m. Pacific time on Monday before Judge Rita F. Lin in Courtroom 15 of the San Francisco federal courthouse. It ran for the better part of the afternoon. By the time Judge Lin took the case under submission — saying she anticipates issuing an order “in the next few days” — the government had made two significant concessions on the record, the factual foundation of its sabotage theory had been publicly undermined, and the judge had told the government’s lawyer, directly, that its core argument didn’t make logical sense.
This is the full account of what happened.
What This Case Is About
To understand what was argued today, it helps to understand what the government actually did.
In late 2025 and early 2026, Anthropic was negotiating a contract renewal with the Department of War. The dispute came down to two things Anthropic said it would not allow its technology to be used for: mass domestic surveillance of Americans, and lethal autonomous weapons systems — systems that identify targets and initiate strikes without human decision-making in the loop. Those were Anthropic’s redlines, publicly announced and directly communicated to the Department.
The Department of War didn’t like those terms. On February 27, Secretary Hegseth posted on social media: “Effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic. This decision is final.”
Then, on March 3, the Department formally designated Anthropic as a “supply chain risk” under 10 U.S.C. § 3252 — a national security authority Congress created to protect the defense procurement process from foreign adversaries who might sabotage or subvert military technology systems. The designation was applied to an American company, the first time the authority had been used that way.
Anthropic filed suit. It argues the government retaliated against a company for its protected speech — its public statements about AI safety — and violated the statute’s procedural requirements in the process. It is seeking a preliminary injunction that would halt enforcement of the challenged actions while the litigation proceeds.
Today was the hearing on that motion.
How the Hearing Worked
Judge Lin published her questions in advance. The night before the hearing, she filed a notice listing six specific questions she wanted the parties to address in sequence. Each side would address each question before moving to the next. That structure gave the hearing an unusually focused quality: it proceeded as a directed examination of the record, with Judge Lin doing much of the driving.
Her questions covered the Hegseth social media post, the congressional notification defect, the scope of the supply chain risk designation, the statutory definition of “supply chain risk” and the government’s sabotage theory, the dating of the Emil Michael risk assessment memorandum, and standing as to specific named defendant agencies.
Question One: The Social Media Post
Judge Lin opened by noting the gap between what the February 27 post said and what the March 3 designation does.
The post, as written, would have required any company that does any business with the United States military to immediately stop all commercial activity with Anthropic — including, as Judge Lin put it, a law firm that advised the Department of War on an unrelated matter but used Claude for other clients. The § 3252 supply chain risk designation is narrower. It does not reach that.
The government’s position: the post was not a source of binding legal obligations on Anthropic or anyone else. It was not a final agency action under the Administrative Procedure Act. It should be read as signaling that DoW was going to take action — which it then did through the formal designation process. The post, the government said, “should end the matter.”
Judge Lin pressed: if the Department of War is assessing the situation every day and might receive new information about Anthropic’s risk profile, what prevents it from reverting to the broader interpretation of the post?
The government drew a careful distinction. It would not change its interpretation of the post. But if it received different information about Anthropic that changed its risk assessment, it would act accordingly.
That distinction — between interpreting the post and responding to new information — is one Judge Lin flagged without fully resolving. The government’s position leaves open the possibility that the broader threat the post represented could be reinstated under different circumstances.
Question Two: The Congressional Notification Defect — and a Significant Concession
This exchange produced the clearest concession of the hearing.
The statute requires that before designating any entity a supply chain risk, the Secretary must notify the relevant congressional committees and provide them with, among other things, “a discussion of less intrusive measures that were considered and why they were not reasonably available to reduce supply chain risk.”
Judge Lin asked directly: do defendants concede that Secretary Hegseth’s letters to the congressional committees did not contain that required discussion?
Government counsel: yes. The letters don’t have that discussion.
The government then argued the point away on two grounds. First, Anthropic forfeited the argument by not pressing it in its reply brief. Second, Anthropic has no standing to enforce a congressional notification requirement — that right, the government argued, runs to Congress, not to private companies. Whatever harm resulted from the omission was personal to Congress, not to Anthropic.
Judge Lin did not appear persuaded by the standing argument. She offered her own framing: the notification requirement exists so that Congress can weigh in on whether less restrictive alternatives were available before an extraordinary action is taken against an American company. If the Department skipped that process, the harm doesn’t land only on Congress — it lands on Anthropic too, which never got the benefit of congressional review of alternatives. The government didn’t have a clean answer.
Anthropic’s counsel went further. It wasn’t just the letters that were deficient, he told the court. Looking at the agency materials that predated the letters — the underlying administrative record — there is no discussion of less intrusive measures anywhere. Not in the letters, not in the documents that came before them. When the government addressed the issue in its opposition brief, it pointed to a declaration from Under Secretary Emil Michael dated March 17 — two weeks after the designation had already been made. That, Anthropic argued, is post-hoc rationalization, not a lawful administrative process.
Anthropic’s counsel put it plainly: it appears that the Secretary had made this decision on February 27, and agency staff were scrambling afterward to backfill the procedural requirements. “And not even doing that successfully.”
This observation — that the designation was outcome-first and process-second — runs through the entire case. The Second Declaration of Emil Michael, filed this morning, confirms that the Michael memorandum bearing the basis for the designation was completed and signed on March 2, 2026, one day before the formal March 3 designation.
Questions Three and Four: The Scope of the Designation, the Sabotage Theory, and a Technical Reckoning
These two questions went to the core of the government’s national security justification.
The scope question first.
Judge Lin asked whether the § 3252 designation sweeps more broadly than just barring Anthropic as a subcontractor in covered settings — specifically, whether a contractor that uses Claude Code as a tool to write software for DoW national security systems would face termination as a result.
The government’s answer was narrow: no. The designation’s primary operative provision is § 3252(d)(2)(C), which allows DoW to tell prime contractors they cannot use Anthropic as a subcontractor. A contractor using Claude Code as a coding tool would not be covered by the designation itself — DoW could address that separately through its contract management authority, but it wouldn’t flow from the supply chain risk designation.
Anthropic’s counsel added the statutory argument: the text of § 3252 does not reach suppliers or vendors whose commercially available products happen to be used by a contractor under a general license — the way a contractor might use Excel or Word. The authority is narrow. Professor Rosenstein’s amicus brief, cited in argument, notes that Congress has used different, broader statutory tools when it wanted to accomplish a broader ban.
Then the sabotage theory.
The statutory definition of “supply chain risk” is the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the operation of the Department’s national security systems. That definition was designed for foreign actors — the kind of supply chain threat posed by, say, Huawei. The government applied it to Anthropic.
To do that, the government needed a theory for how Anthropic — an American AI company that had been a willing contractor — posed a sabotage risk. Here is the theory it offered: Anthropic, during contract negotiations, pushed back on how DoW wanted to use its technology. That conduct destroyed trust. And if Anthropic was pushing back now, it might, in the future, push a malicious update to DoW’s systems — install a kill switch, manipulate model weights, subvert warfighter operations at a critical moment.
Judge Lin asked whether publicly announced usage restrictions, communicated directly to the Department, themselves constitute sabotage or subversion. The government conceded: no, they do not.
So the entire theory rests on what Anthropic might do in the future, based on what it has said openly in the present.
Judge Lin then asked the evidentiary question that exposed the theory’s foundation: what evidence in the administrative record shows that Anthropic had ongoing access to or control over Claude after delivering it to the government — such that Anthropic could actually engage in sabotage after the product was deployed?
The government pointed to language in the record about the risk that updates could introduce malicious functionality. The joint recommendation and the Michael memorandum both reference Anthropic’s ability and necessity to continuously update its product as the source of concern.
Judge Lin followed immediately: but updates have to be accepted by DoW, don’t they? Can Anthropic secretly push an update without DoW’s knowledge or consent?
Government counsel: we haven’t taken a position on whether Anthropic maintains that ability. There’s an audit underway.
Judge Lin made the government say it plainly: sitting here today, the Department of War does not know one way or the other whether Anthropic can, in fact, update its software on DoW systems without DoW’s knowledge or consent.
The government confirmed: correct. That audit is ongoing.
This is the evidentiary problem at the center of the case. The government designated Anthropic a national security threat — using authority designed for foreign adversaries — before it had confirmed whether the threat was technically possible.
Anthropic’s counsel addressed this directly. The company had introduced a technical declaration at docket 115 from engineer Thiyagu Ramasamy. The government did not contest that declaration in its filing this morning. The declaration states: before any model is deployed, DoW has extensive opportunity to test and approve it. After deployment, Anthropic has no ability to cause the model to stop working, alter its functionality, shut off access, or influence operations in any way.
An uncontroverted technical declaration says the threat doesn’t exist. The government’s own audit doesn’t know whether it does.
Anthropic’s counsel made the logical point that cuts through the whole theory: a real saboteur would not pick a public fight over contract terms. A saboteur accepts the contract, and then does the nefarious thing quietly. Everything Anthropic has been accused of in this proceeding has been done openly, publicly, and with direct communication to the Department.
Judge Lin said, on the record: “I’m not seeing the connection there.”
She went further, pressing the government on whether its theory would permit DoW to designate any IT vendor a supply chain risk if the vendor was stubborn, insisted on certain contract terms, and made the Department distrust them. “That seems like a really low bar,” she said. “Potentially one that could apply basically any case.”
The government did not offer a principled limiting principle in response.
Question Five: The Undated Memorandum
Judge Lin had asked in her pre-hearing questions when the Emil Michael memorandum — the risk assessment bearing Bates stamp DoW-PI-005 — was completed and signed.
The Second Declaration of Emil Michael, filed this morning, answered this: March 2, 2026. One day before the formal designation.
Question Six: Standing as to Named Agencies
The complaint names a large number of federal agencies as defendants, on the theory that each has contracts with or uses Anthropic’s technology. Judge Lin asked whether the record contained evidence of actual usage as to specific listed agencies — OPM, the Nuclear Regulatory Commission, the Social Security Administration, the SEC, NASA, the Federal Reserve, the National Endowment for the Arts, and the Executive Office of the President.
Anthropic’s counsel was candid: the record doesn’t yet contain evidence as to every one of them. He offered to file a supplemental declaration by 6 p.m. today. As to specific agencies, he confirmed: OPM announced internally it was terminating use of Anthropic technology; the Nuclear Regulatory Commission told Anthropic directly it was no longer using Claude and cited the presidential directive.
Judge Lin ordered the declaration filed by 6 p.m. today, with the government permitted to respond with counter-evidence by 6 p.m. tomorrow.
The Closing Arguments
For the government:
The government’s closing framed the case as a policy dispute dressed up as a constitutional claim. DoW has a policy of not using AI services with usage restrictions that give tech companies leverage over military decision-making. Anthropic refused to contract on those terms. That, the government argued, is commercial conduct — not speech — and the First Amendment does not protect it.
On First Amendment retaliation more specifically, the government argued three defects in Anthropic’s claim. First, Anthropic’s refusal to deal on the government’s preferred terms is not inherently expressive conduct protected by the First Amendment, citing *Rumsfeld v. FAIR*. Second, even if retaliatory animus was a motivating factor, the government would have acted the same way regardless — because it has a legitimate policy reason for requiring AI vendors to remove usage restrictions. Third, the government’s judgments in the national security context are entitled to substantial deference, citing *TikTok v. Garland*. The government also raised the *AFGD* case from the Ninth Circuit, in which the court upheld a presidential executive order affecting union rights even where retaliatory animus was assumed.
Judge Lin asked about the government’s invocation of the Pickering/Connick framework for government contractor speech. Neither party had briefed it, and the government acknowledged as much — noting it had raised the framework as an alternative only if the case got past the threshold question of whether the conduct was inherently expressive, which the government maintained it was not.
On procedural due process, the government argued Anthropic has not been deprived of a cognizable liberty or property interest — reputational harm is not enough, and a contracting relationship with the government is not a protected property interest. It also argued the Court of Federal Claims is the appropriate forum for any contract-related claims.
The government closed by invoking *Winter v. Natural Resources Defense Council* on the balance of equities — arguing that a preliminary injunction would interfere with the commander in chief’s and the Secretary of Defense’s judgments in the national security realm. It also requested that if the court enters any relief, it stay that relief pending appeal, and noted that Anthropic’s reply brief indicated it would not oppose a seven-day administrative stay.
For Anthropic:
Anthropic’s counsel was measured and direct. He said the parties generally agreed with the framework Judge Lin had outlined in what he referred to as her “tentative” — the overview she had offered at the opening of the hearing. He told the court Anthropic is likely to succeed on all four claims: First Amendment retaliation, APA, due process, and separation of powers.
On the relief requested, he was precise. Anthropic is not asking the court to require the government to keep using its product. The requested preliminary injunction would return the parties to the status quo as of the morning of February 27. On that morning, the Department could have decided it no longer wanted to contract with Anthropic. It could have terminated contracts. It could have wound down the relationship through the existing procurement process, following the statutes and regulations that govern how agencies make those decisions. What it could not do on February 27 — and cannot do now — is engage in unconstitutional retaliation, impose a secondary boycott it has now conceded has no valid legal basis, and effect what amounts to an immediate, prospective debarment of Anthropic from all future government contracting without any lawful executive authority for doing so.
Anthropic’s counsel also highlighted the breadth of amicus support: military leaders arguing these actions harm readiness, competitor AI lab employees arguing they chill debate on AI safety, Microsoft, industry trade associations. He noted that the harms extend beyond Anthropic.
Judge Lin thanked both sides for the quality of the briefing and argument. She said she anticipates issuing an order in the next few days, and took the case under submission.
What Happens Next
The court is under submission. A ruling on the preliminary injunction motion is expected within days.
Anthropic has until 6 p.m. today to file a supplemental declaration establishing evidentiary basis for standing against specific named agencies. The government has until 6 p.m. tomorrow to respond with counter-evidence.
If Judge Lin grants the preliminary injunction, the government has already indicated it will seek a stay pending appeal. Anthropic’s reply brief indicated it would not oppose a seven-day administrative stay to allow that process to proceed.
The parallel proceeding in the D.C. Circuit — a petition for review of a separate supply chain risk designation — continues on its own administrative track with April briefing deadlines.
The legal questions this case presents — whether the government can use national security authority to punish a private company for its public statements about how its technology should be used, what procedural protections accompany supply chain risk designations, and what “adversary” means when applied to an American company — will not be resolved by a preliminary injunction ruling. But a ruling here will set the terms for how this litigation proceeds, and signal how seriously this court takes the procedural and constitutional defects in what the government has done.
This account is based on listening in real time to the hearing, the notice of questions filed by Judge Lin on March 23, the Second Declaration of Emil Michael filed March 24, the amicus briefs filed by employees of OpenAI and Google DeepMind and by the civil liberties coalition including FIRE, EFF, Cato, and the First Amendment Lawyers Association, and underlying case filings in Case No. 3:26-cv-01996-RFL, N.D. Cal.
I don't know how you have the time!! But I appreciate it.