Anthropic Cleared GSA. The Pentagon Blacklisted It.

In August 2025, the General Services Administration approved Anthropic to sell AI to civilian agencies. Thirteen months later, a federal appeals court upheld the Pentagon’s decision to blacklist it over the risk posed by Claude’s integration with Defense Department systems. The same model supplier fit inside one federal purchasing channel and outside another.

The contradiction resolves at the point of use. Defense AI procurement is becoming a permission architecture: a model must be capable, but its supplier must also accept the terms under which officials can connect it to data, tools and consequential decisions. A frontier model can be valuable to the government and still be ineligible for a particular system when the government and vendor cannot agree who controls its operational use.

A contract can disqualify a model before it answers a question

The General Services Administration’s August 2025 approval of OpenAI, Google and Anthropic through its Multiple Award Schedule gave civilian agencies a route to buy from all three. It did not settle what the Pentagon could do with Claude after connecting it to military systems. A purchasing channel answers who may compete for certain work; an operational contract has to answer what the buyer and supplier may each permit, restrict or change.

That distinction became concrete in February 2026. The Pentagon demanded broader access to Claude, while Anthropic said proposed contract language made virtually no progress on preventing mass domestic surveillance or fully autonomous weapons use. Anthropic treated those uses as an AI safety boundary. The department sought authority to use a purchased tool for lawful military purposes without a supplier retaining a veto over missions.

The dispute was not simply about whether Claude could perform a task. Anthropic later said in a court filing that it could not manipulate Claude once the military had deployed it, disputing a Pentagon allegation about wartime tampering. A company’s asserted technical inability to alter a deployed model and its contractual power to forbid a category of use are different questions. The department’s concerns about integration and Anthropic’s objections to contract terms met at that boundary.

On August 28, a US judge blocked the blacklist and called the supply-chain-risk designation “illegal and baseless.” A later federal appeals court upheld the Pentagon’s designation, finding Claude’s integration with DoD systems to be a statutorily covered national-security risk. The appeals court issued one ruling, covered in two confirmed entries dated September 25 and 26—not two independent judgments. The earlier decision matters because the government’s legal authority was contested, not self-evident.

Nor did the appellate outcome establish a rule against frontier models as a class. Government-contract analyst Jessica Tillipman’s account of the Anthropic dispute locates a vendor’s retained rights in the acquisition pathway, contract type and negotiated terms. The Pentagon and a supplier can reach different arrangements under different contracts. That is less tidy than a universal rule, and considerably more important to a company deciding what it can promise.

Civilian eligibility does not travel into classified networks

GSA’s schedule and the Pentagon’s designation sit in different mission environments. In March 2026, GSA drafted guidance that would require companies on civilian AI contracts to grant the government an irrevocable license for “any lawful” use. The guidance was a draft, not a settled condition governing every federal purchase. It nevertheless showed that even civilian buyers were examining how much control a supplier could retain after a contract was signed.

The DoD took a separate route. In May, it struck agreements with AWS, Microsoft, Nvidia, Oracle and Reflection AI to use their tools on classified military networks for “lawful operational use.” A DoD official also said xAI had accepted an “all lawful use” standard for Grok in classified systems, the condition Anthropic resisted. Those agreements are evidence of continuing demand for commercial AI capacity, not a retreat into defense-only models. They are also evidence that entry to a classified network depends on terms attached to that capacity.

A classified-network agreement does not, by itself, demonstrate that a tool works reliably in every mission. It establishes a route for use. Before the blacklist, the Pentagon asked Boeing and Lockheed Martin to assess their reliance on Claude—an indication that removing a supplier can reach beyond a model endpoint into contractors’ existing work. The price of an unresolved permission question rises once other organizations have built around the answer.

The integrator owns the path from data to decision

The Defense Department was testing the surrounding system before the Anthropic fight reached court. Scale AI signed a one-year Pentagon contract to test and evaluate large language models for military planning and decision-making. After a $100 million DoD deal in 2025, Scale won a $500 million contract in May 2026 to sift data and assist decisions. The larger award concerns work between stored information and an official’s action, not ownership of a single frontier model.

That work has a specific economic logic. A prediction system needs the data to make a useful prediction, and an organization needs a way to test, interpret and act on the result. Better model output has limited value if the relevant data cannot be accessed under agreed rules, or if nobody has designed a decision process that can challenge the output. Scale’s incoming chief executive, Francis deSouza, described its role as helping enterprises and governments deploy AI they can “verify and trust.” Scale’s contracts give that phrase a practical setting: data preparation, evaluation and decision support.

Defense software companies are positioned differently from suppliers that sell model access alone. The Wall Street Journal reported that Anduril, Palantir and Scale were part of a group developing software for the planned $185 billion Golden Dome antimissile shield. That was a reported development effort, not a $185 billion contract award to those companies. Its significance lies in the proposed job: an operating system for a defense program would have to connect data and decisions across components that no single model supplies.

Shield AI offers another version of the integrated approach. The company raised $2 billion at a $12.7 billion valuation in March 2026, up from $5.3 billion after its March 2025 raise, and roughly half its business was autonomous software. It also planned to acquire a simulation-software maker. Investors were valuing a company built around autonomy, testing and aircraft deployment, rather than a general-purpose model alone. Scale, meanwhile, sued the DoD over what it called a recent procurement decision despite holding several department contracts. Embedded relationships do not remove competition or make eligibility permanent.

Operational control is not proof of field performance

Model evaluation and system evaluation ask different questions. The UK AI Safety Institute’s Inspect toolset evaluates capabilities including knowledge and reasoning. Microsoft’s ASSERT framework generates and runs behavior tests from natural-language descriptions. Both can help make claims about AI behavior testable. Neither a general capability score nor a written behavior test can stand in for observing an entire deployed system under the conditions in which people use it.

The distinction grows sharper when AI agents interact with external tools. An operator must decide which data an agent may read, which actions it may take, where it must stop, and who can inspect or override its work. The related agent control layer gives those permissions and escalation paths an address in software. In defense procurement, deployment accountability also needs an address in the contract: someone must be responsible for testing the system and for changing or halting its use when it fails.

Shield AI demonstrates why an integrated architecture cannot be treated as a reliability certificate. Reuters documented years of technical hitches and safety concerns involving its V-BAT autonomous drone. Shield may control more of the aircraft-and-software system than a model provider controls inside a customer’s workflow; that control also leaves it with the field-performance problem. The related origin-gated drone market shows another way permission can decide which products reach a buyer. Neither permitted origin nor permitted integration makes an aircraft fly correctly.

Anthropic CEO Dario Amodei has called for mandatory third-party testing of frontier models for cyber, biological and autonomy risks, with authority to block or revoke deployment. That proposal would give an outside evaluator power over some uses; the Pentagon’s contract position sought broad authority for the government as buyer. Testing can expose failure modes, but it cannot erase the underlying disagreement over who gets the final say.

GSA’s civilian schedule had a place for Anthropic. At the Pentagon’s classified-network door, Claude needed a key the buyer and supplier could not agree who should hold.