Anthropic argues it cannot reach into Claude, which is the whole pitch

Anthropic filed a 96-page brief with the DC Circuit on Tuesday asking the court to vacate the Department of Defense's supply chain risk management exclusion, the order, issued in late February, that bars DOD components and cleared contractors from procuring Claude for any classified workload.¹ It is, so far as I can tell, the first time the SCRM authority under 10 U.S.C. § 4876 has been used against a US-domiciled company rather than a Chinese or Russian one, and the brief spends a meaningful portion of its word count saying so in a tone of polite disbelief.

The structural story is not the novelty. The structural story is what Anthropic has chosen to argue, because what it has chosen to argue is also its enterprise sales pitch, read back under oath.

The argument, concretely

The exclusion order, as summarised in the brief's statement of facts, rests on a DOD finding that Anthropic retains "the technical capacity to alter, degrade, or withdraw model behaviour post-deployment" in a manner that constitutes an unacceptable supply chain risk for classified systems.² The government's theory, in other words, is that a frontier model is a live dependency: the vendor's ongoing control of weights, fine-tunes, and safety classifiers means the vendor is inside the perimeter even after air-gapped deployment.

Anthropic's response, across roughly forty pages of the brief's argument section, is that this is factually wrong. From page 31:

"Once a Claude model instance is deployed within a classified enclave pursuant to the deployment architecture described in Appendix C, Anthropic retains no technical mechanism, through network callback, update channel, embedded classifier, or otherwise, by which it can modify, disable, or observe the behaviour of that instance. The weights are static artefacts; the inference stack is operated by the customer; telemetry does not egress."³

The brief repeats this claim in several registers. It is a factual claim about the deployment architecture. It is a legal claim that the SCRM finding lacks a rational basis. And, this is the part I want to sit with, it is also, almost verbatim, the language Anthropic's enterprise team has been using in commercial sales motions for the better part of a year.

The frame: safety posture as market position

The cleanest lens here is safety-as-market-position. Anthropic's commercial identity, from the Constitutional AI papers forward, has been built on the claim that its safety apparatus is a feature buyers pay for rather than overhead they tolerate. The RSP framework, the ASL tiers, the interpretability research, these are priced into the Claude enterprise SKU in a way they are not priced into, say, the OpenAI enterprise SKU, and Anthropic has been consistent that this is the point.

The frame predicts that Anthropic will defend safety posture even when defending it is expensive, because the posture is the product. The DOD brief fits the prediction with unusual clarity. Anthropic is spending court time and counsel fees, Wilmer Hale is on the filing⁴, to argue, in a forum where the argument will be public and precedential, that it has deliberately engineered away its own ability to touch deployed models. This is the opposite of the position most SaaS vendors take in government procurement disputes, which is generally that their ongoing operational control is a benefit (patching, monitoring, threat response).

The frame also predicts where this gets uncomfortable. If Anthropic wins on the factual claim, if the court accepts that deployed Claude instances are genuinely isolated, then the safety story has to absorb the implication. An instance Anthropic cannot reach is also an instance Anthropic cannot patch if a jailbreak, a capability elicitation, or an RSP-triggering behaviour emerges in the field. The brief gestures at this on page 58, noting that "model updates are delivered through customer-controlled air-gapped media transfer, consistent with standard classified system lifecycle practice."⁵ Which is to say: if something goes wrong inside a classified enclave running Claude, Anthropic's recourse is to ship a USB stick to Fort Meade and ask nicely.

That is defensible. It is also a meaningfully different safety story from the one told in the RSP, which contemplates rapid mitigation, rollback, and deployment pauses as core levers. The DC Circuit brief and the RSP are, on their own terms, consistent, the RSP governs what Anthropic does with models it still controls, but the existence of a growing fleet of Claude instances Anthropic does not control is a fact the safety narrative has not yet fully metabolised.

Model weight lineage, quietly

There is a second frame in the background, which is the weights-as-IP lens. Appendix C of the brief, referenced but not public, apparently describes the deployment architecture in enough detail for the court; the public version redacts it. What is unredacted is the repeated assertion that the deployed weights are "static artefacts" operated by the customer. This is a carefully chosen formulation. It is the language of a licensed good, not a service. The brief is at pains not to describe Claude-in-DOD as SaaS, because SaaS implies ongoing vendor control, which is the thing being denied.

I would watch whether this framing shows up in Anthropic's commercial contracts over the next few quarters. If the DC Circuit posture becomes the template for how Anthropic characterises classified and regulated deployments generally, weights as delivered artefact, inference as customer operation, that is a quiet but real shift in how a frontier lab describes what it sells.

What this is a case of

It is a case of the first real test of whether the US government treats frontier AI vendors as critical infrastructure suppliers or as ordinary commercial counterparties. SCRM authority was built for Huawei. Applying it to Anthropic, whatever one thinks of the underlying DOD finding, pulls a domestic AI lab into a regulatory category previously reserved for adversary-state vendors. The brief notes this directly, which is brave.⁶

It is also a case of the commercial-safety narrative meeting a legal forum for the first time at this altitude. Anthropic has said many things about what it can and cannot do to deployed models in blog posts and sales decks. Saying them to a federal appellate court, under signature, with a 96-page record, is a different kind of commitment.

What to watch

The government's response brief, due in early June on the court's expedited schedule. If DOD argues the factual record rather than the legal standard, if it contests the "no callback, no telemetry" claim on technical grounds, this becomes a dispute about what Anthropic's deployment architecture actually does, which would be the most analytically useful public document the frontier-lab sector has produced in some time.

Whether any other frontier vendor files an amicus. The obvious candidates, OpenAI, Google, Microsoft, all have interests pointing in different directions, and silence from each will itself be informative.

Anthropic's next RSP update, and whether it addresses the growing population of instances outside its operational reach.

Footnotes

¶