Newly Unsealed Emails Show the Pentagon Told Anthropic Its Guardrails Were "Not Workable" — a Day After Blacklisting It as a Threat

Read the emails in the order they were sent, not the order the Pentagon announced them, and the story changes completely.

On February 27, Defense Secretary Pete Hegseth publicly declared Anthropic a "supply chain risk" — a designation the Department of Defense formalized on March 3, citing a national security threat. Court filings unsealed July 2 show that around the same window, Emil Michael, the Pentagon's Under Secretary of Defense for Research and Engineering, was privately emailing Anthropic CEO Dario Amodei that a contract deal was "very close."

The dispute at the center of it is specific. Anthropic maintains two hard limits on Claude: no fully autonomous weapons systems that remove a human from the engagement decision, and no domestic mass surveillance. When Amodei flagged that the Pentagon's proposed contract language appeared to eliminate those limits entirely, Michael did not deny it. He called the guardrails "just not workable."

Federal Judge Rita Lin, who granted Anthropic a preliminary injunction in March, quoted the email exchange directly, calling it "exceedingly difficult to square" with the government's simultaneous public position that Anthropic was a hostile national security threat. The timeline reads less like a security assessment and more like a negotiating tactic: designate a vendor as untrustworthy in public while continuing to press it privately to drop the specific safety commitments the government finds inconvenient.

The implication for AI investors extends well past Anthropic's cap table. Government contracts have become a core revenue thesis for nearly every frontier lab and a growing share of application-layer AI startups chasing defense and federal budgets. This case establishes, in a public court record, that a "national security risk" designation can be deployed as leverage over a vendor's product guardrails rather than as a genuine security finding — which means the designation itself is now a negotiable variable, not a fixed constraint.

That should worry any founder building a business model on the assumption that serving the government is a stable, apolitical revenue category. It has never been apolitical. What's new is that the mechanism — blacklist first, negotiate the guardrails down after — is now documented in a federal court record instead of implied. The next lab that holds a safety line against a procurement demand should assume the same playbook is available against it, in public, before the ink on any contract is dry.