The series that translates national-security and AI-policy arguments across partisan lines, because the stakes are too high for tribal shorthand.
Anthropic Round 3: The Panel Was Hot
What Happened This Week
Nine days ago, on Monday, May 19, the D.C. Circuit heard oral argument in Anthropic v. Department of War. The panel was Judges Karen LeCraft Henderson, Gregory Katsas, and Neomi Rao. The room was full. I have watched a lot of administrative-law arguments in that courthouse, and the panel split visibly. Henderson hammered the government from her first question. Rao leaned the other way, pressing Anthropic on whether the court should second-guess executive national-security determinations and on the opacity of frontier models. Katsas occupied the middle, pushing on the technical feasibility of model-side limits and on how fast the underlying technology is changing. The case is closer than the most heated coverage suggests, and Katsas is the swing.
Judge Henderson, in a moment that has now circulated widely, said in open court: "To me, this is just a spectacular overreach by the department." That is not throat-clearing. That is a sitting circuit judge characterizing the agency action as something other than colorable. Judge Katsas pressed on a different angle, in two registers. He pointed out that Anthropic already constrains its model in significant ways ("we're going to build limits into the model, we're not going to sell something that can produce child pornography or nuclear weapons") and asked whether further use restrictions could be implemented at the model layer as a narrower remedy than procurement cutoff. He also pressed the harder question on the other side: "The model is unpredictable," and "AI three months from now will be totally different from the AI of today," which is the version of the same record that supports the government's case for a coarse procurement tool rather than fine-grained technical control. Judge Rao, the panel's third vote, leaned toward the government. She pressed Anthropic's counsel on model opacity, echoing the Pentagon's posture that the court should not second-guess national-security determinations about what is embedded inside a system the deploying agency cannot fully inspect.
The court took it under advisement. The D.C. Circuit's typical expedited timeline for a case of this posture runs six to twelve weeks, which puts the ruling somewhere between late June and mid-August. The government has been preparing a Plan B for at least four weeks, according to people who would know. The Anthropic legal team, after argument, declined to characterize the bench's posture beyond saying they were grateful for a thorough hearing. They could afford restraint. The bench did the work for them.
Here's What You Need to Know in 30 Seconds
The D.C. Circuit panel in Anthropic v. Department of War split visibly at oral argument on May 19. Henderson called the supply-chain-risk designation "spectacular overreach." Rao pressed Anthropic on model opacity and on whether the court should defer to executive national-security judgment. Katsas, the swing, pushed on both sides: model-side use restrictions as a narrower remedy, and on the rapid-evolution problem that makes any narrower remedy hard to verify. The ruling could go either way and Katsas is the vote that decides it. A ruling against DoW would do something larger than vindicate Anthropic: it would narrow the executive's ability to use procurement designations as a substitute for AI policy. A ruling for DoW would, conversely, ratify procurement-as-policy at exactly the moment the administration is leaning harder on it (the April Pentagon-Google deal, the pulled May security EO). Either way, the Henderson opinion (whether majority or dissent) will be cited going forward. The ruling is expected between late June and mid-August. The market is already pricing it both ways.
The Hawk Case: Procurement Is the Executive's Job
The hawk position, in the version worth engaging, is not the trivial "the Pentagon should be able to buy what it wants" version. The serious hawk argument is that procurement discretion has been, since the founding, a core executive prerogative. The Federal Property and Administrative Services Act of 1949, the FAR system that grew out of it, and the entire architecture of federal contracting rest on the proposition that the executive branch decides who it does business with, on what terms, and with what conditions attached. The hawk reads the Anthropic designation as falling squarely within that tradition. The Department of War concluded, after an internal review, that the integration profile of a frontier Anthropic deployment in classified environments posed risks the department was not prepared to absorb. Whether you find that conclusion persuasive on the technical merits, the hawk argues, is a different question from whether the department has the authority to reach it.
The hawk also reads the supply-chain-risk designation as the right administrative vehicle for the underlying concern. The SECURE Technology Act framework exists precisely because the procurement system needed a way to act on vendor risk faster than ordinary debarment proceedings allow. Anthropic was the first frontier-model developer designated under that framework, but it was not the first vendor designated, and the hawk argues that singling out the AI case as procedurally unusual ignores the eight or ten hardware cases that established the precedent. The vendor accountability function the framework was built for is exactly the function it is now performing. The hawk would prefer that the court read the case narrowly: did the department follow the procedural requirements of the framework, and were its conclusions supportable on the administrative record? Both answers, the hawk argues, are yes.
The hawk further argues that the panel's posture at oral argument was more divided than the press coverage suggests. Henderson is a hot-bench judge by temperament; the "spectacular overreach" line is quotable, but it was paired with sharp questions about the standard of review that cut closer to the government's strongest defense. Katsas's question about model-side use restrictions cuts both ways: the hawk reads it as a serious inquiry about whether the technical premises of the designation hold up, which is exactly the inquiry the government would prefer the court conduct, because that inquiry is governed by deferential review of the agency's expert judgment. Rao's model-opacity line leaned the government's way. The hawk is not predicting a win. The hawk is predicting that the case is closer than the room felt to the press in the front rows on Monday, and that the actual swing vote is Katsas, not Henderson.
The hawk's bottom line: Procurement is the executive's job. The Department of War made a national-security judgment about a vendor in a domain where the department's institutional expertise is the relevant expertise. The supply-chain framework exists to operationalize exactly that judgment. A circuit panel that disagrees with the policy outcome should not invent a doctrine that strips the executive of the authority Congress gave it in 1949 and reaffirmed in 2018. The right reading of the case, on the hawk's view, leaves the designation in place and lets the political branches argue about whether procurement is the right policy lever.
The Reformer Case: Procurement Is Not the Same as Policy
The reformer position concedes the executive's procurement authority and rejects what the administration has tried to do with it. The reformer agrees that the Department of War can decline to contract with a vendor. The reformer disputes that the same authority extends to operating a supply-chain-risk designation as a site-wide debarment that prevents any federal agency, anywhere, from contracting with the vendor for any purpose, including purposes wholly unrelated to defense or national security. The supply-chain framework was built for narrow hardware-risk cases where the vendor's compromised component would propagate across systems. Applying it to a frontier AI developer, where the alleged risk is the developer's deployment profile rather than a contaminated component, is not what the framework's drafters had in mind, and the reformer reads the panel's skepticism on May 19 as evidence the framework's text does not bear the weight the government is putting on it.
The reformer also reads the designation as procurement-as-policy in a sense the hawk obscures. If the executive cannot get a regulatory framework for frontier AI through Congress (and it cannot), and if the executive cannot get a self-executing standard through ordinary rulemaking (and the relevant agencies have not tried), then designating a single vendor under a supply-chain framework that was never built for the purpose is doing the regulatory work that the political branches declined to do, in a posture that is structurally insulated from notice-and-comment review. That is not vendor accountability. That is policy by enforcement action against a single named target, and the reformer argues that this is exactly the use of executive authority the courts exist to police.
The reformer reads Henderson's role on the bench accordingly. Henderson's "spectacular overreach" was not throat-clearing, in the reformer's view; it was the panel's senior judge signaling that the case had moved past whether the designation was procedurally defective and into whether the executive had authority to make this kind of designation at all. Katsas's model-side use restriction question, the reformer argues, was a roadmap to a narrower remedy that would let the court rule for Anthropic without disturbing the broader supply-chain framework: if the alleged harm can be addressed by what the developer does in the model, the designation fails ordinary tailoring review. Rao's model-opacity questions cut the other way, the reformer concedes, but a Katsas-Henderson opinion on tailoring grounds does not need Rao. The reformer's case is that a 2-1 ruling against the designation, narrowly written, holds the framework intact while invalidating the administration's attempt to use it as an AI regulatory vehicle. The reformer is not predicting that outcome. The reformer is arguing it is the outcome that fits the record best.
The reformer's bottom line: The judicial check on the Anthropic designation is the right check. It does not say the executive cannot contract or decline to contract. It says the executive cannot use a narrow procurement-risk tool as a substitute for the AI regulatory regime that Congress has not enacted. If the administration wants frontier-AI policy, it should pass frontier-AI policy. The supply-chain framework was not built to fill that vacuum, and on May 19 the D.C. Circuit suggested, in three different voices, that it will not be permitted to.
Where They Actually Agree
The hawk and the reformer agree that the panel split visibly. They read the same transcript and come to different forecasts about what it means, but they agree on what happened in the room. They agree that Henderson's "spectacular overreach" line will appear in whatever the court issues, in some form, whether as the engine of the majority or as the centerpiece of a dissent. They agree that Katsas's model-side question is the question on which a narrow opinion would turn, and that Katsas is the swing. They agree that Rao's posture made a 3-0 ruling against the designation unlikely. The disagreement is about whether a Katsas-Henderson majority materializes, and whether that majority writes narrowly or broadly.
Both sides agree that the timing of a ruling matters more than usual. If the D.C. Circuit issues an opinion in late June, the administration has roughly four months to absorb it before the November budget cycle and roughly six months before the FY 2027 NDAA conference report. If the opinion does not arrive until mid-August, the political branches have already moved past the live policy window in which an adverse ruling would be most disruptive. The hawk welcomes the longer timeline. The reformer prefers the shorter one. Both are reading the same calendar.
Both sides agree that this is the consequential case of the spring. The original Anthropic challenge in March, the April 8 stay denial, the April 29 Pentagon-Google contract announcement that arguably moved the matter from theoretical to operational, and now the May 19 oral argument have been a sustained four-month sequence in which the question of whether executive procurement authority can carry the weight of AI policy has been litigated in something close to real time. Both the hawk and the reformer expect the panel ruling to be cited in every major procurement decision involving a frontier-AI vendor for the rest of the decade. That is a lot of weight to put on a three-judge opinion. Both sides agree the panel knows that.
Where They Don't (And Shouldn't Pretend To)
On whether procurement is a legitimate policy lever for AI. The hawk treats procurement as one of the few levers the executive has that does not require congressional cooperation, and reads the use of that lever as appropriate executive action in a domain where the legislative branch has abdicated. The reformer treats procurement-as-policy as a category error: contracting authority exists to acquire goods and services on advantageous terms, not to operate a back-door regulatory regime that bypasses notice and comment. Both readings are defensible. The dispute is whether the operational use of procurement to shape industry behavior is a feature of executive authority or an abuse of it. The Anthropic case is the cleanest test of that question the courts have seen on AI.
On the precedent value of a ruling against DoW. The hawk reads even an adverse ruling as narrow: the panel will likely say something about the specific designation without disturbing the broader framework, and the executive will rewrite the designation on a tighter record and try again. The reformer reads an adverse ruling as structurally significant: a circuit opinion holding that the supply-chain framework cannot bear the weight the administration is putting on it will be cited in every future case where executive procurement authority is used as a substitute for regulation. Both are reading the same likely opinion text. They are forecasting different downstream behavior by the administration, the agencies, and the lower courts.
On whether the pulled May AI security EO matters here. The hawk treats the pulled EO as a separate event involving a different policy question and a different procedural posture. The reformer reads the pulled EO and the Anthropic case as two halves of the same picture: in both, the administration tried to make AI policy through executive instruments designed for other purposes, and in both, the political and legal feedback was that the instrument would not bear the weight. Both readings are consistent with the public facts. The disagreement is whether to treat the two events as connected. The reformer's read seems more parsimonious to me, but the hawk has the better argument that connecting the two requires inference the public record does not yet support.
On what Anthropic itself wants. The hawk reads Anthropic as a litigant pursuing its commercial interest, full stop, and treats the company's broader policy statements as the kind of strategic positioning any major procurement plaintiff would engage in. The reformer reads Anthropic as a litigant with an unusual amount of public-interest alignment with the reformer position, because the company has genuine institutional reasons to want a federal regulatory regime rather than a procurement-driven one. Both readings have evidence behind them. The hawk is right that Anthropic's brief is a litigant's brief. The reformer is right that the brief reflects a corporate position that has been remarkably consistent across three administrations.
Here's My Two Cents
Should the panel rule against the Department of War, the holding would do something larger than vindicate one vendor. It would narrow the executive's authority to use procurement designations as a site-wide instrument for shaping frontier-AI vendor behavior, and that narrowing would arrive in the same season as the failed May AI security EO, and the combined effect would be a fairly clear judicial and political signal that the executive branch cannot make AI policy by procurement contract alone. Should the panel rule for the Department, the procurement-as-policy approach gets ratified, but the Henderson dissent (or concurrence) will be cited in the next case, and the next case is coming. The Pentagon-Google deal in April was the high-water mark of procurement-as-policy on AI. The May 19 oral argument was the moment the tide started to be tested, whichever way it runs.
The thing worth saying clearly is that the panel composition is not what people expected at the start of the case. Henderson is a George H. W. Bush appointee with a long record of executive deference in national-security postures. Katsas is a Trump appointee with a textualist administrative-law profile. Rao is a Trump appointee who spent two years running OIRA and is the panel's most procurement-literate judge. None of the three is the panel the Anthropic litigation team would have drawn if it were drawing for hostility to executive authority. That Henderson landed where she did, on this record, with this designation, is the most consequential single fact from the argument: it suggests the government's theory is structurally weaker than the administration's internal review concluded, at least on the most executive-deferential vote on the panel. It does not, on its own, win the case. Rao leaned the other way. Katsas is genuinely uncertain. The center of gravity in the room was a Henderson-led skepticism that may or may not collect a second vote.
The power-moves frame here is straightforward. If the panel rules for Anthropic in late June or July, the administration's procurement-as-policy approach to AI gets a structural ceiling. The Department of War can still decline to contract with vendors on standard procurement grounds. What it cannot do is operate the supply-chain framework as a regulatory substitute. That ceiling, combined with the pulled security EO and combined with the stalled NPF preemption legislation, leaves the administration with one functional path for federal AI policy: ordinary legislation, through ordinary committee processes, on ordinary timelines. That is the path the administration spent the spring trying to avoid. By August, it may be the only path the executive has left.
The political read is that the administration is hedging. The Plan B work that has been quietly happening for four weeks is contingency planning for a panel that could go either way: a narrower designation, a partial withdrawal, or both, contingent on the ruling. None of those options recover the policy ambition the original designation was supposed to deliver. Even on a government win, the administration's internal review reportedly concedes that the supply-chain vehicle has carried as much policy weight as it can carry without congressional backing. The hedging itself is the signal.
What you should watch in the next eight weeks is whether the administration pre-empts the ruling. There is a not-trivial chance that the Department of War, under pressure from White House counsel, narrows or withdraws the designation before the panel issues its opinion. That would moot the case, deny the panel the chance to write the doctrine, and let the administration claim a procedural victory while quietly conceding the substantive one. The cleanest tell would be a Federal Register notice between now and mid-July adjusting the designation's scope. If that notice appears, the administration has concluded that the panel ruling would be worse for executive procurement authority than walking the original designation back. If no such notice appears, the administration has concluded it can live with whatever the panel writes. Either way, the procurement-as-policy era of executive AI governance is closing. The only question is whether it closes by judicial opinion or by administrative retreat. By Labor Day, we will know which.
Related Briefings
Anna R. Dudley writes on national security, intelligence policy, and the places where hawks and reformers need to find each other. Bipartisan Translation is the weekly series for the conversation that is not happening on cable news. Subscribe at annardudley.substack.com.