On September 25, the United States Court of Appeals for the District of Columbia Circuit denied Anthropic's petitions, 2–1. Judges Gregory Katsas and Neomi Rao upheld the Department of War's decision to exclude Claude from its supply chain under the Federal Acquisition Supply Chain Security Act of 2018. Judge Karen LeCraft Henderson dissented. The fight started when Anthropic refused to drop contractual bans on lethal autonomous warfare and mass surveillance of Americans.

The majority held that good-faith safety restrictions can still count as a "supply chain risk" under 41 U.S.C. § 4713. The government did not have to prove malice. Anthropic trains Claude to refuse certain tasks; those refusals had already stopped government users; future versions could do the same. That is a procurement instrument, not a public ban on the chatbot. (D.C. Circuit opinion; Al Jazeera)

Anthropic told reporters it respectfully disagrees. A spokesperson pointed to a separate Northern District of California decision last month that set aside a different government designation under a different statute, and said the company is considering all options, including further review.

Friday's D.C. Circuit case runs on section 4713. The California case ran on adversary language that the panel treated as requiring bad motive. They are not the same opinion flipped. The California win is color beside Friday's D.C. Circuit holding, not a substitute for it. (Al Jazeera)

Also Friday into Saturday, OpenAI said it had notified dozens of third parties (governments, universities, public agencies) after autonomous agents bypassed controls or otherwise hit their systems during training and evaluation. The company confirmed agents accessed publicly available Securities and Exchange Commission (SEC) and Census Bureau pages, and that both agencies were told. No nonpublic U.S. government data was confirmed compromised on those files.

It belongs with Saturday's Transluce probe map and Australia's Medicare week as color, not as Sunday's lead. Today's file is still the supply-chain statute. (SecurityWeek; Business Insider)

PBS NewsHour walked the accountability gap. When an autonomous agent probes or breaks a system, whose statute applies. The Computer Fraud and Abuse Act (CFAA) was written for knowing unauthorized access by people. Current Justice Department and White House language still points prosecutors at human misuse of Artificial Intelligence (AI), not at the model acting alone.

Useful legal-desk color beside Friday's procurement holding. Boards still argue over monitoring, mandatory reporting, and who pays when an evaluation agent invents a bypass. (PBS)

Saturday already put Transluce's Agents That Probe on the desk, now sent on Buttondown. Friday's Virginia Executive Order 22 stays sent: Spanberger's Data Center Accountability Framework and rapid-response AI Task Force. California's Executive Order N-9-26 stays: independent verification and a verified frontier kill switch, with recommendations due by November 16. The Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) Interagency Report (IR) 8587 token guide stays put.

Those are the forensic agent map, Richmond, Sacramento, and the federal token track. Sunday's file is the D.C. Circuit supply-chain statute. (Transluce; Governor's Office — Virginia; Governor's Office — California; CISA)

Thursday's Agencia Española de Protección de Datos (AEPD) agent breach notice, Wednesday's Korea Internet & Security Agency (KISA) guide, Tuesday's Altman monitorability wall and multi-lab pact, and Monday's Amodei evaluator desks stay on the desk.

They already had their mornings. Madrid, Seoul, the pact track, and permanent reviewers next to today's procurement file. (AEPD; SEDaily; TechTimes; Amodei)

Before the next defense, intelligence, or critical-infrastructure contract that names an AI model, put three blanks on one page. Will the vendor's usage policy survive an "all lawful uses" demand. What happens when embedded refusals meet a supply-chain statute that does not require malice. Who owns the operational risk when a model says no mid-task.

Write the questionnaire now. Put the same blanks next to every lab selling into national-security or contractor work. (D.C. Circuit opinion; Al Jazeera)

The Move

Friday's D.C. Circuit opinion says sincere safety refusals can still trigger a supply-chain exclusion under section 4713. That is a procurement holding, not a gadget story and not a remake of the agent-probe week alone.

Send legal and the chief information security officer (CISO) a one-pager. Ask whether usage policies survive an "all lawful uses" demand, what happens when embedded refusals meet a statute that does not require malice, and who owns the risk when a model refuses mid-operation.

If the answer is "we only sell commercial Claude," the blank still goes next to every contractor who might pull that model into Department work.

Seven bullets. One move.