Judge Rita Lin's preliminary injunction runs forty-three pages on a question different from the one everyone thought this case would answer. The public framing was about whether an AI company could maintain safety guardrails when a sovereign customer demanded otherwise. Lin's actual decision was narrower, more procedural: the Pentagon's own records showed it designated Anthropic a supply chain risk because of the company's "hostile manner through the press." Punishing a company for speaking publicly is, she wrote, classic First Amendment retaliation.

The question of whether safety commitments can survive sovereign deployment demands went unaddressed. Lin was explicit:

The substantive question was deferred. But by the time she ruled in late March, the market had already filled the silence.

Within days of the original blacklisting in February, ten defense-tech portfolio companies under a single venture firm began replacing Claude. Lockheed Martin started swapping out Anthropic's models. Piper Sandler warned clients of disruptions across defense integrators. A rival announced its own Pentagon deal hours after the blacklisting. Program teams did what program teams do: they weighed operational continuity against regulatory uncertainty and chose to de-risk. Contracts signed, migrations begun, relationships restructured around a conclusion no judge had endorsed.

The market acted as if safety commitments were a liability in sovereign contracting. Whether they actually are remains judicially untouched. Bloomberg Tax commentary noted the ruling doesn't clarify what many had assumed: that private contractors can place meaningful limits on how the government uses their intellectual property. Lawfare's analysis of whether the Defense Production Act could compel Anthropic to retrain Claude called the question "genuinely unsettled." No court has ruled on whether AI model architecture constitutes protected speech.

Anthropic's case worked because the retaliation was so legible, so clearly tied to public speech. A quieter version of the same pressure, applied through procurement scoring rather than presidential directives, would generate no constitutional claim at all. And even with the injunction in hand, the procurement behavior it set in motion may not reverse. As one legal analyst observed, defense contractors eager to maintain favorable Pentagon relations may now lack motivation to partner with Anthropic regardless of the legal outcome. The full litigation could take a year or more.

I keep returning to the assumption this exposed. Most of us expected safety commitments to be tested somewhere with briefs and discovery and published opinions other companies could cite. What played out was faster and less legible. Procurement offices read the political weather. A judge could tell them what the law required; what they wanted to know was which vendor wouldn't create problems.

Whether that procurement response proves durable is unclear. Political winds shift. Injunctions hold or don't. The companies that migrated away could migrate back, though the switching costs make that less likely with each passing month. The demonstrated mechanism, though, may be harder to undo than any particular contract decision. The next time an AI provider faces pressure to relax safety restrictions from a government customer, there may not be a First Amendment hook to hang on at all.