Hacker News Reader

Comment by joshuamorton | Hacker News Reader

So Claude is a supply chain risk in the same way that an employee is a supply chain risk.

I'm struggling here because you're basing this determination entirely on things which the government never acused anthropic of, and haven't asked anthropic to address, and which the underlying law probably doesn't support.

The government made clear that it was only designating anthropic a supply chain risk due to their refusal to allow Claude to be used lawfully for autonomous kill chains and domestic surveillance. Why are you bringing up this other stuff when the government never did?

View on HN

Please read the entire opinion first as it explains exactly what the government thinks. The majority of the court says the Department reasonably worried that Claude-supported “critical defense system[s]” might “fail[] to engage” as expected. Those are concerns about how a supplier-controlled model performs inside a system, not merely politicking. See the opinion, especially pp. 12 and 19–21: https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-104.... My point about Fable or adding a backdoor is not that they do that, it's that they have a documented history of trying to change model behavior in unspecified ways just because they don't like a certain group of people and it is not worth the risk for the government to have something like that sprung upon them, at any point, at all. A private company cannot ever have the ability to dictate to the government what it can and cannot do, and if that company doesn't want to comply, the government is reasonable in excising them from their systems, which is what this supply chain risk designation is.

If an employee might be a supply chain risk in this analogy then they conduct background checks before they let them do anything and conduct periodic investigations. Otherwise, they don’t get access to the code base or information

Right, and for the same purposes, the government has not made any claim that Claude poses risks. (And to the extent that they exist, pre-existing concepts like code review and testing mitigate them)

Again I'll reiterate: the only concern the government has stated is that of Claude refusing to answer things during an active battle.

I respect that decision, I think if the government wants to use OpenAI for that situation it makes sense. They can and should pick suppliers who meet their needs.

Nothing about what the government has said suggests any reason that Claude Code is a risk. So why are you insisting that it is and that the government is justified in banning it?

> Nothing about what the government has said suggests any reason that Claude Code is a risk. So why are you insisting that it is and that the government is justified in banning it?

I think there is an important distinction here because even the Government’s own lawyer conceded that a contractor using Claude code is not necessarily a risk.

The nuance is relying on Claude code as part of a DoW delivered or production system. This case puts Anthropic directly into the supply chain. Thus, if Claude is actually part of a DoW-procured capability, Anthropic still controls the model. DoW’s argument is that Anthropic could put something in there to perturb or retard the capability that DoW is after. DC Circuit said the department viewed that as a national-security problem because Anthropic had refused to accept a contract term the department considered necessary.

THEN, because the statute covers IT technology that can be manipulated to not fulfill the mission that the DoW wants/needs it is then by statute a supply chain risk.

Reply on news.ycombinator.com