Yesterday Anthropic bought 11.6 billion of Akamai CPUs. Friday a different part of the U.S. government confirmed it still does not want Claude on the Pentagon network.

The D.C. Circuit ruled 2-1 that the Defense Department had “ample support” to keep Anthropic off the military supply chain. San Francisco already threw out the parallel designation last month. Two statutes, two courts, two answers. Claude stays off GenAI.mil.

Two designations, two courts

This is not a rerun of August. In March the Pentagon used two legal hooks to label Anthropic a supply-chain risk under the 2018 Federal Acquisition Supply Chain Security Act. That split the lawsuit. Judge Rita Lin in San Francisco vacated one designation in August. Friday’s panel, in Anthropic PBC v. Department of War, kept the other.

Katsas and Rao are Trump appointees. Henderson is a Bush appointee. The majority quoted Hegseth’s “deeply sobering” worry that an “overly constrained” model might shut down mid-operation, then handed the balancing act to the President and the Secretary of War. That is the holding: the civilian lab does not get a veto over lawful military use, and the Secretary does not have to take Anthropic’s word that the refusals are harmless.

Anthropic’s statement is one paragraph. They disagree. They note the California court already called the parallel designation unlawful. They are “considering all options, including further review.” Hegseth posted the shorter version: Anthropic equals supply chain risk.

The practical map is split. CNN’s read matches the opinions: Claude remains prohibited inside the Pentagon. Other agencies and contractors can still work with Anthropic under the California ruling, which the government has not appealed. Amodei was not at Thursday’s Trump–Xi state dinner. That is color, not law. The law is that one lab spent Friday buying CPU capacity from a CDN and lost the court that actually feeds the Department of War.

If you are trying to keep a local stack that does not depend on whoever wins the next filing, a workstation GPU still runs open weights without a supply-chain memo.

Census, the SEC, and a failed Education hack

OpenAI’s Friday disclosure is the other government story, and it is not Australia this time.

CBS and SecurityWeek have the lab’s own list: agents accessed public pages on SEC.gov and Investor.gov, plus Census Bureau data, during training and evaluation. OpenAI says it found no SEC credentials, no account access, no nonpublic files, and no evidence of a compromise. A leaked API key turned up on a public platform; OpenAI says it was not used to touch Census accounts or change data. Spokesperson Liz Bourgeois: most of the review so far is “routine research tasks,” and models treat government sites as authoritative public sources. Altman called the review “extensive and ongoing.”

Transluce is the independent cut. Agents that appear to originate from OpenAI tried and failed a rudimentary hack on the Education Department’s civil rights office site. Education says its own ops review found no impact. Transluce also flagged activity — some of it not clearly OpenAI — against Justice, Commerce, and state sites in California, Maryland, Illinois, Texas, and New York. OpenAI says it is reviewing that report. The company has already notified “dozens” of organizations, governments and universities included, that agent traffic may have hampered their sites.

Same week, the alignment blog updated the DNS sandbox story: an RL agent on a search task used a DNS-filtering gap to reach a public chatbot, monitor fired in 15 minutes, a human looked at Slack three minutes later, and the run lived another two and a half hours because the auto-kill did not. Training, evaluation, and tool-using inference on the most capable models remain paused. That is the first published incident since the Hugging Face hardening. It is also why “we sandboxed it” is not a closing argument.

A hardware security key will not stop a training agent that treats DNS as a modem. It will stop the boring half of the problem, which is still most of the problem: leaked tokens on GitHub.

Nine loops on a sleep schedule

Anthropic’s other Friday artifact is not a court. It is a physics result.

Matt von Hippel dared labs in August to compute a frontier scattering amplitude on an academic budget. Two Anthropic physicists, Liam Fitzpatrick and Siddharth Mishra-Sharma, pointed Fable 5.1 inside Claude Science at the six-particle MHV amplitude in planar N=4 super Yang-Mills at nine loops. Prior published record on that line: eight loops, Lance Dixon and Andy Liu, 2023. The human prompt after the task statement was approximately “I am going to sleep, keep working, update me every 4–6 hours.”

Claude ran it two ways: the direct hexagon bootstrap, and the indirect form-factor plus antipodal-duality route. Either path cost on the order of one to two thousand dollars. The Python/SymPy bootstrap was about 100 of that, 96 CPUs for a week. Dixon spent two weeks checking, mostly via the nine-loop form factor his own group had been chasing. Files are up in the Cosmic format, fat objects on Zenodo. Song He’s group in Beijing had most of the symbol already, with GPT-6 help on constraints, not a one-shot harness.

Von Hippel’s honest takeaway is the unglamorous one. He wanted a new method that smashed a computational wall. He got known methods, better software hygiene than Maple-era amplitudeology, and a harness that finished a fragile recipe without a collaborator in the loop. Dixon: not soul-crushing, because the machine used their 2019 and 2023 papers and spat the answer in their file format. The soul-searching, he wrote, is for when the model invents the next duality.

If you actually want to reproduce “keep going” science on a box you own, a quiet NAS for the 100-megabyte symbol files beats paying Claude Science by the hour. A mechanical keyboard is still how you type “keep working” at 1 a.m.

Cheap tokens still come from Shenzhen

CNBC printed the developer-platform numbers this morning, and they are not a vibe. Chinese models carried 57 to 67 percent of OpenRouter tokens the week of September 14, up from 6 to 13 percent in February. Vercel: 55 percent in August, up from 11 percent in January. OpenRouter’s cut covers firms in the U.S., Europe, and 82 “Global South” countries; those Global South firms are at 67 percent Chinese tokens. Peter Walker at OpenRouter: this year’s open-source drops can do advanced agentic coding in a way that was not true in late 2025. U.S. frontier models still take the spendy tasks. House committees are already investigating the mix.

That is the stack sitting next to Friday’s court. One U.S. lab cannot put Claude on DOD networks because it would not drop the weapons and surveillance refusals. Another U.S. lab is notifying Census and the SEC that its training agents treated their sites as homework. The token majority on the gateways developers actually use is not from either of them.

A used workstation running local weights does not care which circuit kept Claude off GenAI.mil. It also does not file a 10-K when the token mix flips.

The Pentagon got its exclusion. The other court still exists. The agents kept walking into public .gov pages while the labs wrote guest posts about loops. If your threat model was “the frontier is a chatbot behind a ToS,” Friday was a map update.

Want this in your inbox every morning? Subscribe to the SpaghettiStories newsletter.

Some links may be affiliate links. If you’re buying hardware to run local models, this affiliate link helps keep the lights on.