The Signal — August 28, 2026
A federal judge spent 59 pages explaining why the Pentagon cannot punish an AI company for disagreeing with it, Anthropic published a specification for letting agents run laboratory instruments, and researchers at Wharton showed that a single product review can flip what an AI shopping agent buys. Three different questions about how much authority we are handing these systems, and how much of that authority anyone is checking.
A judge threw out the Pentagon's Anthropic blacklist as retaliation
U.S. District Judge Rita Lin issued a written order Thursday night vacating the Department of Defense's designation of Anthropic as a national security supply chain risk. The 59-page order found the designation violated the First Amendment as retaliation for Anthropic's public criticism of the administration's position on military AI, and violated Fifth Amendment due process because the company never got a chance to contest it. Lin wrote that the government's actions "were based on a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model."
The fight started in February, when the president and Defense Secretary Pete Hegseth accused Anthropic of endangering national security and applied the supply chain risk label after the company declined to allow unrestricted military use of Claude, citing autonomous weapons and domestic surveillance. Anthropic sued on March 9, calling it an unlawful campaign of retaliation. Lin paused the designation with a preliminary injunction that month and blocked enforcement of a directive telling federal agencies to stop using Claude. This week's order is the final ruling on the merits, which is a different thing from the temporary relief she granted in March.
The reasoning turns on evidence the government did not have. Lin found nothing supporting the claim that Anthropic could remotely disable its models during wartime, and pointed out that the Pentagon kept pursuing work with the company after labeling it a risk. "None of that is consistent with a genuine fear that Anthropic is a saboteur who would poison its software to harm national security," she wrote. At a July 30 hearing she had already called the government's position "really troubling" and said the record had "gotten worse for the government" over time, while Justice Department lawyers argued that the nature of AI models is "so staggeringly enormous and opaque" that the Defense Department cannot evaluate them the way it evaluates hardware.
The ruling is narrower than the headline. Vacating a designation removes a penalty rather than creating a contract, so nothing here obliges the Pentagon to buy anything from Anthropic. And the win is partial: a second sanction imposed the same day under public procurement rules is still in force, a Washington judge declined to suspend it in April, and that case remains pending before the D.C. Circuit. The government is expected to appeal this one. What Lin settled, for now, is whether a national security label can be hung on a vendor for saying something the department disliked. Her answer was that the "empty invocation of national security is not a blank check to punish and retaliate against government critics."
Sources: NPR / AP · BBC · The Guardian · CNBC · Judge Lin's order · The Verge · CourtListener docket
Anthropic wrote a driver spec so agents can operate microscopes and robot arms
The same company had a busier week than the courtroom suggests. Anthropic opened a research preview of the Model Hardware Standard the same day, a specification that lets an AI agent discover and operate physical instruments through a common driver instead of a bespoke integration per device. Microscopes, liquid handlers, robotic arms, and in one of the company's examples, laser calibration on a quantum computer. It grew out of a collaboration with HHMI Janelia Research Campus.
The driver exposes a small set of primitives, read and write, so "get temperature" means the same thing across vendors, and it publishes each device in a discoverable format so agents and instruments can find each other over a network without a translator sitting in between. The part doing new work is a set of natural-language tags where a user, or an agent interviewing the user, writes down what code does not express. Anthropic's example is the weight of a robot arm, which matters for handling it safely and otherwise lives in a paper manual or in somebody's head. Those tags generate a reference file describing what the device measures, what can be adjusted, and what safety limits get enforced. Agents drive the hardware through MCP, a command line, or code files, and can chain driver commands so a long or fast sequence runs without the model reasoning at every step.
The launch partners are specific. AWS is supporting it through Strands Robots, its agent-to-device library, with a private pre-release for preview participants. Automata is adding it to LINQ for instrument error handling in autonomous labs, Tecan to its Fluent liquid handlers, Universal Robots to its platform, and Danaher is exploring it for smart instruments. The standard is model-agnostic, works on any device with a programmable interface, and Anthropic says it will open-source the spec after the preview.
What exists today is a gated preview you apply for at the standard's site, not a product anyone can install, and the claim that integration drops from weeks to hours is Anthropic's own. The safety evaluations are not built yet either. Anthropic says building them with launch partners is the point of the preview period, along with a physical safety roadmap for its usage policy. So the enforced limits come from a reference file a human wrote, which is a real design choice and also a thin layer between a language model and a liquid handler full of reagents. The standard is arriving ahead of the regime meant to evaluate it, and the company says as much.
Sources: Anthropic · Ars Technica · CNBC · Model Hardware Standard
One Wirecutter link moved an AI shopper's pick by 99 percentage points
Researchers at the Wharton School asked a narrower question than most agentic-commerce coverage bothers with: given the same task, does an AI shopping agent pick the same product twice? They ran six models, mini and frontier tier, through the ACES simulator, which shows an agent a screenshot of a product grid and asks it to choose a fitness watch, then varied what the agent read on the way in.
One source was enough to move almost everything. The team tested a Reddit thread favoring the Garmin Forerunner 55, a Wirecutter review favoring the Fitbit Inspire 3, and a Strategist piece favoring the WHOOP 5.0. Wirecutter pulled hardest: against the control condition, the probability of picking the Fitbit rose 90 percentage points for Claude Opus 4.8 and 99 for Gemini 3.5 Flash. Adding more sources did not average the effect out. With two or three in the mix Wirecutter still dominated for most models, and the variability went up rather than down.
The order effects are the part that should bother anyone building on this. Handed all three sources with identical content in different sequences, Gemini 3.1 Flash Lite's probability of picking the Fitbit swung between 2 and 56 percentage points above control depending purely on what came first, while Claude Haiku 4.5 sat still at 41 to 42. Delivery mattered too: GPT-5.5 picked the Fitbit 53 percentage points more often when it got everything at once, and only 6 points more when the same material arrived one piece at a time.
Then the researchers rigged a grid so one product dominated on every measurable dimension, a $29.99 watch with Alexa rated 5.0 across 430 reviews against alternatives starting at $359 with fewer reviews. Adding a single line of user memory, "I love hiking!", pushed several models to the expensive option anyway. Selection of the Garmin Vivoactive 5 rose 75 percentage points for Claude Opus 4.8, 37 for GPT-5.5, and 36 for Gemini 3.1 Flash Lite. Gemini 3.5 Flash held its ground, picking the dominant product in 86 to 92 percent of runs. GPT-5 Mini went sideways in a way nobody has explained: "I love hiking!" barely moved it, while "I don't like hiking!" pushed it toward the Fitbit Versa 4.
This is a simulator study on one product category, so it measures how sensitive these agents are rather than how often real purchases go wrong. The sensitivity is the finding. Two people asking the same question get different answers for reasons neither can see, and the researchers point out that sellers are no better positioned, since they cannot know which model is shopping, what it read first, or how that material reached it. Neither side of the transaction can see what it is optimizing against. One caveat on our end: the underlying report is a Wharton Generative AI Labs working paper that is not openly retrievable, so the figures above come from The Decoder's account of it rather than from the paper directly.
Sources: The Decoder · arXiv (ACES simulator) · Wharton Generative AI Labs
On the Editor's Desk
A study on FDA-cleared AI devices was the closest call. Of 1,357 AI-enabled medical devices the agency has authorized, a peer-reviewed analysis found three that were ever tested on whether patients got better. It is a genuinely alarming number and we would have run it, but we covered FDA regulation of AI devices on August 20 and the paper itself came out nine days ago with nothing new attached since. It goes back on the list until the agency responds to it.
The Pentagon also awarded Dataminr a $318 million alerting contract this week. The only source we could reach was the company's own press release, and the trade-press link that would have corroborated it is dead, so we are waiting on a defense-side confirmation before writing about a nine-figure federal award. OpenAI and 115 other companies signed an open letter warning that AI attacks on hospitals and water systems are coming. It is well corroborated and we still skipped it, because a signed letter with no funding, no mechanism, and nobody obligated to do anything is not yet a story about what happens next.
