The Pentagon Removal Deadline Lands This Month
Lost under the threat report coverage: the Defense Department’s designation of Anthropic as a supply chain risk remains in effect, and removal of Anthropic products from all Defense Department systems is due to complete by the end of September 2026. Contractors are still expected to comply. That deadline is two weeks out and it has had almost no attention.
It is proceeding despite two things pointing the other way. A US federal judge ruled the Pentagon illegally blacklisted Anthropic, partly on the basis of capabilities Claude did not actually have. And Commerce Secretary Howard Lutnick publicly described Anthropic’s long-running issues with the administration as resolved — a senior Pentagon official immediately disagreed. Lutnick was mostly describing Commerce, where June export controls on Fable 5 and Mythos 5, imposed over concerns that safeguards could be bypassed to expose advanced cyber capability, were later lifted after Anthropic worked with the government on additional safeguards. Two agencies, two directions.
The origin is not technical and it is worth stating plainly, because it explains the rest of Anthropic’s year. It began as a $200 million contract disagreement over how the Pentagon could deploy Claude on classified systems. Anthropic wanted contractual limits barring use of its models in autonomous lethal weapons systems or domestic mass surveillance. The Pentagon rejected those limits. Anthropic kept the clause, lost the contract, got designated a supply chain risk, won in federal court, and is being removed from the building anyway.
ENISA Finally Gets Mythos. Not the Current One.
Anthropic has given the EU’s cybersecurity agency ENISA access to Mythos 5, and the timeline is the story. Anthropic previewed Mythos in April. After lobbying from the bloc, it proposed ENISA access in late May. That proposal opened months of wrangling over the type and scope of access, complicated further by the White House restricting foreign access to Mythos and Fable. ENISA is testing it now — more than three months after the offer.
And it is not getting the current model. ENISA has Mythos 5; it does not have Mythos 5.1, which shipped September 1. For a cybersecurity agency whose entire use case is finding vulnerabilities before attackers do, being a version behind is not a rounding error. Mythos is gated precisely because it is good enough at uncovering security flaws that Anthropic restricts it to vetted institutions under Project Glasswing. The whole premise is that capability this sharp goes to defenders first. A three-month negotiation and a version gap is a real dent in that premise.
The uncomfortable read is that nobody in this story is clearly wrong. Anthropic has a legitimate reason to gate a model that finds zero-days. The White House has a legitimate interest in foreign access to frontier cyber capability. ENISA has a legitimate claim that defending European infrastructure requires the current tool. Those three positions do not reconcile, and what falls out of the gap is a three-month delay and a downgraded version — not because anyone decided that was the right outcome, but because it is what the process produced.
Anthropic Walks Away From Decart, and From Its Own Biggest Deal
Anthropic has decided against acquiring Israeli AI startup Decart in a transaction reported at roughly $6 billion — which would have been, by a wide margin, its largest acquisition ever. The two sides were in discussions as recently as August 2026, Anthropic performed due diligence, and then walked. Both companies may still pursue other forms of collaboration.
What Decart does is the part that makes this interesting. Its technology centers on reducing the cost of training and running AI systems by improving the efficiency of the chips powering them. That is not a feature acquisition or a talent grab. That is a direct attack on the single largest line item in Anthropic’s cost structure, in a year when the company is contracting compute at gigawatt scale and preparing to show investors a margin story.
Walking away after due diligence usually means one of three things: the technology did not hold up under inspection, the price could not be justified against building internally, or the integration risk was unacceptable this close to a listing. Nobody has said which, and the reporting does not resolve it. Worth filing away, though, because the compute-cost problem it was aimed at does not go away just because the deal did.
2.1.270 Is One Line, and It Is Probably the Line You Hit
After a release carrying 98 CLI changes, Claude Code 2.1.270 shipped September 12 with exactly one bullet in the changelog: “Fixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while (regression in 2.1.269).” That is the entire release.
Small, but if you were on 2.1.269 you probably met it. The symptom is the annoying kind — everything works for an hour, then git status and git diff start prompting for approval in a session that had been running clean. Easy to misdiagnose as a settings problem or a stale permission cache, because it only shows up in long-running sessions, which is exactly when you are least inclined to restart and investigate. Upgrade and it goes away.
One housekeeping note if you track releases yourself. The GitHub releases page lags the real version stream badly — Anthropic does not cut a GitHub release for every npm version, and that page has been sitting on v2.1.266 while 2.1.270 is live. Several third-party trackers are still reporting 2.1.269 as current for the same reason. Use the docs changelog as your freshness signal.
A Quiet Weekend Is a Good Time to Check What You Are Actually Running
Nothing shipped on the Claude Developer Platform or the Claude apps release notes on September 11, 12 or 13. The newest entries on both remain September 10. After a fortnight that delivered plugin evals, smart reports, Managed Agents permission policies and a pile of credential-leak fixes, the pipeline took the weekend off.
Which makes this a decent moment for the maintenance nobody schedules. If you have been putting off the 2.1.268 credential-exposure fixes, that is a security upgrade, not a convenience one — plugin and marketplace errors were printing tokens from git source URLs, and MCP commands were printing secrets resolved from ${VAR} placeholders. If you run managed configuration, the deprecated field spellings stop being accepted on October 7, 2026 at 12:00 PM Pacific; the in-app warnings have been running since September 10 and that date is now three weeks out.
And if you maintain plugins, the eval harness that landed in 2.1.269 is free to run against four of its six grader types. A quiet Sunday is exactly when you find out whether your skill triggers on natural phrasing, which is the failure Anthropic says authors hit first.
$15 Billion in Revolving Credit, and the Lenders Are the Underwriters
Anthropic is finalizing an expansion of its revolving credit facility to $15 billion, clearing one of the last structural hurdles before a public filing. For scale: the facility it secured last year was $2.5 billion over five years. This is six times that — and it came in above an earlier target of roughly $10 billion. The line got bigger during the process, not smaller.
Morgan Stanley is leading, with Goldman Sachs, JPMorgan Chase and Citigroup in prominent roles, and reporting has individual banks committing $1 billion or more each. Those same four lenders are leading the IPO. That is not a conflict, it is the standard sequence: companies finalize the revolver before handing out formal listing roles, and committing balance sheet to the credit line is how banks buy their seat at the underwriting table.
The distinction worth holding onto is that a revolver is not a fundraise. It is the ability to draw working capital against compute commitments without issuing equity — which matters a great deal for a company that wants to keep spending at gigawatt scale while showing a clean cap table to public investors. Read next to the Decart walk-away, it sketches a consistent posture: preserve flexibility, avoid a large dilutive acquisition, secure cheap access to cash, and get to the listing clean.
Every Story This Week Was the Same Story: Who Gets Access
Line them up. The Pentagon is removing Claude from every Defense Department system this month because Anthropic would not drop a clause about autonomous weapons. ENISA waited three months for Mythos and got the previous version, because Anthropic gates it and Washington restricts it. The threat report documented actors in Yemen, Russia and China getting access Anthropic never intended to grant. And Chinese labs allegedly took access by fraud, at a scale of millions of exchanges. Four stories, one question: who is allowed to use this, and who decides.
What makes it interesting is that Anthropic is losing on both ends simultaneously, in opposite directions. It is too restrictive for the Pentagon, which walked rather than accept limits on lethal autonomy. It is too restrictive for Brussels, which spent a summer negotiating for a model it still cannot fully use. And it is not restrictive enough to stop a cell in northern Yemen from decomposing missile guidance work across parallel sessions, or to stop 5,380 fraudulent accounts from routing through Singapore and Japan. The same policy is generating complaints for being both too tight and too loose, which usually means the policy is not the variable.
The thing that actually does not scale here is case-by-case judgment. Every access decision Anthropic made this year was bespoke: negotiate with ENISA, litigate with the Pentagon, investigate the account clusters, vet the Glasswing institutions. That works at the scale of a few dozen counterparties. It does not work at the scale of an API, which is why the enforcement wins are all retrospective — Anthropic caught the distillation after 190 million exchanges, and caught the weapons work after the rocket was on the pad. Detection is genuinely good. Prevention is a different problem and nobody has solved it.
Which is the honest frame for the financing news sitting alongside all this. The $15 billion revolver and the Decart walk-away are the moves of a company optimizing for a clean listing: preserve flexibility, avoid dilution, do not take on integration risk. Reasonable. But the access question does not get easier after an IPO — it gets harder, because a public company has a new constituency asking why it turned down $200 million on principle. Anthropic has spent this year paying real money to hold a line. The interesting test is not whether it holds the line now. It is whether it still holds it when the line has a ticker symbol attached and someone has to explain the decision on an earnings call.