FASCSSA never mentions AI. It never mentions smart contracts either. That omission is exactly why the D.C. Circuit's ruling on Anthropic is the most under-read document in crypto right now.
Two days before the deadline on Anthropic's “provable inference” milestone, a three-judge panel upheld the Pentagon's designation of the company as a supply chain risk under 41 U.S.C. §4713. Not for a backdoor. Not for a foreign parent. For a contract clause — the sentence stating Claude will not be used for lethal autonomous warfare or mass domestic surveillance.
Read the majority opinion and the mechanism is unsubtle: risk arising from “the manner in which a product operates” sits inside the statute. That phrase does not separate a poisoned firmware blob from a refusal. It does not distinguish a backdoor from a guardrail. A guardrail is now a product defect — at least when the buyer is the Department of Defense and the stated requirement is “all lawful purposes.”
FASCSSA was drafted for hardware. Counterfeit silicon, compromised routers, subverted vendors. The threat model was an adversary inside the box; the remedy was exclusion from the procurement chain.
Crypto has lived under the adjacent logic since August 2022, when OFAC sanctioned Tornado Cash's contracts rather than any identifiable operator. Identical structural move — the behavior of a system became the offense, and the system became a party. What separates the two cases is that this industry already built its compliance layer around that premise. Account abstraction didn't emerge from a philosophy seminar. It emerged because spending limits and session-scoped permissions were the only way to let automated agents touch funds without handing over root keys.
I've spent enough time inside that stack to read it correctly. After running a mempool-arbitrage script between Uniswap V1 and EtherDelta in 2017, then deploying a liquidation bot that caught a health-factor miscalculation on Compound during a flash-loan cascade in 2020, I stopped treating a guardrail as a virtue and started treating it as a written record. Every allowlist, every spend cap, every revoke function is a documented constraint on an automated system, signed and timestamped.
That's the context the AI-policy commentariat is missing. Anthropic has a favorable parallel ruling in the Northern District of California, a circuit split to litigate, and a nine-figure legal budget. An on-chain agent framework has a multisig, a timelock, and a Discord. Same legal theory, two addresses. Only one of them can afford to answer the door.
Strip the commentary and the panel did three things worth diagramming.
First, it collapsed intent into effect. A safety decision made transparently, for ethical reasons, by a public benefit corporation, still landed as a supply chain attribute. Motive stopped being a defense.
Second, it handed the Secretary a de facto override. Where internal safety policy obstructs military need, procurement authority can route around it. Ethics charters, safety committees, board resolutions — none constitute a legal answer.
Third, and least discussed, it removed the procedural buffer. Judge Henderson's dissent wanted a “material risk” finding before any supply chain action. The majority deleted that step. The absence of a threshold is itself the deterrent — a lab now self-censors before government contact occurs, because contact is the risk.
Now translate. Every mechanism above has a direct on-chain analogue, and I don't mean metaphorically.
An AI agent holding a session key is a guardrail. The key scopes which contracts it can call; the cap bounds its exposure; the allowlist decides which counterparties exist. These aren't features bolted onto a model — they are the model's operational envelope, expressed in bytecode. Under the D.C. Circuit's reading, an envelope that prevents a capability is indistinguishable from an envelope that fails to provide one.
Crypto already writes that envelope down in a form that should terrify any procurement auditor. Formal verification is native practice here: Certora specs, K-framework semantics, invariant suites committed to public repositories. This industry spent a decade treating machine-checkable proofs as a marketing asset. They are now a written confession, authored in advance, specifying exactly which behaviors a system is designed to refuse.
Second-order effect: open weights are the only supply chain hedge that survives contract renegotiation. You cannot amend a license into a frontier model's weights. You cannot revoke a capability a self-hosted deployment already contains. Models excluded from defense procurement carry no “refusal to serve” liability, because there is no counterparty to refuse. If this logic holds, self-hosted inference stops being an ideological preference and becomes a procurement strategy.
Then there's the self-regulatory body problem. SAFA — the standards consortium founded by Anthropic, Google, and OpenAI — is now wedged. Antitrust action has already reframed its standard-setting as coordinated output restriction, and the D.C. Circuit's framework supplies a second, independent basis for that reading. Crypto knows this shape exactly. Every exchange self-regulatory organization, every validator cartel, every MEV ethics committee has been pulled apart on the same two hooks: coordination, and admission. A published safety standard is a document saying, in advance, what you won't do. It is simultaneously evidence of collusion and evidence of a defect.
The insurance channel is the quiet one. AI liability underwriters need a definition of breach, and “refused a permitted use” is now a candidate. That reprices every on-chain agent operator, because agent frameworks are precisely where a refusal has a dollar figure attached — a liquidator that won't execute, a rebalancer that won't rebalance, a router that won't route. The cost lands on whoever runs the agent, never on whoever wrote the model.
The consensus read forming in group chats is that this is an Anthropic problem. It isn't.
Guardrails were crypto's compliance moat. For five years, the pitch for permissioned DeFi, KYC'd pools, and “institutional-grade” agent infrastructure rested on the same claim Anthropic made: our constraints make us safer to do business with. The D.C. Circuit inverted the sign. Constraints became the risk factor, and the risk factor is what diligence teams flag.
So the rational response is not to strengthen guardrails. It's to remove them — or at minimum, stop documenting them. Watch three things next quarter: session-key policies that get quieter, formal verification suites that migrate from public repos to private ones, and agent frameworks that ship permissionless by default, because a permissive default contains no written admission.
The equilibrium this ruling selects for is anti-safety. Not maliciously — structurally. Every actor optimizing against a rule that punishes documented restraint drifts toward systems that document nothing. The collective panic will arrive late, and it will arrive at the layer with the least legal recourse.
Watch the docket, not the press. An en banc petition, and the scope of the California ruling, will reveal whether this is one agency's discretion or a doctrine. Then watch what quietly disappears from public repositories in the meantime.
The real question isn't whether a model can be trusted to refuse. It's who gets to decide that refusal is a feature — and whether, by the time they decide, anyone is still writing it down.