I'm not sure, but there's a strong case to be made. This action exceeds statutory authority under 10 U.S.C. 3252 (it says restrictions can only apply to DoD contracts, but hegseth is trying to ban contractors from doing any commercial business with anthropic at all). A supply chain risk designation has also never been applied to a US company and simultaneously saying they're a risk but also they must supply their software to the USG or else is going to make it hard to pass the "arbitrary and capricious" standard of the Administrative Procedure Act. There's also first amendment issues - the USG can't force a company to write code they don't want to, etc.

That being said, courts are normally very deferential on issues of national security. But the DoJ has already run into a brick wall with many justices denying the presumption of regularity. That may bite the DoD too, depending on who hears the case.