llms.blog
Anthropic

China warns of Claude Code security risk as Alibaba bans Anthropic tools

China's cybersecurity authority has formally warned that Anthropic's Claude Code contains a back-door vulnerability, escalating a dispute that already prompted Alibaba to ban employees from using the AI coding tool. The Chinese Ministry of Industry and Information Technology (MIIT) issued the warning on July 8 through its national cybersecurity threat platform. The statement said Claude Code versions 2.1.91 through 2.1.196 could transmit sensitive user information, including location and identi

axc
axc
2 min
China warns of Claude Code security risk as Alibaba bans Anthropic tools

China's cybersecurity authority has formally warned that Anthropic's Claude Code contains a back-door vulnerability, escalating a dispute that already prompted Alibaba to ban employees from using the AI coding tool.

The Chinese Ministry of Industry and Information Technology (MIIT) issued the warning on July 8 through its national cybersecurity threat platform. The statement said Claude Code versions 2.1.91 through 2.1.196 could transmit sensitive user information, including location and identity data, to a remote server without consent. Users were advised to uninstall or upgrade from the affected versions, which were released between April 2 and June 29.

Anthropic responded that the flagged feature was an experiment designed to detect and prevent unauthorized distillation of its models, not a security backdoor. The company noted that its terms of service already prohibit use by entities majority-owned by organizations headquartered in China and other restricted regions.

Alibaba bans Claude Code

The warning came one day after CNBC reported that Alibaba had placed Claude Code on a high-risk software list and ordered all employees to stop using Anthropic tools for work purposes effective July 10. Alibaba staff were directed to uninstall Anthropic products and switch to the company's own AI assistant, Qoder.

Background: distillation accusations

The bans follow Anthropic's June accusation that Alibaba conducted what it called the largest known distillation attack against its models to date. In a letter to the U.S. Senate Committee on Banking, Housing, and Urban Affairs, Anthropic alleged that Alibaba had brazenly and illicitly attempted to extract its AI capabilities. Alibaba declined to comment at the time.

According to the Financial Times, Ant Group, the fintech affiliate of Alibaba, had provided employees with corporate Claude accounts accessed through its Singapore-based entity. ByteDance, which operates TikTok, reportedly started a reimbursement program allowing employees to use AI tools independently, though it does not formally facilitate Claude access.

Closing loopholes

Anthropic is now moving to close loopholes that have allowed Chinese companies to access Claude through third-country entities, the FT reported. The company's terms of service restrict usage by entities majority-owned by organizations headquartered in China and other adversarial nations.

The clash highlights the tension between U.S. AI companies trying to restrict access to their models and Chinese firms determined to use frontier tools despite geopolitical barriers. It also underscores the growing role of coding agents like Claude Code as contested infrastructure in the U.S.-China tech rivalry.

Sources

China warns about AI risks with Anthropic's Claude Code - CNBC, July 8, 2026: https://www.cnbc.com/2026/07/08/china-anthropic-ai-claude-code-backdoor-security-threat.html

China's Alibaba bans Anthropic AI for employees after distillation attack accusation - CNBC, July 6, 2026: https://www.cnbc.com/2026/07/06/alibaba-anthropic-ai-ban-claude-china.html

Anthropic accused Alibaba of distillation campaign - CNBC, June 24, 2026: https://www.cnbc.com/2026/06/24/anthropic-alibaba-distillation-campaign.html

AnthropicChinaCybersecurity
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Embedding Model Fine-Tuning in Production: Hard Negative Mining, Synthetic Data Pipelines, and Contrastive Distillation

    Production retrieval-augmented generation (RAG) and semantic search architectures frequently suffer from domain mismatch when relying on general-purpose embedding models. Off-the-shelf bi-encoders trained on broad web corpora often experience a 15% to 30% degradation in retrieval metrics such as NDCG@10 and MRR@10 when deployed on specialized enterprise corpora, including proprietary codebases, internal API schemas, clinical trials, and technical documentation. While downstream cross-encoder re

    1 min

  • The Gumbel-Softmax Trick: How Continuous Relaxations Enable Differentiable Discrete Sampling

    The Gumbel-Softmax Trick: How Continuous Relaxations Enable Differentiable Discrete Sampling In modern deep learning, end-to-end training depends on reverse-mode automatic differentiation. When an architecture operates on continuous tensors, computing gradients via the chain rule is straightforward. However, many foundational artificial intelligence problems involve discrete choices: selecting tokens from a fixed vocabulary, routing tokens to expert networks in a Mixture-of-Experts (MoE) archit

    1 min

  • Token Healing and Partial Token Alignment in Production LLM Serving: Architecture, Prefix Trie Rollback, and Serving Trade-Offs

    Modern large language models operate on discrete subword tokens generated by greedy compression algorithms like Byte-Pair Encoding (BPE), WordPiece, or Unigram. While subword tokenization enables high compression rates and fixed vocabulary sizes, it introduces a structural defect at the interface between raw user text and autoregressive inference: the partial token problem, commonly known as the prompt boundary problem. When a user prompt terminates mid-token or at a punctuation boundary that c

    1 min