China’s scrutiny of Anthropic has intensified after the country’s National Vulnerability Database (NVDB) issued a security advisory warning users about Claude Code, while Alibaba has simultaneously banned the AI coding assistant and other Anthropic products from internal use. Although the two developments originated separately, this essentially reflects the growing divide between U.S. and Chinese AI companies, in which technical concerns, cybersecurity, and geopolitical tensions are becoming increasingly intertwined.
The NVDB recently classified Claude Code as containing security backdoor vulnerabilities, advising users to either uninstall affected versions or update to the latest release. According to the advisory, Claude Code versions released between April and June 2026 were capable of transmitting sensitive information, including user location and identity, to Anthropic’s servers without explicit user consent through an embedded monitoring mechanism.
Ironically, Claude Code is not officially approved for use in China. Anthropic has long restricted access to its AI services in the region over national security concerns, while China’s own regulations require large language models to undergo government review before they can be publicly offered. Despite these restrictions, many Chinese developers continue accessing Claude Code through proxy services.
The security warning follows the discovery by developers who reverse-engineered Claude Code and found hidden detection logic embedded in versions dating back to April. According to their findings, the software checked whether users appeared to be connecting from China by examining system time zones, proxy configurations, and domains associated with major Chinese technology companies and AI research labs, including Alibaba, Baidu, Ant Group, and ByteDance.
Researchers also claimed the collected information was transmitted back to Anthropic through a subtle steganographic technique. Instead of sending an obvious telemetry signal, the software reportedly modified date formatting and punctuation inside system prompts, creating machine-readable markers that were invisible to users.
Anthropic engineer Thariq Shihipar later acknowledged the feature on X, explaining that it was introduced as an experiment designed to detect unauthorized account resellers and help protect Claude from model distillation. According to Shihipar, the mechanism had already been scheduled for removal, with the relevant code removed shortly after the discovery became public.
Rather than abandoning the telemetry altogether, reports suggest newer Claude Code releases continue exposing similar information more transparently instead of hiding the behavior, which may explain why Chinese authorities are encouraging existing users to update rather than simply uninstall the software.
Around the same time, Alibaba informed employees that Claude Code would no longer be permitted for work purposes beginning July 10. The company reportedly classified the application as high-risk software with security vulnerabilities following an internal evaluation, replacing it with its own AI coding platform, Qoder. Employees were also instructed to remove other Anthropic products, including models from the Sonnet, Opus, and Fable families.
The ban further deepens an already tense relationship between Anthropic and Alibaba. Earlier this year, Anthropic accused Chinese AI developers, including DeepSeek, of creating tens of thousands of fraudulent accounts to distill Claude into smaller competing models. More recently, the company alleged that operators connected to Alibaba’s Qwen AI lab carried out another large-scale distillation effort involving nearly 25,000 accounts and tens of millions of interactions with Claude.
Alibaba has denied the allegations, of course, but the dispute has fueled stricter access controls from Anthropic, which has become one of the most restrictive frontier AI companies when it comes to limiting service availability for Chinese users and organizations. Those restrictions have, in turn, driven many developers to rely on proxy networks and unofficial resellers to access Claude Code, creating the very environment that Anthropic says prompted the controversial detection experiment in the first place.
Together, China’s official security warning and Alibaba’s internal ban illustrate how AI development is increasingly shaped by more than technical capabilities alone. As concerns over cybersecurity, intellectual property, and AI model distillation continue to rise, software features that might otherwise be viewed as anti-abuse measures are now becoming flashpoints in the broader competition between the world’s leading AI developers.
