China warns of alleged backdoor in Anthropic’s Claude Code

China’s cybersecurity regulator has warned users about an alleged “backdoor” vulnerability in Anthropic’s AI coding tool Claude Code, Reuters reports.

The warning came from China’s National Vulnerability Database, or NVDB, a cybersecurity platform overseen by the Ministry of Industry and Information Technology. The database claimed that Claude Code contains a built-in monitoring mechanism.

According to the regulator, the mechanism could transmit users’ locations and identity-related identifiers to remote servers without their consent.

The warning applies to Claude Code versions 2.1.91 through 2.1.196. Organizations and users were advised to immediately inspect their systems and either uninstall the affected versions or update to a release in which the alleged backdoor code has been removed.

The alert appears to refer to a hidden tracking mechanism that developers discovered in Claude Code in late June. The tool checked a user’s time zone and proxy settings, then used steganography — hidden markers embedded directly in the system prompt — to tag requests from users believed to be linked to China.

Anthropic engineer Thariq Shihipar described the mechanism as an experiment launched in March to prevent model distillation and unauthorized reselling. According to him, the company had already planned to remove the tracker, and the relevant changes were rolled back in a subsequent release.

Anthropic officially blocks access to its products from China, but users still bypass those restrictions with VPNs and proxies.

Following the controversy, Alibaba banned employees from using Claude Code starting July 10 and moved them to its own Qoder platform. Since February, Anthropic has accused Chinese AI labs, including Alibaba’s Qwen team, of large-scale distillation of Claude models.