China Declares Claude Code a National Security Threat, Anthropic Says It Was Catching Thieves

On July 8, 2026, China's National Vulnerability Database (NVDB), a cybersecurity platform operated by the Ministry of Industry and Information Technology (MIIT), published a warning stating that Claude Code "contains security backdoor risks, posing a severe threat." It said versions 2.1.91 through 2.1.196 contain a built-in monitoring mechanism capable of transmitting sensitive user information, including geographic location and identity-related identifiers, to remote servers without consent. It advised users and institutions to immediately inspect affected systems, uninstall the affected versions or upgrade to the latest secure release, and strengthen network traffic monitoring to prevent unauthorised data leakage.

China's NVDB identified Claude Code versions 2.1.91 through 2.1.196 as containing the backdoor vulnerability. Version 2.1.91 was released on April 2, 2026; version 2.1.196 was released on June 29, 2026, meaning the hidden tracking code was active for approximately three months. Anthropic's Claude Code engineer Thariq Shihipar confirmed the tracking feature was fully removed in version 2.1.198, released July 1, 2026. The latest version as of July 8 is 2.1.204, which does not contain the disputed code.

Anthropic said the code was an experimental anti-abuse mechanism, not a surveillance tool. Engineer Thariq Shihipar explained on X that it was launched in March 2026 to combat two specific threats: fraudulent account resellers and model distillation by Chinese competitors. It worked by reading timezone and network signals to determine whether a user was based in China or affiliated with a Chinese AI lab. Shihipar said the team "has landed stronger mitigations since then" and confirmed the feature was removed on July 1. Anthropic also noted Chinese users were never authorised to use Claude Code, its terms prohibit access by China-headquartered entities and their majority-owned subsidiaries, even when incorporated abroad.

Model distillation is a technique where the outputs of a more capable AI model are used to train a less capable one, stealing intelligence from a frontier model without accessing its weights. In a June 10, 2026 letter to US senators, Anthropic alleged that operators linked to Alibaba's Qwen lab ran nearly 25,000 fraudulent accounts that generated approximately 28.8 to 29 million interactions with Claude between April 22 and June 5, what Anthropic called the largest known coordinated distillation attack on its systems. The hidden tracking code in Claude Code versions 2.1.91–2.1.196 was specifically designed to detect and block users engaging in this practice.

Alibaba informed employees in late June / early July 2026 that Claude Code would be banned from all work use effective July 10, citing security concerns. The company placed Claude Code on its high-risk software list and instructed employees to switch to Qoder, Alibaba's in-house AI coding platform. The ban followed Anthropic's June 2026 letter to US senators accusing Alibaba of the largest known distillation attack on Claude, Anthropic's mass account restrictions cutting off numerous Chinese users, and the discovery of the hidden location-detection code. China's CNBC confirmed the ban on July 7, 2026.

No. The tracking mechanism was not disclosed to users and was not mentioned in Anthropic's standard terms of service or privacy documentation during its deployment period (April 2 – July 1, 2026). The alleged backdoor surfaced via a June 30 Reddit post by LegitMichel777, who reverse-engineered Claude Code. Anthropic did not issue a formal disclosure before the Reddit post. Engineer Thariq Shihipar confirmed the feature on X after it was publicly discovered. Security Boulevard noted this "highlights the increasingly geopolitical battleground of corporate AI development, where data privacy, intellectual property theft, and international compliance continue to collide."

The hidden tracking mechanism was discovered through independent reverse engineering. On June 30, 2026, Reddit user LegitMichel777 published findings claiming to have analysed Claude Code's binary and found code beginning in version 2.1.91 that checked whether a user's proxy configuration or timezone matched identifiers associated with China or Chinese AI labs. The findings spread through specialist tech media the following week. Chinese publication Yicai was among the first to report the story to a Chinese-language audience. The NVDB warning followed on July 8, citing the "built-in monitoring mechanism" identified in the same version range.

No. Anthropic's terms of service explicitly prohibit access by Chinese-headquartered organisations and their majority-owned subsidiaries, even if incorporated abroad. Anthropic describes itself as maintaining the hardest line on China access of any major frontier AI company. Despite these restrictions, Claude Code was widely used in China through VPNs and third-party proxy services. In March 2026, a Xiaomi AI developer acknowledged at a state-organised forum that many Chinese developers were using Claude Code. It was this proxy-based access that Anthropic's timezone and network detection code was specifically designed to identify and block.

Both framings contain truth. From a technical security standpoint, software that collects and transmits user location and identity data without disclosure is a legitimate concern for any organisation handling sensitive data. From a geopolitical standpoint, the warning, issued by a state cybersecurity platform affiliated with MIIT, days after Anthropic's mass account cutoffs and the Alibaba distillation accusations, is inseparable from the escalating US-China AI rivalry. The warning legitimises Alibaba's ban, discourages Chinese enterprises from using US AI tools, and reframes Anthropic's anti-distillation measures as hostile surveillance. Both things can simultaneously be true: the code was real, and China's use of its exposure is strategic.

The Claude Code story is one episode in a rapidly escalating pattern of mutual restriction. Simultaneously: Beijing is reportedly discussing restrictions on overseas access to Chinese AI models including Alibaba Qwen and ByteDance Doubao. Anthropic has cut off large numbers of Chinese user accounts following its Senate letter. The Trump administration maintains export restrictions on Nvidia's most advanced chips. US restrictions on Anthropic's Fable and Mythos models for foreign nationals remain partially in place. Each escalation tends to produce a counter-move. The cycle of restriction, detection, disclosure, and retaliation is now structural to the US-China AI relationship, and the Claude Code episode is its most recent chapter, not its conclusion.