The Chinese authorities have issued a security warning regarding Anthropic’s Claude Code tool. However, the issue goes beyond the vulnerability itself and shows that the rivalry between the US and China is increasingly spilling over into the AI software market.
The National Vulnerability Database (NVDB), operated by the Chinese Ministry of Industry and Information Technology, reported the discovery of an alleged ‘backdoor’ mechanism in selected versions of Claude Code. According to the statement, the tool was said to transmit sensitive information – including the user’s location data and identifiers relating to their identity – to remote servers without obtaining consent. The warning applies to versions 2.1.91 to 2.1.196.
The NVDB has advised organisations to immediately check which versions of the software they are using and to either uninstall them or update to the latest release, in which – according to the Chinese website – the disputed code has been removed. At the same time, organisations were urged to tighten access controls for development tools to external networks and to monitor traffic in key corporate systems in order to minimise the risk of data leaks.
The warning came a few days after Alibaba’s decision to ban its employees from using Claude Code. The company recommended switching to its own development tool, Qoder. Reuters had previously reported that the reason for this was features enabling the identification of users linked to China.
To date, Anthropic has not issued an official statement regarding the Chinese authorities’ announcement. Last week, however, a company spokesperson admitted that some of the mechanisms for detecting a user’s environment were an experiment designed to curb abuse and hinder unauthorised access to services, as well as the so-called ‘distillation’ of AI models. According to the company, the feature has since been removed.
For businesses using AI tools for programming, this development is yet another sign that the security of such platforms is becoming just as important as their capabilities. Growing geopolitical tensions mean that decisions regarding the choice of an AI provider increasingly depend not only on the quality of the technology, but also on issues of trust, data control and compliance with local regulations.
