Beijing Flags "Backdoor" in Anthropic's Claude Code, Deepening AI Standoff With Washington

China's Ministry of Industry and Information Technology said Wednesday that Anthropic's Claude Code, a popular AI coding assistant, contains a "back-door" vulnerability serious enough to warrant an official warning to companies using it.

According to a statement from the ministry's cybersecurity threat platform, translated by CNBC, the tool has been capable of transmitting sensitive user information, including location and identity data, to a remote server without users' consent. The ministry told affected users to uninstall or upgrade out of the impacted versions, which it identified as 2.1.91 through 2.1.196, corresponding to releases between April 2 and June 29. Anthropic's own version history puts the current release at 2.1.204, meaning the flagged builds are already several updates old.

Anthropic pushed back on the framing. The company told CNBC the behavior China describes was actually a deliberate experiment it ran earlier this year aimed at preventing "distillation," a technique where a rival AI company probes a model's outputs to train a cheaper, competing system that mimics its capabilities. In other words, what Beijing is calling a security hole, Anthropic is calling an anti-theft measure.

That distinction matters, because it lands the story squarely inside an escalating dispute between Anthropic and Chinese tech giant Alibaba. Last month, Anthropic accused Alibaba of trying to extract its AI capabilities through exactly this kind of distillation effort. Claude models aren't officially offered in China, which made the alleged attempt to siphon their behavior notable. Alibaba has not commented on the accusation.

The timing has only gotten more pointed. CNBC confirmed this week that Alibaba has told its own employees to stop using Anthropic's tools for work starting July 10, just days before Beijing's public warning about Claude Code's supposed security flaw. Anthropic, for its part, noted that its usage policy already bars entities majority-owned by China-headquartered organizations from using its products, a restriction that predates this latest dust-up.

A tool Chinese workers use anyway

The friction is complicated by the fact that Claude Code has real traction inside China despite the official restrictions. In March, a developer from Xiaomi said at a state-organized forum that many people in China were already relying on Claude Code in their work, restrictions notwithstanding. That's the backdrop against which Beijing's warning lands: not a hypothetical threat to some distant foreign market, but a tool with an existing foothold among Chinese developers and companies, one the government now wants to actively steer people away from.

Framed that way, the ministry's alert does double duty. It's ostensibly a cybersecurity advisory, but it also functions as an official nudge away from a foreign AI product that Chinese workers have found workarounds to use, at a moment when Beijing has its own reasons, competitive and otherwise, to discourage reliance on it.

Reading the dueling explanations

The two accounts of what actually happened in Claude Code aren't necessarily irreconcilable. A system built to detect and disrupt distillation attempts could, by design, involve the kind of server communication that looks identical to unauthorized data exfiltration from the outside, especially to a regulator with no visibility into Anthropic's internal reasoning. Whether that communication crossed into genuinely undisclosed data collection, or was a narrowly scoped defensive mechanism that got swept up in broader distillation-related scrutiny, isn't something either side's public statements fully settle.

What is clear is that the vulnerability, whatever its origin or intent, existed across roughly three months of Claude Code releases before being resolved in later versions. Anthropic hasn't disputed that the behavior occurred, only its characterization as a backdoor.

Why this matters beyond one advisory

This episode is really a symptom of a larger dynamic: American AI labs are increasingly building defenses against having their models copied or reverse-engineered, and those defenses are colliding with how governments and companies scrutinize foreign software operating, officially or unofficially, inside their borders. Anthropic's anti-distillation measures exist because frontier AI capabilities are valuable and expensive to build, and companies want to stop rivals from getting them cheaply by studying outputs. But those same measures, once discovered, can be repackaged by a foreign government as evidence of surveillance or bad faith.

The result is a feedback loop that's likely to keep repeating as long as Chinese developers keep finding ways to use restricted U.S. AI tools, and as long as U.S. companies keep building technical safeguards to prevent their models from being distilled by companies like Alibaba. Each side has a rational, self-interested story to tell about the exact same piece of code. What happens next, whether Anthropic patches its way past this specific controversy or whether Beijing's warning accelerates a broader pullback from U.S. AI tools among Chinese firms and their employees, is the part worth watching.