🔐 Espionage Accusation Against Claude Code | China vs Anthropic

On July 8, 2026, China's Ministry of Industry and Information Technology published a security advisory that could mark the beginning of a new chapter in the tech cold war between Beijing and Washington. The target this time is Claude Code, an AI-powered coding tool from American company Anthropic that Chinese authorities claim contains a security backdoor capable of transmitting users' sensitive information to remote American servers.

The accusation, raised by China's National Vulnerability Database (CNVDB), alleges that versions 2.1.91 through 2.1.196 of the tool can transmit users' geographic location, identity-related identifiers, and potentially even source code from projects being worked on, all without user knowledge or consent, to Anthropic's servers.

The History of Tension | From Model Extraction Accusation to Complete Ban

The current saga has roots in an event that occurred one month prior. In early June 2026, Anthropic publicly announced that Alibaba, China's tech giant, had attempted to extract the capabilities of Claude AI models through reverse engineering methods. Anthropic emphasized at the time that access to Claude services in China is not permitted, and any use of it in the country constitutes a violation of terms of service.

Alibaba showed no response at the time, but it appears that behind the scenes, the company's engineers were busy with something else: reverse engineering Claude Code to discover why the tool exhibited unusual behavior in certain cases.

Alibaba Engineers' Discovery

According to published reports, Alibaba's security engineers, while reverse engineering Claude Code, encountered a series of suspicious checks that appeared designed to identify Chinese users. These checks included:

• Examining system timezone settings to identify Chinese time zones
• Detecting common proxy servers and VPNs used in China
• Searching for specific characteristics of Chinese AI lab infrastructure
• Recognizing specific network characteristics common in China

When these checks returned positive results, Claude Code would transmit certain information to Anthropic's servers. Exactly what information was sent remains unclear, but China's National Vulnerability Database claims this information included geographic location, system identifiers, and possibly metadata from coding projects.

Anthropic's Response | Anti-Abuse or Espionage?

Anthropic quickly responded to these allegations. In a statement released on Thursday, July 9, the company emphasized that what China calls a backdoor was actually an experimental anti-abuse mechanism. The purpose of this mechanism was to identify and prevent unauthorized use of Claude Code in countries where Anthropic does not provide services for legal or policy reasons.

Anthropic also added that this mechanism was part of an internal experiment and was never intended to operate as a permanent espionage tool. However, the company confirmed that this capability existed in versions 2.1.91 through 2.1.196 and has been removed from version 2.1.197 onwards.

The Big Question: Why Did Anthropic Do This?

From Anthropic's perspective, the explanation is simple: American companies like Anthropic are subject to US export laws that prohibit them from providing advanced technologies to specific countries, including China. But since users can access these tools through VPN or proxy services, Anthropic was seeking a way to identify and block these unauthorized accesses.

But critics say that even if Anthropic's intention was good, the implementation is problematic. Sending user information without their explicit knowledge, even for anti-abuse purposes, can be considered a privacy violation. In the European Union, such behavior could constitute a violation of GDPR regulations.

The technical community points out that there were alternative, more transparent approaches available. Anthropic could have implemented IP-based geoblocking, required authentication that verifies geographic location, or simply displayed a clear message refusing service to VPN users. Instead, the silent data collection approach created exactly the kind of trust breach the company now faces.

China's Reaction and Alibaba's Ban

Following the discovery by Alibaba engineers, the company made a decisive move. On July 7, Alibaba officially banned the use of Claude Code for all its employees and required them to use Qoder instead, Alibaba's own AI-powered coding platform.

One day later, on July 8, China's National Vulnerability Database (CNVDB) published its official security advisory. This warning, available on the official CNVDB website in Chinese, explicitly states that Claude Code contains a backdoor vulnerability that poses a serious threat to organizations and individuals.

Content of China's Warning

According to published translations, the CNVD advisory includes the following:

"It was recently discovered that the AI coding tool Claude Code contains security backdoor risks that pose a serious threat. This vulnerability allows the software to transmit sensitive information, including users' locations and identity-related identifiers, to remote servers without users' consent."

The warning also recommends that organizations and individual users should immediately uninstall versions 2.1.91 through 2.1.196, and if they must use the tool, upgrade to newer versions.

Different Perspectives | Geopolitics or Real Security?

Reactions to this incident in the cybersecurity and technology community are completely divided. Some view this as a real security concern, while others see it as part of the tech cold war between America and China.

First Perspective: This is a Real Security Concern

Independent security researchers who have examined the code confirm that the capability in question actually exists. Kevin Beaumont, an independent security researcher who previously worked for Microsoft, tweeted: "I saw the code myself. The checks are real. The question is whether this is an espionage backdoor or a compliance mechanism?"

From this group's perspective, even if Anthropic's intention was good, the implementation is problematic. Sending user information without explicit notice, for any reason, can be considered a privacy violation. In many countries, privacy laws require users to be explicitly informed of and consent to any data collection and transmission.

Second Perspective: This is Part of the Tech Cold War

On the other hand, many analysts believe the timing of this warning is highly suspicious. This warning was published exactly one month after Anthropic accused Alibaba of attempting to extract the model. This could indicate that China's warning is, at least partially, a retaliatory move.

Also, some point out that China has previously used security warnings as a tool to pressure foreign companies. In 2021, China removed Microsoft products from some government offices for security reasons, a decision many saw as part of China's efforts to reduce dependence on American technology.

Interestingly, the Chinese government has in recent years strongly emphasized developing domestic alternatives to American technology tools. Qoder, the platform Alibaba introduced instead of Claude Code, is itself an example of these efforts.

The broader context involves US-China technology decoupling accelerating since 2024. The Biden and Trump administrations implemented increasingly restrictive export controls on AI technology. China responded by launching Operation Tech Independence, a multi-billion dollar initiative to develop domestic alternatives to Western technology. This Claude Code incident perfectly fits that narrative.

Some Western analysts argue that China's complaint, while technically accurate, is strategically motivated. By publicly identifying and banning American AI tools, China creates market space for domestic alternatives while portraying Western technology as untrustworthy. It's a win-win for Beijing's tech nationalism agenda.

Impact on the Industry | Should We Be Worried?

Regardless of the political motivations behind this incident, one thing is clear: this event could have a significant impact on how AI-powered coding tools are used worldwide.

The Trust Question

One of the most important assets of any software company is user trust. When users discover that a tool collects and transmits information without their knowledge, even for legal purposes, that trust is severely damaged.

In an informal Twitter poll, 68 percent of developers who responded said they would likely stop using Claude Code or at least review it more carefully after this incident.

New Standards Are Needed

This incident demonstrates that the technology industry needs clearer standards for how AI-powered tools operate. Some experts suggest that an international framework for transparency in AI tools should be established with the following requirements:

• Complete disclosure of any data collection, even for compliance purposes
• Access to source code for independent security auditing
• Transparent reporting about where data is stored and processed
• User right to opt-out of any data collection

The Future of AI Coding Tools in a Multipolar World

This incident is part of a larger trend: the world is becoming a multipolar technology space where different companies must adapt to different laws and expectations in different countries.

Three Technology Blocs Are Forming

Researchers at MIT's Technology Policy Institute in a recent report predicted that by 2030, three separate technology blocs will form:

The American Bloc: Including the United States, Canada, Europe, Japan, and South Korea. This bloc focuses on rapid innovation and proprietary models but is constrained by strict privacy regulations (like GDPR).

The Chinese Bloc: Including China and its close allies. This bloc emphasizes technological self-sufficiency and prefers to use domestic tools. High government control but massive investment in research and development.

The Open-Source Bloc: Including India, Brazil, and many developing countries that focus on using open-source technologies to avoid dependence on either major power bloc.

In this new world, companies like Anthropic must decide which markets they want to operate in and what compromises they're willing to make. Should Anthropic launch a localized version of Claude with servers inside China to access the Chinese market? Or should it completely exit that market?

The Bigger Ethical Question

Beyond technical and geopolitical issues, this incident raises a major ethical question: Do technology companies have the right to violate user privacy in the name of enforcing laws?

On one hand, it can be argued that Anthropic was only trying to comply with US export laws. These laws are real, and violating them could result in heavy fines and even criminal prosecution.

On the other hand, users expect the tools they use to respect their privacy. Even if the company's intention is good, secrecy can irreparably damage trust.

Perhaps the solution is complete transparency. Anthropic could have explicitly stated from the beginning in its terms of service that Claude Code includes a geographic detection system that collects limited data to enforce export restrictions. This approach might have driven some users away, but at least those who stayed would be making an informed decision.

The broader debate touches on fundamental questions about sovereignty, privacy, and technology governance in an interconnected world. When a company operates globally but is subject to one nation's laws, whose rules should prevail? When national security concerns conflict with privacy rights, which takes precedence?

Legal experts note that existing frameworks like GDPR attempt to answer these questions, but AI tools create new challenges. The speed and scale of data collection by AI systems, combined with their opacity, make traditional consent mechanisms inadequate. Users can't meaningfully consent to data practices they don't understand.

Some propose a new category of "high-risk AI tools" that would face stricter disclosure requirements, mandatory third-party audits, and user rights to explanation. The EU's AI Act, set to fully take effect in 2027, moves in this direction, but critics argue it doesn't go far enough for development tools that touch sensitive intellectual property.

Conclusion | Lessons We Must Learn

The Claude Code incident and China's accusation, regardless of the political motivations behind it, teaches us several important lessons:

Lesson One: Transparency is more important than ever. In a world where AI tools penetrate sensitive parts of our work, users have the right to know exactly what's happening behind the scenes.

Lesson Two: Compliance and privacy should not be in conflict. Companies must find ways to both follow laws and respect user privacy.

Lesson Three: In a multipolar technology world, there is no simple solution. International companies must be prepared to work with different approaches in different markets.

Lesson Four: Open-source and local tools can be good alternatives to cloud services, especially for organizations with serious security concerns.

Final Recommendation for Developers

If you're a developer using AI-powered coding tools, keep several important points in mind:

First, don't blindly trust any tool. Even if it's from a reputable company, always assume your information might be collected. For sensitive projects, prefer local or open-source tools.

Second, read the terms of service. I know it's tedious, but know exactly what data is collected and where it's stored. If something seems suspicious, ask the company questions.

Third, have an exit strategy. If you become too dependent on one tool and suddenly that tool is blocked or has a security problem, what will you do? Always have at least one alternative ready.

And finally, remember that AI is a tool, not a replacement. No AI tool can replace critical thinking, security understanding, and your accountability. Review the code AI writes, test it, and ensure it meets your security standards.