Alibaba bans Claude Code over hidden Chinese user tracking
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Alibaba has banned Claude Code for its employees after security researchers discovered hidden tracking code in the tool designed to identify Chinese users. A Reddit user reverse-engineered Claude Code and found obfuscated code, active since version 2.1.91 (April 2), that checked for Chinese timezones and proxy URLs, then used steganography to embed signals invisibly in system prompts sent to Anthropic's servers. Anthropic acknowledged the code as an anti-abuse experiment targeting unauthorized resellers and distillation attacks, and removed it on July 1. The incident unfolds amid a broader conflict: Anthropic accused Alibaba-affiliated operators of running the largest known distillation attack on Claude using ~25,000 fraudulent accounts. The episode raises serious developer trust concerns, given Claude Code's deep file system access, and accelerates China's push toward domestic AI tools.
Table of contents
How the tracking workedAnthropic’s responseThe distillation backdropThe developer trust problemThe bigger picture297 Impressions1 Comment