TL;DRChina’s National Vulnerability Database has flagged multiple versions of Anthropic’s Claude Code as containing a security “back door” that could send user locations and identifiers to remote servers without consent. Anthropic says the code was an experiment to stop illicit model distillation, and that its policy already barred China-based users. Analysts expect the row to accelerate Chinese developers’ shift to domestic coding tools such as ByteDance’s Trae, Alibaba’s Qoder, Tencent’s CodeBuddy, and Zhipu’s CodeGeeX and ZCode.
Beijing’s cybersecurity warning against Anthropic is expected to speed up a shift already under way. Chinese developers are moving to domestic coding tools, analysts told the South China Morning Post.
China’s National Vulnerability Database, overseen by the Ministry of Industry and Information Technology, issued an alert this week. It claimed multiple versions of Claude Code contained a security “back door”.
According to the agency, the software could send user locations and identity markers to remote servers without consent. It urged local organisations to uninstall the affected versions or upgrade to patched releases.
What Anthropic says happened
