China Alleges Security Flaw in Anthropic's Claude Code AI Tool
China's National Vulnerability Database (NVDB), affiliated with the Ministry of Industry and Information Technology, issued a warning on Wednesday regarding a "security backdoor" in Anthropic's AI coding tool, Claude Code. The NVDB claims this vulnerability could enable the software to transmit sensitive user data, such as locations and identity identifiers, back to Anthropic's servers without explicit consent. Claude Code is designed to generate, debug, and review computer code based on user prompts. Although Anthropic restricts direct access to its products in China and other adversarial nations, users can still access them via VPNs or third-party proxy services. The NVDB described the risk as "severe" and urged immediate checks, uninstallation, or upgrading to a secure version. Chinese tech giant Alibaba reportedly banned the use of Claude Code for its employees starting July 10 due to similar security concerns. Anthropic engineer Thariq Shihipar addressed earlier reports, stating the feature was an experimental measure launched in March to prevent account abuse and protect against AI model "distillation" by unauthorized resellers. He indicated that stronger mitigations have been implemented and the feature was intended for removal, with a full rollback planned for the following day's release.
The NVDB's warning highlights the ongoing tension between national security interests and the global proliferation of advanced AI tools. While China's regulator points to potential data exfiltration, Anthropic's engineer suggests the feature was an experimental security measure against misuse. This situation underscores the challenges in governing AI technologies that operate across borders, especially when access is circumvented through indirect means. The incident raises questions about the transparency of data handling practices in AI development and the efficacy of regulatory oversight in a rapidly evolving technological landscape. Future developments will likely involve increased scrutiny of AI models' data transmission capabilities and the establishment of clearer international norms for AI security and data governance.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.