China's Ministry of Industry and Information Technology on Wednesday warned that Anthropic's Claude Code contains a back-door vulnerability, telling domestic users to uninstall or upgrade versions 2.1.91 through 2.1.196. The flagged range covers roughly three months of releases, from April 2 to June 29, according to Anthropic's own version history. The current build, 2.1.204, is three point releases past the ministry's cutoff.
The MIIT's cybersecurity threat platform said Claude Code can send sensitive information to a remote server without user consent, including location and identity data. The statement described the flaw as a "security back-door vulnerability that poses a serious threat." It did not publish technical details, a proof-of-concept, or a CVE identifier.
Anthropic did not immediately respond to a request for comment on the advisory. Claude Code is not officially sold in China, which makes the ministry's warning notable — Beijing is telling users to stop running a product that Anthropic does not formally distribute in the country.
Key facts
- 01China's Ministry of Industry and Information Technology said Claude Code contains a back-door vulnerability that can exfiltrate user location and identity without consent.
- 02The advisory names Claude Code versions 2.1.91 to 2.1.196, covering releases from April 2 to June 29, and tells users to uninstall or upgrade.
- 03Anthropic's latest Claude Code build as of Wednesday is 2.1.204, three point releases past the flagged range.
- 04Alibaba ordered employees to stop using Anthropic tools for work starting July 10, a week after Anthropic accused the company of trying to extract its AI capabilities.
- 05Claude is not officially available in China, but Xiaomi AI developers publicly acknowledged using Claude Code at a state-organized forum in March.
The advisory lands one week before Alibaba's internal ban on Anthropic tools takes effect on July 10. CNBC confirmed on Monday that Alibaba has ordered employees to stop using Anthropic products for work. Last month, Anthropic publicly accused Alibaba of attempting to extract its AI capabilities. Alibaba did not comment on the accusation at the time.
The sequence — Anthropic accuses Alibaba, Alibaba bans Anthropic internally, MIIT flags Claude Code nationally — reads as a coordinated escalation rather than an isolated security disclosure. Chinese state cybersecurity platforms have previously issued similar advisories against foreign chip and software vendors during periods of trade friction with Washington.
Despite the lack of official availability, Claude Code has real users inside China. In March, a Xiaomi AI developer said at a state-organized forum that many engineers were using the tool. Chinese developers routinely reach US AI products through VPNs, third-party proxies, and API resellers, and Claude Code's terminal-native workflow has made it a favorite for autonomous coding tasks worldwide.
The technical claim in the advisory — that Claude Code transmits telemetry to remote servers — is not by itself unusual. Most modern developer tools, including competing coding assistants from OpenAI, Google, and Chinese vendors, send telemetry, crash reports, and usage data back to their operators. Whether that constitutes a "back door" depends on scope, disclosure, and user consent, none of which the MIIT statement specified.
For Anthropic, the practical impact inside China is limited because the product was never officially sold there. The reputational impact outside China is a different question. Anthropic has spent 2026 pitching Claude Code as an enterprise-grade agentic coding tool, and a foreign-government security advisory — however politically motivated — becomes a talking point for procurement teams and rival vendors in markets where the product does compete.
The broader pattern is one AI Chat Daily has tracked across recent coverage of DeepSeek's move to in-house inference chips and Microsoft's shift toward its own MAI models: the AI stack is fragmenting along national lines faster than the technology is maturing. Chinese cloud vendors, Chinese chipmakers, and now Chinese regulators are drawing hard perimeters around what US AI products employees and enterprises are allowed to touch.
The MIIT notice is thin on forensic evidence, and Anthropic has not been given a public window to respond before the advisory landed. Independent security researchers outside China have not yet corroborated the back-door claim, and no CVE has been filed against the affected versions. Readers should treat the technical specifics as unverified until a second source publishes analysis.
The strategic read is clearer than the technical one. Anthropic is now a named target in Beijing's AI-decoupling playbook, joining a short list of US frontier labs whose products are being formally warned against inside China. That closes off a gray-market user base Anthropic was never officially serving, but it also hardens the split that will define how enterprise AI gets sold for the rest of the decade — one stack for the US and its allies, another for China, and vanishing overlap in the middle.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
