AI trade war heats up: China warns of 'security backdoor' in Anthropic's Claude Code | Mint

China's National Vulnerability Database said the suspected vulnerability could allow the transfer of data, such as user location details and identity-related information.

A Chinese cybersecurity regulator has warned users about an alleged "security backdoor" in certain versions of Anthropic's artificial intelligence coding assistant, Claude Code, claiming the tool could transmit sensitive user information to the company's servers without consent.

China's National Vulnerability Database (NVDB), a government-backed cybersecurity platform, said the suspected vulnerability could allow the transfer of data such as user location details and identity-related information. The regulator urged organisations and individuals using the software to immediately review their systems and take precautionary measures.

Claude Code is an AI-powered coding agent developed by US-based AI company Anthropic. The tool can create software code, identify and fix programming errors, and analyse existing code based on user instructions.

Anthropic has restricted access to its products for users and organisations in China and several other countries it considers high-risk jurisdictions. However, Chinese users can still access the company's AI services through virtual private networks (VPNs) or third-party proxy platforms.

Anthropic has not publicly responded to requests for comment regarding the allegations, which were initially reported by specialised technology outlets last week.

The NVDB, which is affiliated with China's Ministry of Industry and Information Technology, said on its website it had recently "detected that the AI coding tool Claude Code contains security backdoor risks, posing a severe threat".

The NVDB advised companies and users to conduct a detailed security review and either remove affected versions of Claude Code or upgrade to newer versions where the alleged backdoor code has been eliminated. It also recommended stronger monitoring of network traffic to prevent possible unauthorised transfer of sensitive information.

The warning comes amid rising scrutiny of AI tools and data security risks as governments and companies worldwide compete to develop and deploy advanced artificial intelligence technologies.

Chinese technology giant Alibaba Group has reportedly instructed employees to stop using Claude Code from 10 July due to security concerns, according to AFP .

The move follows earlier tensions between Anthropic and Chinese technology firms. Anthropic has previously accused Alibaba of attempting to reverse-engineer its AI models through a process known as "distillation," in which one AI system is trained to replicate the capabilities of another.

Meanwhile, Claude Code engineer Thariq Shihipar responded on X last week to claims that the tool was collecting or tracking certain data from Chinese users.

"This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation," Shihipar wrote.

"The team has landed stronger mitigations since then and we've actually been meaning to take this down for a while... this should be fully rolled back in tomorrow's release."

The controversy highlights growing geopolitical tensions surrounding artificial intelligence, with cybersecurity, data privacy and control over advanced AI technologies becoming major issues in the competition between the United States and China.