China warns of backdoor in Anthropic's Claude Code versions 2.1.91-2.1.196
China's Ministry of Industry and Information Technology warned Wednesday that Anthropic's Claude Code AI coding tool contains a backdoor vulnerability in versions 2.1.91 to 2.1.196. Anthropic confirmed the backdoor was an anti-distillation experiment, as tensions escalate after the company last month accused Alibaba of attempting to extract its AI capabilities.
China warns of backdoor in Anthropic's Claude Code versions 2.1.91-2.1.196
China's Ministry of Industry and Information Technology issued a security warning Wednesday about Anthropic's Claude Code AI coding tool, stating that versions 2.1.91 through 2.1.196 contain a backdoor vulnerability that can transmit sensitive user data without consent.
According to the ministry's cybersecurity threat platform, the autonomous coding tool can send information including user location and identity to a remote server without user authorization. The affected versions span releases from April 2 to June 29, 2025. The current version as of July 8 is 2.1.204.
When contacted by CNBC, Anthropic acknowledged the backdoor, stating it was "an experiment earlier this year to protect against distillation." The company did not provide additional details about the experiment's scope or duration.
Escalating US-China AI tensions
The warning comes weeks after Anthropic accused Chinese tech giant Alibaba of attempting to extract its AI capabilities in June. Anthropic's tools are not officially available in China, though many Chinese users have found workarounds to access them.
Alibaba has ordered employees to stop using Anthropic tools for work starting July 10, CNBC confirmed. At a state-organized forum in March, a Xiaomi AI developer noted widespread use of Claude Code among Chinese developers.
Anthropric's usage policy explicitly prohibits use by entities majority-owned by China-headquartered organizations.
What this means
The incident highlights the increasingly fraught intersection of AI development and national security concerns. While Anthropic characterizes the backdoor as an anti-distillation measure—likely intended to prevent unauthorized model copying—its existence in production software raises questions about transparency in AI tool security. Users of affected Claude Code versions should upgrade immediately to version 2.1.204 or later. The disclosure may further complicate cross-border AI adoption as companies navigate competing security frameworks.
Related Articles
Anthropic Deploys Claude Mythos 5 in New Security Scanner for Enterprise Codebases
Anthropic has moved its Claude Security vulnerability scanner onto Claude Mythos 5, its most capable model, in a public beta for Enterprise customers. The company is also integrating Mythos 5 into partner security products for hospitals, utilities, and banks, without exposing the model directly to end users.
Anthropic Watermarks Claude's Text Output; Independent Educator Breaks Down the Mechanism
Anthropic has begun embedding invisible watermarks into Claude's generated text so it can later identify AI-authored content. ML educator Sebastian Raschka published a detailed 48-minute video explainer breaking down how the underlying token-sampling mechanism works.
Jailbreak Bypasses Anthropic's Sexual Content Ban in Claude Opus 4.6, Opus 3, Haiku 4.5
A researcher's multi-turn jailbreak technique reliably pushes Claude Opus 4.6, Opus 3, and Haiku 4.5 into generating sexually explicit content that Anthropic's usage policy explicitly prohibits. Newer models, Opus 4.7 through Opus 5, resist the same technique.
Anthropic Reverses Course, Will Let Enterprise Customers Store Retention Data on Their Own Cloud
Anthropic is revising its 30-day data retention policy after enterprise pushback, allowing regulated-industry customers to store the required data on their own cloud infrastructure instead of Anthropic's servers. The changes, built with more than 100 customers, are set to roll out this fall.
Comments
Loading...