China Warns of Security Risks in Anthropic's Claude Code AI Tool

China's National Vulnerability Database (NVDB), operated by the Ministry of Industry and Information Technology (MIIT), has issued a statement warning of serious security vulnerabilities in Claude Code, an AI coding tool developed by US-based Anthropic. The NVDB stated that specific versions of Claude Code (2.1.91 through 2.1.196) possess a built-in monitoring mechanism capable of transmitting sensitive information, including users' geographic location and identity identifiers, to remote servers without their consent.

This development comes shortly after Chinese tech giant Alibaba banned its employees from using Claude Code. Alibaba cited security risks, adding the tool to its list of "high-risk software" and directing employees to switch to its proprietary Qoder platform instead. Anthropic, in response, stated that the tracking mechanism was an "experiment" launched to prevent account abuse by unauthorized resellers and to protect its models against "distillation"—the practice of using outputs from larger AI models to train smaller, less expensive ones. The company indicated that this tracking system would be removed.

The identified security vulnerability and Alibaba's subsequent ban have raised significant concerns for technology companies regarding data compliance and cross-border data management. For financial firms and institutions operating in Hong Kong and mainland China, where data sovereignty rules are strictly enforced, hidden data tracking poses a critical compliance risk. This situation further accelerates the push by Chinese firms to reduce their reliance on US-origin software and gravitate towards domestic alternatives.

This incident is viewed as a reflection of the escalating technology rivalry and national security concerns in the AI domain between the United States and China. China has consistently voiced worries about the potential risks of AI technologies and their implications for national security. Beijing is intensifying its security governance in this sector, focusing on issues such as controlling the information environment, mitigating socio-economic impacts, and addressing the risks of AI escaping human control.

Analysts suggest that such security warnings and corporate bans will further complicate the operations of international technology companies in the Chinese market. Moving forward, data security and national security concerns are likely to lead to stricter regulations concerning the development and deployment of AI technologies. Companies will need to invest more in local solutions and transparent data management practices to ensure compliance with both national and international laws and to maintain user trust.