China's CNVDB Labels Claude Code a "Backdoor"; Alibaba Bans It

Anthropic Claude Code, versions 2.1.91 (April 2) through 2.1.196 (June 29)

China's national vulnerability body alleged Claude Code contained a built-in monitoring mechanism that collected user location and identity data and sent it to external servers. Alibaba added Claude Code to its high-risk software list and barred employees from using it starting July 10, moving staff to in-house tools

Anthropic said the code was a March 2026 anti-abuse experiment that checked base URL, timezone, and hostname against reseller and Chinese-company lists to counter unauthorized reselling and model distillation, and that it was removed in version 2.1.198 (July 1). The dispute is over disclosure and intent rather than a formal CVE