Two accusations surfaced the same week, aimed in opposite directions, and both are backed by real evidence. Alibaba says Claude Code was carrying a hidden backdoor. Anthropic says the backdoor was a trap for a distillation attack it had already caught in progress.
- 01Alibaba banned Claude Code fleet-wide, effective today.An internal notice classifies it as “high-risk software with security vulnerabilities” and tells staff to switch to Alibaba’s own Qoder.
- 02The “backdoor” was real, hidden, and undisclosed. Claude Code checked a machine’s timezone and proxy settings against a Chinese watchlist, then signaled a match by quietly altering characters in the outgoing prompt.
- 03Anthropic doesn’t deny it built the check.An engineer on the Claude Code team says it was a March experiment against “unauthorized resellers” and distillation — not espionage.
- 04The distillation claim has its own numbers.Roughly 25,000 accounts, 28.8 million exchanges, 45 days, aimed at Claude’s agentic and coding capabilities — what Anthropic calls its largest distillation attack on record.
“False colors” is a ruse as old as sail: a ship runs up a flag that isn’t its own to close the distance before anyone can object. Nobody on either side of this dispute is flying a false flag exactly — Alibaba really did find hidden code, and Anthropic really does say it caught a large-scale attack. The deception, if there is one, is in the framing each side chose once the other side’s hand was forced open.
01 The ban, effective today
Alibaba’s internal security notice, reported this week by the Chinese outlet Zhidongxi, doesn’t hedge: “As Claude Code was recently discovered to carry back-door risks, after comprehensive evaluation, Claude Code has now been added to a list of high-risk software with security vulnerabilities.” The ban covers Alibaba employees fleet-wide, takes effect today, July 10, and points staff at Qoder — Alibaba’s own coding assistant — as the replacement.
High riskAlibaba internal security classification, Jul 2026That verdict didn’t come from nowhere. Days earlier, security researchers posted findings on Reddit and GitHub describing exactly what an Alibaba insider had flagged internally: a version of Claude Code built to quietly examine a machine’s environment and embed identifying markers in what it sent back to Anthropic’s servers.
02 What the hidden check actually did
The mechanism is worth laying out plainly, because “backdoor” undersells how quiet it was. Nothing about it changed what a user saw on screen. It worked entirely inside the system prompt, checking two signals and answering with a third.
Asia/Shanghai or Asia/UrumqiThat’s steganography in the strict sense: information hidden inside a channel that looks completely ordinary to anyone reading it. Nothing rendered in the chat window ever looked wrong. The signal lived in punctuation and date formatting a human reader has no reason to scrutinize.
03 The distillation window
Anthropic’s side of the story is the one the hidden check was reportedly built to catch. The company says it identified a coordinated attempt to extract Claude’s outputs at scale — the technique called distillation, where a rival trains its own model to imitate a target model’s behavior cheaply, using nothing but its answers.
Anthropic has called it the largest known distillation attempt against its models to date, and has attributed the traffic to Alibaba’s Qwen lab. If the scale holds up, it explains why Anthropic reached for a covert detection method rather than a public rate limit: a rival that already knows it’s being watched can route around a visible defense in an afternoon.
04Two ships’ logs
Strip away the framing and both accounts describe the same six weeks from opposite decks. Neither denies the other’s central fact — they disagree entirely about which fact is the story.
Undisclosed spyware, added to a coding tool
- Claude Code silently profiled a machine’s timezone and proxy configuration without disclosure to the user running it.
- The check specifically targeted signals tied to Chinese infrastructure — a watchlist of 147 named entities.
- Employees discovered the behavior only after outside researchers published it, not from anything Anthropic disclosed up front.
An anti-fraud experiment, not an intelligence operation
- The check was built to catch resellers and distillation traffic, not to identify individual users or their location.
- It followed a 45-day window in which roughly 25,000 accounts allegedly ran 28.8 million exchanges against Claude’s agentic capabilities.
- Anthropic has said the detection code has since been removed from Claude Code following the disclosure.
A rival lab moved a large volume of traffic through Claude in ways Anthropic considers abuse, and Anthropic responded with a covert check it never told anyone about. Both of those things happened. The dispute is entirely about which one is the bigger breach of trust.
What both logs agree on, once you subtract the framingDates that matter
The experiment launches
Anthropic ships the timezone/proxy detection logic inside Claude Code, undisclosed, per its own later account of the work.
ORIGINThe window opens
Anthropic says roughly 25,000 accounts begin generating unusually high volumes of agentic and coding traffic against Claude.
The window closes
The tally reaches 28.8 million logged exchanges over 45 days — what Anthropic later calls its largest known distillation attempt.
The codebook goes public
Security researchers post findings on Reddit and GitHub describing the timezone/proxy checks and the steganographic markers.
Alibaba's notice
Zhidongxi reports Alibaba’s internal verdict: Claude Code carries “back-door risks” and is added to a high-risk software list.
The ban takes effect
Alibaba staff are cut off from Claude Code fleet-wide; Qoder is recommended as the replacement — the date this piece publishes on.
TODAY06 My read
Nobody comes out of this looking clean, and I don’t think that’s an accident of reporting — it’s the actual shape of the incident. Anthropic built a covert fingerprinting layer into a widely trusted developer tool and didn’t tell anyone, including the users whose machines it was quietly profiling; that’s the kind of decision that erodes trust in every agentic tool, not just Claude Code, regardless of how sympathetic the underlying motive was. And if Anthropic’s numbers are anywhere close to right, 25,000 accounts running 28.8 million exchanges over 45 days against a rival’s agentic capabilities isn’t a gray-area terms-of-service dispute — it’s an industrial-scale extraction attempt, and a covert detector is a predictable response to an adversary that would simply route around a public one.
The part that should worry every developer using any AI coding tool, from either lab, isn’t who’s more at fault. It’s that neither disclosed anything until an outside researcher forced the issue. That’s the actual news: silent fingerprinting on one side and silent scraping at industrial scale on the other, both running for months before either surfaced in public.
What to watch
Does Anthropic publish a real postmortem?
A one-line explanation from an engineer on social media is not a disclosure policy. Watch whether Anthropic publishes what the detection code actually collected, and commits to disclosing any future covert checks up front.
Is the removal independently verifiable?
Anthropic says the code has been pulled. Claude Code’s source is inspectable — watch whether outside researchers confirm the check is actually gone, not just renamed.
Does the ban stay internal, or go national?
Today’s ban covers Alibaba’s own employees. Watch whether Chinese regulators extend anything like it to a broader market restriction, the way they did with earlier foreign-model disputes.
Does another lab admit to the same playbook?
Distillation attempts against frontier labs are widely assumed to be common; covert fingerprinting to catch them may be too. Watch whether this incident makes another lab’s own hidden checks surface next.
- This was written the same day the ban took effect.Details of both companies’ accounts may still be revised, retracted, or contradicted as more reporting lands.
- Sourcing here is aggregated news reporting,not a firsthand read of Alibaba’s internal notice or Anthropic’s source code — quotes are relayed through outlets including Zhidongxi and coverage that cites Thariq Shihipar’s public statement, not independently re-verified against primary documents.
- The distillation numbers — 25,000 accounts, 28.8 million exchanges, 45 days — are Anthropic’s own tally, as reported, not an independently audited figure.
- “Backdoor” is Alibaba’s characterization. Anthropic’s own account describes the same code as fraud detection; this piece uses both terms deliberately, attributed to their source, rather than picking a side in the vocabulary.