China Issued a National Backdoor Alert for Claude Code. The 'Backdoor' Was Anthropic's Own Anti-Piracy Code, Deleted a Week Earlier.

TL;DR

On Wednesday, China's National Vulnerability Database (NVDB), run by the Ministry of Industry and Information Technology, told users to uninstall Claude Code, Anthropic's coding agent, over an alleged backdoor that shipped "geographic location and identity-related identifiers" to remote servers without consent. It flagged versions 2.1.91 through 2.1.196, the releases from April 2 to June 29. Here is the twist: the "backdoor" was real code, but it was not espionage. It was Anthropic's own anti-piracy marker, built to catch resellers and model distillation, and Anthropic had already deleted it on July 1, a full week before the advisory. A government just issued a national security alert for a patch that had already shipped.

What China actually said

The NVDB posted the warning to WeChat on July 8. Its claim: Claude Code contained a mechanism that covertly routed sensitive data, including a user's location and identity-linked identifiers, to outside servers, all without notice or permission. The recommended fix was blunt. Uninstall the affected versions, or upgrade to a release where the code is gone.

There is an awkward detail underneath the alarm. Claude Code is not officially available in China at all. Anthropic's own response noted that the users being told to remove it "were not supposed to be using it in the first place," reaching it through VPNs and third-party proxies against the terms of service. So the advisory is, in effect, a state telling its citizens to stop using a tool they were already not licensed to run.

What the code actually did

Strip the geopolitics and the mechanism is more interesting than the headline. A developer using the handle Thereallo documented it in late June, and The Register laid out the internals. The code used almost-invisible Unicode markers to quietly edit Claude Code's own system prompt, encoding proxy and gateway classifications into what looked like plain English, with the target domain lists hidden behind XOR and base64.

The trigger was mundane. It checked whether you had overridden the base URL environment variable, the flag you set to route Claude Code through a gateway or reseller. If you had, it looked at your system timezone and compared the hostname against an encoded list of known Chinese AI labs, competing AI firms, unauthorized resellers, and gateway domains. Think of it as invisible ink slipped into the margins of the instruction sheet, readable only by the tool, whispering "this one looks like a competitor."

Two things are worth keeping straight. It classified how you were connecting, not what you were building. It did not read your source files or exfiltrate your repo. But the concealment is the part that stings for a developer tool. As Thereallo put it, hiding this from users is the wrong move for something "that asks for trust." China's framing (a data-stealing backdoor) is a stretch. The honest description (a covert marker your own coding agent wrote into its prompt without telling you) is bad enough on its own.

The timeline is the whole story

Anthropic engineer Thariq Shihipar owned the code publicly the day it surfaced. His account: it was "an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation," the team had since built stronger mitigations, and they had "been meaning to take this down for a while." The pull request was merged, and the rollback shipped in the July 1 release.

China's advisory landed on July 8. That is the punchline. The NVDB flagged versions ending at 2.1.196, but the marker was already gone from current builds a week before the warning went out. Issuing a national vulnerability advisory for a patch that already shipped is a bit like the fire department posting a burn notice for a candle you blew out last Tuesday.

Why the code existed at all

None of this is random. Anthropic has spent 2026 fighting model distillation, the practice of training a cheaper model on a frontier model's outputs by hammering it with queries. In a June 10 letter to the US Senate Banking Committee, the company accused operators affiliated with Alibaba's Qwen lab of running the largest known distillation campaign against Claude, using roughly 25,000 fraudulent accounts. The hidden marker was one of several anti-distillation defenses it began rolling out earlier in the year.

So the mechanism China's government just branded a backdoor was aimed squarely at Chinese labs and resellers, the same ecosystem that government protects. Alibaba, for its part, had already banned Claude Code internally and told staff to switch to its own coding tool. This is not really a security disclosure. It is one more shot in a distillation cold war, this time fired from a national vulnerability database.

What builders should take from it

Forget who is right. The durable lesson is about trust in the tools you hand your credentials and your codebase. An agent that silently rewrites its own system prompt based on hidden signals is a governance problem even when the intent is benign, because you cannot audit what you cannot see. The fix for a reseller problem should not be steganography in a product developers run with write access to their repos.

Practically: geopolitics is now an input to your toolchain, not a distant abstraction. Pin versions, read changelogs, and know what your agent phones home. And if you happen to be running Claude Code somewhere in the 2.1.91 to 2.1.196 band, update anyway. The marker is gone in current builds, and staying current is the cheapest security control you have.

Key Takeaways

• China's National Vulnerability Database issued a July 8 advisory urging users to uninstall Claude Code versions 2.1.91 through 2.1.196, alleging a backdoor that shipped location and identity data to remote servers.
• The code was real but was Anthropic's own anti-piracy marker, not espionage: it classified how you connected (base URL override, timezone, hostname), not what you built, and hid the check in the system prompt via XOR and base64.
• Anthropic engineer Thariq Shihipar owned it as a March anti-distillation experiment and shipped the removal on July 1, a week before China's warning landed.
• It traces back to Anthropic's distillation fight with Alibaba's Qwen lab (the alleged 25,000-account campaign), so the flagged mechanism targeted the very labs China's advisory defends.
• The builder takeaway is trust and auditability: a coding agent that covertly mutates its own prompt is a governance smell regardless of intent, and version hygiene is your cheapest defense.

Sources: The Register (mechanism internals and removal), CBS News (NVDB warning, Shihipar statement), South China Morning Post (Anthropic response, version range), Yahoo/Quartz (advisory details).