A cybersecurity platform operated by China's industry ministry has issued a warning this week after it identified a serious security "backdoor" risk in Anthropic's AI coding tool, Claude Code.
The National Vulnerability Database of China posted a statement on its WeChat account on July 8, reporting that Claude Code contains a built-in monitoring mechanism capable of transmitting sensitive information, including users' geographic location and identity-related identifiers, to remote servers without users' consent.
According to their findings, this applies to Claude Code versions 2.1.91 through 2.1.196. The database advised that organizations and users should immediately review affected systems and either uninstall the impacted versions or upgrade to the latest secure release in which the alleged backdoor code has been removed.
The Chinese agency also urged organizations to tighten controls on external network access for development tools and strengthen traffic monitoring on core business networks to prevent the unauthorized transfer of sensitive data.
China's tech giant Alibaba has already banned employees from using Claude Code at work after the tool drew scrutiny for features that can help identify China-linked users.
Developer Anthropic responded to this stance by arguing that what the Chinese authorities described as a "backdoor" was an experimental anti-abuse mechanism, and that access to Claude was not permitted in China.
By Nazrin Sadigova
