Several versions of the US coding tool contain a backdoor transmitting users’ location and identity data without consent, the National Vulnerability Database claims
China has accused Anthropic’s AI coding tool Claude Code of containing “security backdoor vulnerabilities” capable of transmitting sensitive user information without consent, warning the mechanism poses a “serious security risk.”
Claude Code, developed by the US startup with close ties to the Pentagon, is an AI-powered coding assistant that helps developers write, edit, debug, and understand code using natural-language prompts. Because it runs inside a developer’s terminal rather than a browser, it can access source code and other files the user chooses to share, making any unauthorized data transmission particularly sensitive for businesses and governments alike.
In a risk advisory issued on Wednesday, the Chinese Ministry of Industry and Information Technology’s (MIIT) cybersecurity threat platform NVDB said it had identified a potential security risk in several recent Claude Code versions. According to NVDB, they contain a “built-in monitoring mechanism” that automatically transmits users’ geographic location, identity identifiers, and other sensitive data to remote servers without consent.
The MIIT described the alleged mechanism as a potentially malicious feature that could pose privacy, security, and intellectual property risks, as AI coding assistants are often used on proprietary software and other sensitive codebases. It urged users to review affected systems, uninstall the vulnerable versions, or upgrade to a release with the alleged backdoor removed. The ministry also called for tighter controls on outbound network access for development tools and stronger traffic monitoring to prevent unauthorized data transmission, signaling that Beijing may push for broader regulatory scrutiny of foreign AI coding tools operating within its digital ecosystem.
Anthropic has not publicly responded to the advisory, though the underlying issue had already surfaced in developer circles days earlier.
China’s relationship with Anthropic has been contentious for months. While the company prohibits Chinese firms and their foreign affiliates from using Claude under regional and national security restrictions, reports say Chinese researchers and engineers continue to access it via overseas proxies. Since February, Anthropic has accused Alibaba and several other Chinese AI labs of illegally “distilling” its models to train competing systems, a dispute that has fueled mutual distrust between the company and Chinese regulators.
The advisory followed claims posted on Reddit last week that Anthropic had secretly “embedded spyware in Claude Code” to identify users illegally accessing the service from China. The claims quickly circulated among developers and security researchers, prompting an unusually direct public response from within Anthropic itself.
Anthropic employee Thariq responded on X that the code was part of an “experiment” launched in March “to prevent account abuse from unauthorized resellers and protect against distillation,” stating that the team had since implemented “stronger mitigations” and had been “meaning to take this down for a while.” He added that the mechanism was merged into the codebase and would be removed in the company’s July 2 release, effectively confirming that the monitoring feature existed, even as he framed it as an anti-abuse measure rather than a deliberate surveillance tool.
That explanation has done little to quiet scrutiny of Anthropic, which has faced repeated controversy in the US as well. While the company has highlighted safeguards around its AI – recently withholding its Claude Mythos model over fears it could expose critical software vulnerabilities and resisting Pentagon requests to relax restrictions on surveillance and autonomous weapons – its technology has reportedly been integrated into Palantir’s analysis and surveillance software used by US government agencies.
During the US war on Iran, the software reportedly identified an elementary school in Minab as a target. A subsequent US strike killed nearly 160 people, but Anthropic CEO Dario Amodei argued that the use of Claude did not violate the company’s “red lines,” claiming “a human made that final call.”
The latest backdoor allegations add to a growing list of concerns about how widely used AI coding and analysis tools handle sensitive data, and whether built-in monitoring features designed for anti-abuse purposes could be repurposed – intentionally or not – for broader surveillance. With both Chinese regulators and international developers now raising red flags, Anthropic is likely to face continued pressure to clarify exactly what data its tools collect, where it is sent, and who ultimately has access to it.