Loading story…
Alibaba has ordered employees to stop using Anthropic’s Claude Code for work and reportedly directed them to remove other Anthropic products, classifying the software as high risk over alleged security vulnerabilities and backdoor concerns. Internal guidance said the ban would take effect on July 10, with staff told to switch to Alibaba’s internal Qoder platform instead. The move followed claims that Claude Code contained concealed environment-detection logic that checked proxy settings and system time zones against lists associated with Chinese companies including Alibaba, Baidu, ByteDance, Ant Group, and Moonshot AI.
The allegations originated from a June 30 Reddit reverse-engineering post that said the logic had been present since Claude Code version 2.1.91 and encoded detection results through subtle changes to internal system prompts rather than explicit telemetry, making monitoring difficult. Anthropic had not publicly confirmed the issue in full, but an engineer reportedly said the mechanism was an experiment aimed at preventing reseller abuse, unauthorized access, and model distillation, and that the code was removed on July 1. The dispute comes amid broader tensions between the companies after Anthropic accused operators linked to Alibaba’s Qwen lab of using fraudulent accounts in a large-scale model distillation effort.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Alibaba reportedly decided to ban Anthropic's Claude Code from internal workplace environments effective July 10, classifying it as high-risk software with security vulnerability and backdoor concerns. Reports said employees were told to remove other Anthropic products and switch to Alibaba's internal Qoder platform instead.
China's National Vulnerability Database warned developers to uninstall or upgrade Claude Code versions 2.1.91 through 2.1.196, alleging they contained backdoor code capable of collecting location and identity data and sending it to remote servers. The notice also advised users to investigate installations and strengthen network monitoring around development tools.
A Reddit reverse-engineering post alleged that Claude Code versions since 2.1.91 silently checked proxy settings and system time zones against lists associated with Chinese companies and AI labs. The reports said the results were encoded through subtle prompt modifications rather than explicit telemetry.
Anthropic engineer Thariq Shihipar said the mechanism was an experiment meant to prevent reseller abuse and model distillation, and that the code was removed on July 1. Another report said a Claude Code team member indicated the mechanism would be removed in an upcoming release.
On June 30, a Reddit user identified as "LegitMichel777" claimed reverse engineering had uncovered covert detection functionality in Claude Code tied to Chinese enterprises including Alibaba, Baidu, ByteDance, and others. The post triggered public allegations that the behavior resembled a backdoor or privacy-risking anti-abuse mechanism.
On 2026-06-30, a reverse-engineering analysis of Claude Code 2.1.196 described undocumented prompt modification behavior that replaced characters in the system prompt with visually similar Unicode markers and altered date separators under certain conditions. The report said the behavior was gated by base URL, timezone, and hostname checks and appeared aimed at users accessing Claude Code through proxies, gateways, or reseller infrastructure.
Anthropic said the Claude Code mechanism that checked timezone and proxy-related signals was introduced in March as an experimental anti-abuse control. The company said it was intended to prevent unauthorized access, redistribution, and model distillation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
14 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetechrepublic.com
Open sourcetomshardware.com
Open sourcetheregister.com
Open sourcetomshardware.com
Open sourcecybersecuritynews.com
Open sourcethereallo.dev
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic accused Alibaba and its **Qwen** research division of illicitly accessing its Claude models in what it called the largest known AI distillation attack against the company. In a letter to the U.S. Senate Banking Committee, Anthropic said operators used nearly **25,000 fraudulent accounts** to generate more than **28.8 million** Claude exchanges between April 22 and June 5, targeting high-value capabilities from the **Mythos Preview** model, including software engineering and agentic reasoning. The company said the activity was designed to replicate frontier-model performance without incurring the full cost of training a competing system. Anthropic warned that adversarial distillation can transfer advanced capabilities while omitting the original model’s safety guardrails, raising both security and national security concerns beyond intellectual property theft. The company linked the alleged operation to a broader pattern involving other Chinese AI labs, including **DeepSeek**, **Moonshot AI**, and **MiniMax**, and called for antitrust-safe threat intelligence sharing, continued AI chip export controls, and penalties for firms found to have improperly used U.S. model outputs. The disclosure has also spurred proposed U.S. legislative action, including potential sanctions or blacklisting of Chinese companies accused of training rival systems on unauthorized American AI outputs.
Jul 12, 2026
Anthropic alleged that three China-based AI labs—**DeepSeek, Moonshot AI, and MiniMax**—used roughly **24,000 fraudulent accounts** to generate more than **16 million interactions** with Claude in a coordinated effort to extract the model’s advanced reasoning, coding, and tool-use capabilities. The company said it linked the activity through IP correlations, request metadata, and infrastructure indicators, and warned that large-scale unauthorized distillation could remove safety guardrails and enable copied capabilities to be used in offensive cyber operations, disinformation, intelligence collection, and mass surveillance. Anthropic said it shared its findings with U.S. government entities and industry partners, while noting it had no evidence that the Chinese government directly coordinated the campaigns. The allegations surfaced as Anthropic remains in a separate high-stakes dispute with the U.S. Department of Defense, which on June 4 refused to reverse the company’s designation as a supply-chain risk. Anthropic is challenging the Pentagon’s March blacklisting after Defense Secretary Pete Hegseth invoked emergency powers following failed talks over limits on Claude’s use for domestic surveillance and autonomous weapons. Federal attorneys told the court the procedural dispute over administrative remedies is now moot because the secretary has denied reconsideration, and reporting indicates a majority of the appellate panel appeared inclined to let the designation stand while the case proceeds.
Jun 29, 2026
**Anthropic** reported detecting “industrial-scale” **distillation** activity targeting its *Claude* models and attributed it to three Chinese AI labs: **DeepSeek, Moonshot, and MiniMax**. Anthropic said the actors used **~24,000 fraudulent accounts** and generated **~16 million exchanges** with Claude, allegedly leveraging proxy/reseller access to evade controls and violate terms of service and regional restrictions. The company characterized the activity as deliberate capability extraction rather than normal customer usage, and paired the disclosure with renewed calls for stronger export controls. Anthropic warned that models produced via illicit distillation may lack safety guardrails and could be repurposed for **national security-relevant misuse**, including **offensive cyber operations**, surveillance, and disinformation. Reporting described tactics including coordinated fake-account networks (“hydra clusters”), proxy services, and prompt patterns aimed at extracting advanced reasoning and other capabilities at scale; one breakdown cited DeepSeek activity at **150,000+ exchanges** and Moonshot at **3.4M+ exchanges**, alongside prompt engineering intended to elicit step-by-step reasoning. Separate coverage on training-data memorization/copyright and a vendor blog on AI-driven crypto fraud discuss broader AI risk trends but do not address Anthropic’s specific distillation allegations.
Jul 16, 2026