The Claude Code affair — hidden trackers, state advisories, and a trust breach that redraws the AI supply chain

TL;DR

• China's National Vulnerability Database (NVDB), affiliated with the Ministry of Industry and Information Technology, issued a formal "security backdoor" advisory on 8 July 2026 against Anthropic's Claude Code versions 2.1.91–2.1.196 (released 2 April – 29 June). Latest version as of Wednesday is 2.1.204.
• The trigger: a researcher operating as "Thereallo" found hidden instructions in Claude Code's system prompt using prompt steganography to flag users by timezone, proxy signature, and other markers correlating with Chinese AI labs. Anthropic engineer Thariq Shihipar confirmed on X the tracker was added as an "experiment" in March 2026.
• Alibaba banned Claude Code internally effective 10 July, classifying it as high-risk software and pushing employees to its in-house Qoder tool. The ban follows Anthropic's earlier public accusation that Alibaba (alongside DeepSeek, Moonshot, and MiniMax) attempted to distil Claude's capabilities.
• Mirror image, same week: Reuters reports CISA is using Anthropic's Mythos model to audit US government code. The same vendor is a national-security tool in Washington and a national-security threat in Beijing.
• Anthropic has removed the tracker. That is not enough. The trust breach travels; the geopolitical framing is now set.

What actually happened

Start with the technical fact, because everything downstream flows from it.

Sometime around March 2026, an engineer at Anthropic added instructions to Claude Code's system prompt — the invisible scaffolding the model reads before every user interaction — that told the model to look for specific signals when a user connected: system timezone, proxy configuration, and other telltale markers of a user routing traffic through servers commonly associated with Chinese AI research labs. When those markers fired, Claude Code quietly annotated the session and reported back to Anthropic's servers.

The mechanism is called prompt steganography — hiding operational instructions inside otherwise-innocuous prompt text. It is a real technique. It works. It is also, in this case, exactly the kind of thing Anthropic has spent three years telling regulators, journalists, and the public that it would never do.

The researcher known as "Thereallo" surfaced the tracker in a technical write-up around 6 July. Ars Technica and Futurism picked it up within 24 hours. Anthropic engineer Thariq Shihipar responded on X, confirming the tracker existed and describing it as an "experiment." Anthropic removed the code shortly afterwards.

Two days later, on 8 July, the Chinese NVDB — which sits inside the MIIT — issued its advisory. The wording is deliberate. It calls the affected versions a "security backdoor" and instructs Chinese users to uninstall or upgrade. The affected range is 2.1.91 through 2.1.196, covering releases from 2 April to 29 June. Current version 2.1.204 is outside the flagged range.

The same week, Reuters reported that CISA is deploying Anthropic's Mythos model to audit US federal government code. Read those two sentences together. That is the story.

The changelog view

Because this is partly a security advisory, treat it like one.

Where "backdoor" is and isn't the right word. A traditional backdoor is remote code execution, an undocumented auth path, or a lateral-movement vector. This is not that. What it is is undisclosed identification telemetry embedded in a developer tool used to write source code. For any user whose codebase is sensitive — and for developer tooling that is essentially the whole population — that distinction matters less than it sounds like it should. Data left the machine, went to a vendor, without informed consent, targeted at a specific national origin. Whether you call it a backdoor, spyware, or an over-eager anti-abuse experiment depends on where you sit. Beijing has chosen its word. Enterprises need to choose theirs.

Why Anthropic did it (the honest version)

The industry context is genuine, and the piece is weaker if we skip it.

Earlier in 2026, Anthropic publicly accused DeepSeek, Moonshot, MiniMax, and Alibaba of running distillation attacks — using Claude's outputs to train competing models, in violation of Anthropic's terms. Separately, Washington Post reporting exposed a grey market of Chinese resellers offering Pro Claude subscriptions for ~US$12/month against Anthropic's US$100+ list price, using stolen or shared credentials.

From inside Anthropic, the tracker looks like an anti-abuse instrument: identify traffic that correlates with the labs it has publicly accused, flag it, gather evidence, protect the model weights that are the company's only real moat.

From outside, it looks like something else. It looks like a frontier lab deciding, unilaterally and secretly, to run nationality-based user identification inside a tool that developers have integrated into their editors, their CI pipelines, and their production codebases. If you are a Chinese developer working on a European client's project through a US VPN, this system was — at least in principle — attempting to figure out who you were. That is not a defensible posture, and Anthropic's own trust-and-safety writing from 2024 would have said so.

Both readings can be true simultaneously. That's why this is a trust breach, not merely a CVE.

What Beijing is actually doing

The MIIT advisory is a piece of statecraft as much as a piece of cybersecurity work.

The NVDB is a real institution and its advisories are technically substantive; it is not the Chinese equivalent of a press release. But its choice to issue this advisory on this product, on this timeline, is unambiguously geopolitical. Read the sequence:

1. 3 July — Alibaba bans Claude Code internally, effective 10 July, pushing employees to Qoder.
2. 6–7 July — "Thereallo" exposes the tracker; Anthropic engineer confirms; Anthropic removes it.
3. 8 July — NVDB issues formal advisory; state media amplifies.
4. Same week — CISA confirms deployment of Anthropic's Mythos model for US government code audit.

The Chinese state is doing something specific here: it is establishing that it, too, can issue CVE-style advisories against Western AI tools, that it can do so with technical substance, and that its industrial policy on AI now includes formal vulnerability disclosure as a lever. That is new. Until this week, the CVE-and-advisory apparatus has been a Western monopoly in AI. It is not anymore.

Cross-layer implications

Supply chain. Every enterprise procurement team with Claude Code in their toolchain now has an unhappy conversation to have. Not because the specific tracker is still active — it isn't — but because trust in the vendor's disclosure hygiene is now measurably lower than it was on Monday. That will affect contract terms, DPIA scope, and residual-risk registers, particularly in EU jurisdictions.

EU AI Act. Article 10 (data governance) and Article 13 (transparency obligations) both plausibly bite here. Undisclosed telemetry targeting users based on national-origin proxies is exactly the kind of thing the AI Office was designed to notice. Watch for an information request within four to six weeks.

Distillation defence. If frontier labs cannot legally or reputationally deploy user-identification instrumentation, they need a different anti-distillation strategy. Watermarking outputs, rate-limiting suspicious usage patterns, and legal action are the alternatives — all slower, all less effective. Expect a wave of quiet infrastructure work on output-side defences.

The mirror. OpenAI shipped GPT-5.6 to broad release this same week after Center for AI Standards and Innovation (CAISI) testing. Musk's SpaceXAI shipped Grok 4.5 (Cursor-integrated, not yet available in the EU). The Anthropic story does not stop those releases — but it changes how every non-US enterprise reads the fine print on all of them. If Anthropic did this, the reasonable prior on the next lab doing something similar is no longer zero.

Talent market. Anthropic's brand is "the safety lab." That brand is expensive to build and cheap to spend. Recruiting into safety and policy roles just got harder. Expect at least one senior departure with a pointed post about it inside 30 days.

Who benefits from the noise

• Chinese domestic AI stack (Qoder, Alibaba Cloud Qwen tooling, DeepSeek-Coder, Moonshot): Enormous. This is the best marketing they have received in a year, and it came from Anthropic itself.
• Google (Gemini Code Assist), open-weight models (Qwen 3, DeepSeek V4, Kimi K2): Modest tailwind. Any enterprise re-opening its coding-assistant RFP includes these now.
• OpenAI: Neutral-positive on the surface (they are not the story), quietly negative on structural read (any user-identification revelation elsewhere in the industry lands harder now).
• CISA and US federal buyers: They have to defend the Mythos deployment on the same day their vendor is being called a national-security threat by Beijing. Politically awkward, but the deployment is unlikely to reverse.
• Chinese state: Large win. Established a new instrument (state CVE advisory against Western AI), demonstrated technical capacity, and reframed a defensive posture as a rules-based response.

Recommendations — for practitioners and enterprise buyers using Claude Code

This section is addressed to the piece's natural audience: engineering leaders, security teams, procurement, and data-protection officers running AI coding tools in production. It is not addressed to any single organisation.

Immediate (this week):

1. Inventory Claude Code versions across your fleet. Anything in the 2.1.91–2.1.196 range should be upgraded to ≥ 2.1.197 — ideally straight to current (2.1.204) — before the weekend. This is a low-effort patch; the harder work is knowing where it is installed.
2. Log a security event, not just a version bump. Your SIEM and your risk register should both reflect that undisclosed vendor telemetry was present during a defined window. That matters for any downstream incident response.
3. DPO notification if you operate in the EU/UK. The tracker collected user-identification signals without disclosed lawful basis. Even absent a formal complaint, document the exposure and preserve logs.

Short-term (30 days):

4. Update your AI-tooling procurement checklist to require a signed vendor attestation on prompt-level telemetry and user-classification instrumentation. This is now a category of risk, not an edge case.
5. Reopen your coding-assistant RFP if your evaluation was more than six months old. The competitive set — Gemini Code Assist, Copilot with GPT-5.6 backing, Cursor (now inside SpaceXAI/Grok), Qwen-Coder, DeepSeek-Coder — has shifted meaningfully.
6. For teams with China exposure (offices, contractors, joint ventures): treat Claude Code use as a specific policy question, not a general one. Alibaba's classification is a signal about what regulator posture toward your operations may look like.

Structural (this quarter):

7. Assume this is not the last incident of its kind. Build a policy for "vendor A/B fallback" on your critical AI tooling — not because Anthropic is uniquely untrustworthy, but because the industry norm on hidden telemetry is now visibly unsettled.

For an individual developer using Claude Code personally: upgrade past 2.1.196, and if you use a VPN or work from a Chinese timezone, understand that during April–June 2026 your session metadata was flagged and transmitted. There is no realistic remediation for you personally beyond the upgrade and awareness.

Uncertainty ledger

• Intent. Anthropic has not published a full post-mortem. Whether the tracker's design was scoped narrowly to distillation-attack signals or captured broader user data is not fully known. A credible post-mortem would materially reshape the story.
• Technical scope. The public analysis by "Thereallo" is detailed but has not been independently reproduced end-to-end. Anthropic engineer confirmation covers existence, not scope.
• NVDB accuracy. MIIT's advisory is politically loaded but technically anchored. Whether it materially overstates the risk (calling telemetry a "backdoor") is a matter of framing, not fact.
• CISA reaction. No public statement yet on whether the Mythos deployment includes any equivalent instrumentation or whether US government contracts include disclosure clauses that would prevent it.
• Regulatory response. No formal EU AI Office action yet. Expect one; don't assume one.

Bottom line

A US frontier lab embedded user-identification steganography inside a developer tool, got caught by a lone researcher, and had a Chinese state agency respond with a CVE-style advisory before the tracker had been publicly removed for 48 hours. That sequence — not the tracker itself, not the advisory itself — is the actual news. It tells you that the AI supply chain is now a national-security surface for both governments, that the norm against covert vendor telemetry inside frontier tools is contested, and that trust in frontier-lab disclosure hygiene has to be re-priced. Patch to 2.1.197 or later this week. Re-price the vendors this quarter.

Sources

• Tier 1 — Reuters, "China issues 'backdoor' security alert over Anthropic's Claude Code" (8 Jul 2026); Reuters, "Alibaba to ban employees from using Anthropic's coding tool" (3 Jul 2026); Reuters (exclusive), "US cyber agency is using Anthropic's Mythos to audit government code" (7 Jul 2026); CNBC, "China warns about AI risks with Anthropic's Claude Code" (8 Jul 2026); CBS News, "China warns of 'security backdoor' in Anthropic AI coding tool" (8 Jul 2026).
• Tier 2 — Ars Technica, "Secret Claude tracker shocks users after Anthropic's anti-surveillance stance" (6 Jul 2026); South China Morning Post, "Alibaba bans staff from using Claude Code over Anthropic spyware concerns" (Jul 2026); Futurism, "Anthropic Caught Secretly Spying on Users" (7 Jul 2026).
• Tier 3 — GIGAZINE (Alibaba internal notice reporting, 4 Jul 2026); Zamin.uz (Alibaba/Qoder framing, 4 Jul 2026); X posts by Anthropic engineer Thariq Shihipar (primary confirmation).