Alibaba plans to prohibit Claude Code due to concerns over a potential backdoor risk, according to a source.

      Starting July 10, Alibaba will prohibit its employees from using Anthropic's Claude Code within workplace environments, following accusations from Anthropic that operators affiliated with Alibaba’s Qwen lab launched the largest known distillation effort against Claude. According to a source mentioned by Reuters, the ban relates to an alleged backdoor embedded in the coding tool, although Alibaba has not publicly confirmed this decision and did not immediately provide a comment upon request.

      The initial report of the ban came from the Chinese financial publication Yicai before Reuters verified it through its own source. This development occurs at a time of heightened tension between Anthropic and Alibaba, with both AI divisions trading accusations of misconduct over purported model theft and an alleged espionage mechanism integrated into Claude's tool.

      Claude Code is Anthropic's command-line coding agent that allows developers to write and debug software via a terminal instead of a chat window. It has quickly become one of the company's most rapidly growing enterprise products, making a workplace-wide ban at a large company like Alibaba significant.

      The accusations concerning the alleged backdoor stem from a Reddit post dated June 30 by a user named LegitMichel777, who claimed to have reverse-engineered Claude Code while trying to restore a disabled remote-control feature. A technical explanation shared with the post, later summarized by outlets such as CyberSecurity News and Tech Times, indicated that the coding assistant had been covertly checking since version 2.1.91, released on April 2, if a user’s proxy configuration or system timezone matched entries on two concealed lists.

      One list reportedly included Chinese corporate networks, cloud regions, and AI labs, mentioning Alibaba, Baidu, ByteDance, and Moonshot AI. If a match occurred, the tool allegedly modified the date format and changed a punctuation character in its own system prompt to log the detection without sending a direct telemetry signal.

      Anthropic has not made a formal public statement regarding the allegation. A member of the Claude Code team, Thariq, is reported to have responded on social media, claiming that the mechanism was designed to prevent account reselling and model distillation and that it would be removed in the next update, which The Register and others noted was already in progress by July 1. This timeline suggests the mechanism was operational for approximately three months before its anticipated removal.

      These events are not happening in isolation. In a letter to US senators dated June 10, Anthropic accused individuals associated with Alibaba’s Qwen AI lab of operating nearly 25,000 fraudulent accounts to extract software engineering and reasoning functionalities from Claude, resulting in more than 28.8 million interactions between April 22 and June 5. Previous reports indicated that this campaign surpassed the scale of three earlier distillation activities that Anthropic had already reported to Washington, linking them to DeepSeek, Moonshot, and MiniMax. Alibaba has not publicly addressed this accusation either.

      This conflict occurs within a larger trend of tech companies instituting restrictions on coding agents due to concerns about distillation, as well as Anthropic tightening access for Chinese users through platforms like Claude Opus and Fable model limitations. The nature of the alleged backdoor—whether it acted as a targeted espionage tool or a broad anti-fraud filter affecting regular Chinese developers—remains debated, and no independent security organization has released a comprehensive audit of the claims.

      If Alibaba's ban is implemented as described on July 10, it would be one of the first prominent companies to formally limit Claude Code specifically due to the alleged mechanism rather than competitive or financial issues. Developers in China who depend on proxy routing to access the tool would be particularly vulnerable if the detection functioned as described by the researcher. Reuters indicated that its report relied on a single source, and Alibaba had not responded by the time of publication. Anthropic was also not directly quoted in the Reuters report, leaving the positions of both companies somewhat unclear as the July 10 deadline approaches.