It’s not every day that two tech giants accuse each other of spying. But that’s exactly what just happened between Anthropic and Alibaba — with Claude Code caught in the middle.
What happened
On July 3, Alibaba issued an internal directive: starting July 10, Claude Code is banned for all employees. The company classified the tool as ‘high-risk software with security vulnerabilities’ and recommended employees use Qoder, Alibaba’s own coding agent, instead.
The trigger? On June 30, a Reddit user named LegitMichel777 reverse-engineered Claude Code and found hidden detection code. Since version 2.1.91, released in April, Claude Code had been silently checking whether users were located in China, routing through a Chinese proxy, or connected to a Chinese AI lab.
How the tracking code worked
The mechanics were clever. When Claude Code detected a modified base URL (common for proxy users), it ran a cascade of checks: system timezone, hostname matched against a list of known Chinese AI labs, then encoded the result as a subtle signal in the system prompt — specifically, a slightly different apostrophe character in the phrase ‘Today’s date is’. The domain list was hidden behind XOR and Base64 encoding.
Thariq Shihipar, an engineer on the Claude Code team, confirmed on X that it was ‘an experiment from March’ meant to detect unauthorized resellers and protect against distillation. The pull request to remove the code was merged on July 1.
The other side of the story
Anthropic wasn’t being paranoid without reason. In a letter to the US Senate on June 10, the company accused operators affiliated with Alibaba’s Qwen AI lab of running the ‘largest known distillation attack’ on Claude — using roughly 25,000 fraudulent accounts to generate 28.8 million queries between April and June.
The Financial Times also reported on July 3 that Chinese companies had been using creative workarounds: Ant Financial gave employees corporate Claude accounts through Singapore subsidiaries. ByteDance reimbursed engineers for personal Claude subscriptions accessed via VPN.
Why this matters
This story shows how deeply political AI tools have become. It’s no longer just about features and benchmarks. It’s about trust, national security, and who gets to train what with whose models.
For developers outside this geopolitical tension, there’s an uncomfortable takeaway: your coding tool can contain code you don’t know about. Anthropic removed the tracking code — but it was active for three months without a single mention in the release notes.
Sources: