Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

https://www.reuters.com/world/china/alibaba-ban-claude-code-workplace-over-alleged-backdoor-risks-source-says-2026-07-03/

by nsoonhui • 20 days ago

336 244 20 days ago

reuters.com

yanhangyhy• 20 days ago

i gonna ask: how can they still use claude? i thought all users in china are banned

josh-wrale• 20 days ago

Cc can be used with non Anthropic models.

re-thc• 20 days ago

how can they still use claude?

Workarounds aside, it says Claude Code not Claude.

i.e. they are using the CLI running any model. You can for instance run GLM with it.

playnuu9• 20 days ago

There is a reason Singapore tops the rank on Claude usage

byzantinegene• 20 days ago

the government also actively promotes AI usage in work environments

chinathrow• 19 days ago

Source?

bravetraveler• 20 days ago

Same way every ban is evaded, smurfing

_flux• 20 days ago

Does Alibaba only have developers in the China?

one33seven• 20 days ago

Did china invent VPNs yet?

dgellow2• 20 days ago

Alibaba has engineers in Hongkong, Singapore, North America. It’s a global corporation

itake• 20 days ago

when i was in hongkong, chatgpt and gemini were disabled. Maybe this has changed though. When I was in China, the corporate vpn (zscaler) routed traffic through hk

dist-epoch• 20 days ago

The same way they buy "banned" and "sanctioned" NVIDIA GPUs.

xyzsparetimexyz• 20 days ago

https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...

TZubiri5• 19 days ago

one possibility:

iproyal.com Oxylabs.io

https://krebsonsecurity.com/2025/10/aisuru-botnet-shifts-fro...

rvnx3• 20 days ago

Can't say they are wrong, after the latest backdoor, or let's say, undocumented functionality that leaks some data that was pushed in Claude Code few days ago

https://news.ycombinator.com/item?id=48759754

dgellow2• 20 days ago

That’s not what a backdoor is…

rvnx3• 20 days ago

When a company can remotely push code without explicit user approval, and code that was hostile / almost malicious, it is a backdoor

tpoacher• 20 days ago

Rear entrance then

SubiculumCode4• 19 days ago

I think most websites transmit general locationbto the server.

eunos• 20 days ago

What Claude Code did is absolutely mindboggling tho, if Chinese harness did that probably POTUS would lose sleep.

cognitiveinline• 20 days ago

Exaggerate much? If you think POTUS would lose sleep about a date format timezone marker, I don't know what to tell you.

yard2010• 20 days ago

Wait what do you mean "if"?

youre-wrong34• 20 days ago

Maybe if they didn’t farm all the data from Claude to train their own trash models. Anthropic wouldn’t feel the need to do it.

vrganj9• 20 days ago

Anthropic stole the entire internet. Excuse my language, but they can fuck right off.

InsideOutSanta• 20 days ago

Who is "they", and which Chinese models are trash?

BoxOfRain• 19 days ago

Bit rich given where Anthropic sourced the data to train Claude with. What's good for the goose is good for the gander.

usef-4• 20 days ago

It seemed pretty mild compared to what's collected by modern websites and apps, though? How many don't know your Timezone?

dijit2• 20 days ago

How many don't know your Timezone?

The timezone fetch was to alter program behaviour at runtime, not to send arbitrary timezones for tracking reasons.

It was one way of detecting if it was a chinese person using the program and then behaving differently.

Malware behaves this way. STUXNET for example was wired to do nothing except propagate unless the environment had the right conditions.

rvz• 20 days ago

Another reason to use open source coding agents and local language models.

Claude Code is neither and it is literally info stealing malware.

feverzsj• 20 days ago

Considering their massive distillation, if US companies stop publishing new models to the public, would China still be able to develop new open weight models?

tristanj• 20 days ago

Yes, 100%. GLM 5.2 is capable of RSI. It's too late to stop.

bel8• 20 days ago

I don't think China would strugle to scrape the internet for fresh data.

And they constantly publish state of the art LLM research (see DS4 context compaction and cache tech).

They have very capable tech giants. So while not being able to distill western models would probably have some impact, it's probably becoming lesser as time passes.

We might even see Western LLMs distilling Chinese models soon. If they aren't already to some extent.

hnfong3• 19 days ago

Everyone distills/copies training data.

A couple months ago when Anthropic was complaining about Chinese distillation, people found that Claude self-identified as "DeepSeek" when asked in Chinese:

https://x.com/stevibe/status/2026227392076018101

It's really a fiasco of massive hypocrisy at this point.

margorczynski• 20 days ago

China has most probably already achieved "escape velocity" on the software side. Now if they achieve parity, to some degree at least, on the hardware side with Nvidia it is very possible they'll overtake the US.

surgical_fire• 20 days ago

Probably yes.

More than a year ago, when Anthropic and OpenAI started to hide the reasoning bits from the output, a lot of people here on HN predicted that Chinese models days were numbered.

Fast forward to today, and models such as DeepSeek and MiMo are nothing short of excellent. I haven't used GLM or Qwen but heard very good things about them as well.

This "massive distillation" sounds a lot like anxiety about how companies from outside the US can develop very good models themselves.

VortexLain2• 19 days ago

In my personal, subjective opinion GLM-5.2 is on par with GPT-5.3

pjmlp• 20 days ago

Of course, it is like any other kind of weapon system, eventually the knowledge gets acquired.

VortexLain2• 19 days ago

Depends on a lab, but they do have plenty of compute and engineering. So this would only slow down the progress.

bdcravens• 19 days ago

Look at all of the software that has been developed as an alternative (and often an upgrade to) software in the west. (Baidu, Wechat, etc)

Many of the top AI researchers at western companies are from China, and many are returning.

realusername2• 19 days ago

It doesn't matter, the only models getting compared are the public ones.

If Anthropic had a super secret model that nobody has access to, I'm not sure why I should care about it since I can't access it.

p0w3n3d• 20 days ago

[flagged]

short_sells_poo• 20 days ago

The corollary is that there are no morals once the stakes are in the $ billions, let alone hundreds of billions.

This isn't even about a single person or personality. Very few people in such position could stand fast by their moral code. In any case, an environment that favors profit above everything will naturally select for individuals who are unencumbered by such hindrances.

There might've been 100s of Altmans and Amodeis who had a strong moral code but we don't know about them because they dropped out of the "race" because of said moral hurdles.

rlpb• 20 days ago

I think appropriate attribution is a moral code, but I am not able to attribute every idea I have to all those who helped me develop the general intelligence that I use to develop such ideas.

spinningslate• 19 days ago

an environment that favors profit above everything will naturally select for individuals who are unencumbered by such hindrances.

Exactly. Dairy farms optimise for milk production so favour cows that produce the most milk.

The market economy optimises for profit so favours those most willing/able to generate it. Zuckerberg, Musk, Thiel, Andreesen and co are products of the system.

rkachowski• 19 days ago

The corollary is that there are no morals once the stakes are in the $ billions, let alone hundreds of billions.

terrifying

matheusmoreira8• 20 days ago

Remember how Kim Dotcom got destroyed for criminal copyright infringement? One would think the big tech CEOs would face the same fate, that police officers would rappel down helicopters, storm their mansions and bring them out in cuffs.

Instead the AI companies reached these absurd settlements with publishers that made a mockery out of all the previous copyright enforcement victims.

xienze2• 19 days ago

Remember how people used to justify their own personal software piracy with arguments like "information wants to be free", "no one stole anything, you still have the data", "I was never going to buy it anyway", and "copyright should be abolished?"

Instead the AI companies reached these absurd settlements with publishers that made a mockery out of all the previous copyright enforcement victims.

Isn't that at least something? How many people pirating software ever settled with the companies they "victimized?"

vlovich1234• 19 days ago

Reminds me, did the AI companies redistribute that copyrighted material to others and make their money that way? Did Kim use the copyrighted material to generate something novel from it?

copyright law literally says something isn’t infringement if it is a novel transformation. I get the jokes and criticism about AI companies fighting and complaining about competitors distilling, but this is a much weirder comparison.

root-parent2• 19 days ago

Remember Aaron Swartz who did something that just pales compared to what Dario Amodei, Zuckerberg-Mr-Torrent and Sam Altman did.

codedokode4• 19 days ago

Exactly. If a rich corporation downloads and uses pirated content without paying, why should ordinary person pay for movies and music instead of downloading them for free?

Simulacra2• 19 days ago

He just lost another court case… I wonder if we're getting close to the government spending as much to prosecute the man than what Hollywood possibly lost..

datsci_est_2015• 19 days ago

The trick here, imo, was the integration with the military industrial complex. It wasn’t very difficult of course, as automation has been a topic in warfare for decades, if not centuries.

But Eisenhower was right:

In the councils of government, we must guard against the acquisition of unwarranted influence, whether sought or unsought, by the military-industrial complex. The potential for the disastrous rise of misplaced power exists and will persist.

TZubiri5• 19 days ago

I never get tired of posting this answer because everyone on the internet is adopting this hot take:

If you look at it with your eyes crossed, Anthropic and the chinese are doing the same thing.

If you look at it with nuance 1 the chinese are doing way worse stuff, and 2 stealing from a thief would still be stealing

1. The chinese are making multiple accounts (at least 49,000)[1][2], using proxies/VPNs, possibly using residential computers and infected computers (unless you think the chinese are doing due diligence to ensure their purchased IPs are kosher). All accounts need to be created with a real name, and especially so if the paid models need to be accessed and paid with a credit card. So this is beyond IP theft and getting closer to fraud. These are all techniques that are well studied because they are used by criminals and cybercriminals, textbook stuff. Consider if that was not sufficient, that China is banned from using the product, so they need to use identities and locations not just to avoid relating the accounts between themselves, but merely to allow account creation. What identities are they using to create accounts.

Compare this to Anthropic which reads notes made a deal in an IP theft case paying billions because they bought books and scanned them but buying the books wasn't sufficient retribution for the authors. Or that they gasp scanned the internet, like Google.

Not having nuance to see the difference between the two companies is something I expect of the twitter echo chamber copying hot takes for upvotes, not hacker news.

[1] https://arstechnica.com/tech-policy/2026/06/anthropic-claims... [2] https://www.anthropic.com/news/detecting-and-preventing-dist...

bildung• 19 days ago

What seems to be missing from that take is that a) Alibaba paid for the access b) there is no IP theft because LLM output is not copyrightable.

Anthropic seems to want to both own and eat its stolen cake.

codedokode4• 19 days ago

First, LLM is merely a tool and its output belong to whoever generated them. If a Chinese researcher used their creativity to generate a response, the copyright belongs to them and AI companies have no rights to it. Second, Chinese release many of their models for free, thus being on a noble mission to make AI available for every country (unlike certain company whose promises were nothing but words). For comparison, US companies do not release anything and want to keep AI for themselves and decide who gets to use it.

stealing from a thief would still be stealing

Stealing from a thief hurts thief industry which is a win for society.

The chinese are making multiple accounts

Not a crime. AI companies also ignore robots.txt and applicable laws when illegally copying copyrighted material from websites to their servers without author permission.

xpct2• 19 days ago

Let's not sane-wash Anthropic's book theft. No, they didn't just 'scan' the internet, they created a tool for worldwide license washing and got fined an insignificant amount for it.

yubblegum• 19 days ago

Whatever happened to honor among theives? What is this world coming to..

jdw64• 20 days ago

I got curious and asked my Chinese friends, and they gave me a Reddit link[1]. It looks like it's about location data collection, and they suggested that might be the reason for the issue.

[1]https://www.reddit.com/r/ClaudeAI/comments/1ujila1/anthropic...

swingboy• 19 days ago

There was a big thread about it here the other day. https://news.ycombinator.com/item?id=48734373

SubiculumCode4• 19 days ago

Wow and very websote on earth practically, collects locationvdata

bhouston2• 20 days ago

All remote AI are a massive security risk for individuals/companies/governments that may be targeted by the US government.

It is likely that the US will get a live feed from each AI provider that they are inspecting in real time to identity things of interest, terrorist attacks or foreign government planning or even foreign companies competitive to key US companies.

It will give them access to the though process in those companies as well as much of their text-based IP (source code, docs, meeting transcripts, etc)

Also if you are using local AI that you didn’t train yourself you can never be sure it doesn’t have purposeful biases in its reasoning that may disadvantage you - such as directing you away from certain plans or ideas or patents etc.

general1465• 20 days ago

Leakage of IP and training on your data is something what I am pointing out too, but people will turn around and try to smooth me down that TOS does not allow that if you are an enterprise client. Are you really going to believe that AI companies won't ignore TOS, when they were ignoring literal laws which sent others to jail in the past? Especially when more data = better model?

londons_explore2• 20 days ago

It is worth thinking about the fact the total throughput of even a big LLM provider isn't many megabits.

If a token compresses to around a byte, worldwide AI input and output is around 1 gigabyte per second.

For any intelligence agency, they can afford to keep and store all of that forever, and later do analysis on it.

bhouston2• 19 days ago

For any intelligence agency, they can afford to keep and store all of that forever, and later do analysis on it.

At the scale the AI companies are operating at, I think it isn't likely that they are sucking it all in right now.

More likely I think the intelligence agencies will get a real-time live tap into the raw data feed which they will process onsite for interesting things and then if things are flagged, they will log it in the intelligence agency systems.

WarmWash3• 19 days ago

It is likely that the US will get a live feed from each AI provider that they are inspecting in real time to identity things of interest, terrorist attacks or foreign government planning or even foreign companies competitive to key US companies.

My favorite conspiracy is that three letter agencies keep pushing the conspiracy that they are omni-present with access to everything. Same as parents telling their kids Santa is watching, and leaders telling adults God is watching. Its extremely effective control and millennia old at this point.

The reality is much more banal that they still need warrants and tech companies hate playing police/evidence servant for the government (it consumes a ton of resources and pays nothing).

roysting• 19 days ago

The reality is much more banal that they still need warrants and tech companies hate playing police/evidence servant for the government

I will not elaborate how I know, but that is not even directionally correct. But these are not even secret things that can’t be known simply through the Snowden, Wikileaks, and Vault7 releases. So why are you telling yourself this? Are you still wet behind the ears or something?

There are people who know exactly how governments do not in fact need warrants and the tech companies don’t even really know they are servants to the government, let alone which one. That’s how things are done. The less surface area the better.

thewebguyd• 19 days ago

warrants

The snowden leaks revealed that's not the case.

The three letter agencies can just issue national security letters without a judge ever seeing it, and those come a long with a gag order (plus other workarounds like just buying data from brokers, and how US communications can get swept up just by virtue of communicating with a foreign national outside the US).

You're right, they aren't omniscient in the way we imagine of a room full of people monitoring everything in real time. But to pretend they aren't passively collecting massive amounts of data is dangerous. Snowden showed us PRISM, with all major tech companies participating. They do effectively have a live, unrestricted wiretap to the internet and if you happen to be a person of interest, they will just send out NSLs and get all your communications that are not fully E2EE without you even knowing thanks to the gag order.

jacobgold• 19 days ago

"Also if you are using local AI that you didn’t train yourself you can never be sure..."

A local model you trained yourself seems about as good as you can do today.

But it may not even be possible to fully trust a model you trained if you used untrusted data during training.

As a user, you have to trust your coding agent AND inference provider AND models: https://jacob.gold/posts/coding-models-are-code/ https://www.anthropic.com/research/sleeper-agents-training-d...

fouc• 19 days ago

also there doesn't even need to be a model involved, agentic code harnesses with remote "instructions for the local computer" are technically backdoored by default.

SubiculumCode4• 19 days ago

Why make this u.s. centric? You think China served models would be different?

tedivm• 19 days ago

China is releasing open weight models you can simply run yourself.

OtomotO• 19 days ago

Because the topic of the article is about the US?

seanmcdirmid2• 19 days ago

It’s pretty hard to put a backdoor in a bunch of model weights. Maybe not impossible mind you, but I can’t fathom how you would do it.

rolymath• 19 days ago

Because Chinese model providers are open source. You can host them yourself.

Can you name one open source US model that came out in the last year?

greenavocado• 19 days ago

you can never be sure it doesn’t have purposeful biases in its reasoning that may disadvantage you - such as directing you away from certain plans or ideas or patents etc.

that's why you should use abliterated heretic models

type0• 19 days ago

even foreign companies competitive to key US companies.

It's unfathomable to me that EU companies don't take the risk of industrial espionage from US more seriously

atlasunshrugged• 19 days ago

Not from China? One country has a recent track record of massive amounts of industrial espionage and one doesn't.

wongarsu3• 19 days ago

Many do, when it comes to AI. Lots of restricting what the AI is allowed to see, working with local AI, trusted AI hosters, etc.

Of course those are largely the same companies that receive emails via outlook, manage company-wide SSO in Microsoft Entra, put their files in Sharepoint and track software and maintenance issues in Jira ... I'm not sure how much much info there is left that isn't already combed through by NSA and friends

hakfoo• 19 days ago

I think we can even skip the "that may be targeted by the US government" clause.

The whole "hosted AI" business feels like like a huge violation of corporate norms on confidentiality. Businesses that would have your head for printing out a source file to reference and annotate are encouraging developers to feed in huge amounts of proprietary code and data, and incorporate changes suggested from an outside party with minimal vetting. Evidently whatever privacy policies they've been throwing at enterprise users are plated with mithril.

At some point, one of the big services is going to get popped, and it won't just be a data breach. There's too much opportunity to quietly use the system as a malware distribution hub. Every vibe-coded dashboard suddenly starts depending on some weird left-pad fork that, 12 dependencies deep, is running a keylogger or Dogecoin miner. Your payment processor suddenly starts accepting the Konami code to approve a transaction.

ravenstine• 20 days ago

Employers in 2022:

No! Don't install that lodash thing without explicit approval from IT. Oh, you want a license for Charles Proxy? Gee, I dunno... we've got a budget to maintain.

Employers in 2023:

No! You can't use ChatGPT at work – it's a security risk.

Employers in 2024:

Okay, you can use Github Copilot I guess, but you'll have to endure boring corporate training on what you're allowed to do with it.

Employers with dollar signs in their eyes in 2025:

We attended a seminar about vibe coding. Why aren't you dumbasses keeping up with the times? Use Claude Code for everything! Don't write any of your own code anymore. We don't even really care if you use yolo mode. Just review code and push 10x more features! Use unlimited tokens! Money printer go brrrrr.

Employers in 2026:

You mean giving one or two companies full autonomous access to our workstations while stupifying our engineers wasn't a sound business plan?

dan_i3• 20 days ago

2025 taught me that my employer would replace me with a slave if they could get away with it.

The confusing part to me is why these companies believed the "AGI" hype, I.E. that OpenAI or Claude's LLM is the ideal white collar slave.

I suppose I can understand that the executive class resents labor enough to make irrational business decisions for the purpose of insulting the workers who design and operate their companies.

That being said, the 2025 AI binge feels like a murder-suicide done by the executives of many of these companies.

bushido• 20 days ago

What's very interesting to me is these moves will introduce a good amount of doubt in future claims by Claude etc, that the open source and non-US models are only getting better because they're distilling from frontier labs.

Jeff9James• 20 days ago

Story of Z.ai:

use claude-code see how good it is send 100k bots to distill fable 5 (GLM 5.2 is the result of this) release Zcode ditch claude-code ban claude-code

julianlam• 19 days ago

[citation needed]

codedokode4• 19 days ago

The outcome is that we get either free or cheaper model. Good work.

kgeist• 19 days ago

Fable 5 was released on June 9 and removed on June 12. GLM-5.2 was released on June 13. It would be an amazing feat to make a model SOTA in just 3 days but I highly doubt it. It's more like z.ai released an existing checkpoint earlier than planned to capitalize on the news

vitorgrs• 19 days ago

Alibaba is not the owner of GLM5.2/Z.AI.

khurs• 19 days ago

Snowden files revealed NSA collect everything they can.

Of-course USA is collecting everything, not just from China but everyone.

And same with every one else.

Simulacra2• 19 days ago

https://archive.is/bmyny

avd201• 19 days ago

Anthropic has been doing this sort of stuff for a while already. I mean, who remembers when Claude would just consume all your remaining usage if it read anything indicating that Openclaw had been used on your codebase? Because I remember. Two months ago btw https://news.ycombinator.com/item?id=47963204 Then there was the whole debacle of Fable silently downgrading to other models if it detected wrong think, or worse, outright sabotaging your codebase if you were working on language models lol

nicogentile• 19 days ago

Seems that we are finally moving to the next stage in LLM's. not only customize based on old searches but also targeted you based on non disclose data. Its basically the same flow we had years ago with ads in social media.

Interesting to notice that we can do the same with these models.

arkhiver• 19 days ago

no ads or captcha: https://nonogra.ph/alibaba-to-ban-employees-from-using-anthr...

JPLeRouzic• 19 days ago

employees were being told to use the company's own coding platform Qoder

That looks a no-nonsense decision, isn't?

gchamonlive2• 19 days ago

There was recently this case here in Brazil https://www.mixvale.com.br/2026/06/26/fbi-warns-brazilian-po...

This is a double edge knife. In this specific instance this was absurdely important for that kid's life, but this work both ways. What if the US authorities deemed it necessary to snoop on foreign governments and citizens for political reasons, now leveraging AI to do it at an industrial scale?

One thing is certain though is that assuring privacy isn't top priority for any cloud provider. Companies doing cutting edge, sensitive work should be wary.

bathtub365• 19 days ago

The US government deemed it necessary to snoop on foreign governments and citizens decades ago and is doing it on a continuous basis. Also on their own government and citizens.

gchamonlive2• 19 days ago

Thanks, I've edited my original comment to address this more clearly

fcanesin• 19 days ago

It is not a risk is a fact - people decompiling Claude Code have found many times that it has code branchs to detect it is being used in Chinese timezone and locale.

kordlessagain• 19 days ago

Well, that's a revenue hit for sure for Anthropic.

somelamer567• 19 days ago

The extreme downvoting of certain viewpoints that are less-than-flattering about China's conduct in the AI race is quite telling.

They seem to have given themselves license to do what they like, but _God forbid_ they're called out for acting less-than-honourably.

Most adults around the world can associate actions and consequences. The incomprehension and entitlement here speaks volumes about the moral and emotional maturity of the Chinese Communist Party and their political system.

0xEnsp1re• 19 days ago

They don't wanna Anthropic to collect data ))

luciana1u• 19 days ago

Alibaba banning Claude Code over backdoor fears is like a pot calling the kettle a surveillance device.

novoreorx• 19 days ago

As someone who knows a lot of Alibaba engineers, this is a fairly common thing and nothing special. Their company owned device has the most strict security control I've ever seen, and it's been for many years. Many softwares are not allowed to run. To me I think it's quite reasonable as the company owned device can access most of the internal resources of this huge monoploy, many of them are confidential. This kind of restriction is only for working in the company, employee's own device out of the company is free from surveillance.

rldjbpin• 19 days ago

being true or not is irrelevant for decisions such as this. has been done on both sides, whether at software level or "hardware".

from Teslas not allowed parked around sensitive areas in the city, to blocking a (very famous and quite well-made) Russian antivirus, or Huawei communication stack.

Anthropic is not doing itself any favours with their recent (?) antics [1], so it is completely well-founded to do this imho. regardless, harness as a moat is not quite as established as the underlying models to the same extent.

[1] https://news.ycombinator.com/item?id=48734373

Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

Related Stories