Alibaba Bans Claude Code: Anthropic's Hidden China-Detection Code Exposed After 90 Days
TL;DR
Alibaba banned Claude Sonnet, Opus, Fable, and Claude Code company-wide starting July 10, after a Reddit user found hidden China-timezone detection code that shipped undisclosed for three months. It's Alibaba's counterpunch in the Anthropic distillation feud, and a trust crisis of its own.
The steganographic trick died the moment it went public. Once every developer knows Claude Code could swap the Unicode codepoint of an apostrophe depending on your system timezone, that signal is trivial to spoof or strip out. What I haven’t seen anyone publish is a working detector for the mirror case, an AI coding tool covertly fingerprinting users for a government or lab that isn’t the one running the servers. If you’ve reverse-engineered CLI-based AI tools for this kind of hidden telemetry, where do you draw the line between anti-abuse instrumentation and a backdoor, and what did you find when you looked?
What happened
Alibaba issued a company-wide ban on Anthropic’s products today. Claude Sonnet, Claude Opus, Claude Fable, and the Claude Code development tool are all on the list, with employees required to uninstall them by the deadline and switch to Alibaba’s in-house coding platform, Qoder. Internally, Alibaba classified the products as high-risk software with security vulnerabilities.
The trigger was a Reddit post. A user going by LegitMichel777 was trying to restore a disabled remote-control feature in Claude Code on June 30 and, while reverse-engineering the tool, found obfuscated code that had never appeared in any changelog. It had shipped silently in version 2.1.91 on April 2 and sat undetected for three months. The code checks whether a user’s system timezone is set to Asia/Shanghai or Asia/Urumqi, and cross-references proxy URLs against a hardcoded list of Chinese domains that includes Alibaba, Baidu, Ant Group, and ByteDance.
What actually sparked the outrage is how the signal got transmitted. Instead of writing to a conventional log, the code hid its findings inside the system prompt sent back to Anthropic’s own servers, using a steganographic method. When a Chinese timezone was detected, the date format switched from dashes to slashes, and the apostrophe in “Today’s date is” got swapped for one of three visually identical but technically distinct Unicode characters, each encoding which flag had fired. Neither the user nor the model itself could tell anything was different. Tom’s Hardware’s coverage called it an invisible tracking watermark.
Thariq Shihipar, an engineer on the Claude Code team, addressed it on X, describing the mechanism as an experiment launched in March meant to prevent account abuse by unauthorized resellers and protect against distillation. He said the pull request stripping the code out had already merged on July 1, the day after the Reddit post went up. Alibaba clearly wasn’t satisfied with that timeline. Ten days later, it moved to a full ban.
None of this happened in a vacuum. On June 10, Anthropic wrote to the Senate Banking Committee alleging that operators linked to Alibaba’s Qwen lab ran the largest known distillation attack against Claude, 25,000 fake accounts generating 28.8 million exchanges over six weeks. I broke down that accusation and its legal grey zones in my June 27 piece. TechCrunch’s reporting already had both stories on the same timeline, and getting caught with hidden detection code just handed Alibaba another card to play.
What the numbers actually say
Start by unpacking the word “backdoor.” In security terminology, that usually means a channel that bypasses normal authentication and gives an outside party control over a system. What Claude Code was doing doesn’t fit that definition. It doesn’t remotely control a user’s machine. It routes a handful of environment signals back to Anthropic’s own servers through a data channel, the system prompt, that already existed for other purposes. That’s closer to a watermark or a behavioral fingerprint used to flag suspicious automated traffic than to a backdoor that hands someone else the keys. Alibaba picked the most damaging word available.
Calling it purely anti-fraud instrumentation doesn’t hold up either. Anthropic’s own engineer admits the experiment launched in March, yet it never appeared in a single changelog entry until an outside user forced the issue by reverse-engineering the tool. The concealment itself was layered: a timezone check, a proxy-domain match, then encoding the result through visually identical but technically distinct Unicode characters. That’s a lot more engineering effort than a routine abuse-logging feature would need. The intent to stay hidden reads louder than the intent to stop fraud.
Running the numbers makes the asymmetry clearer. The distillation attack Anthropic alleges, 28.8 million API exchanges, would have cost an estimated $86,000 to $115,000 to run. Getting caught with the hidden detection code, by contrast, is forcing more than 200,000 Alibaba employees through an enterprise-wide tool migration inside ten days. The engineering cost differs by two orders of magnitude, but what Anthropic is actually paying is a trust cost that doesn’t show up on any invoice, and it’s the kind of cost that follows a vendor into every conversation with government and multinational customers who care about data sovereignty.
The timeline itself is also a signal worth reading. Ninety days passed between the code shipping on April 2 and its discovery on June 30. That gap says less about how well the mechanism was hidden and more about how rarely anyone actually audits a tool they use every day. The person who found it wasn’t a security research firm running a routine review. It was an individual user pulling the tool apart to fix an unrelated feature.
Metrics worth watching next
Whether other Chinese tech firms follow with their own audits. ByteDance, Baidu, and Ant Group all appear on that hardcoded domain list. If a second and third Chinese company publish their own security findings or bans on Claude Code in the coming weeks, that turns this from one company’s grievance into an industry-wide reassessment of US AI tooling risk. Right now the sample size is one.
Whether Anthropic produces a full disclosure. The only public explanation so far is one engineer’s post on X, with no formal security advisory and no accounting of how many times the mechanism fired or how many users it touched. A proper transparency report covering the full trigger logic and data flow would be a real trust-repair move. A brief social-media clarification and nothing more leaves the gap to keep widening.
Whether Claude for Government, still in beta, faces additional source-code audit demands. Government buyers tend to have far less tolerance for undisclosed data channels than typical enterprise customers. If a federal agency or state government adds a code-audit requirement to its procurement process because of this, the fallout has spread from the China market into the government contracts Anthropic wants most.
If this was useful, subscribe to the newsletter for weekly AI PM insights and GenAI case studies.
Sources:
Related Articles
Anthropic Accuses Alibaba of Largest AI Distillation Attack on Claude: 28.8M Exchanges, Senate Sanctions Incoming
Anthropic told the US Senate that Alibaba ran the largest known distillation attack on Claude: 28.8 million exchanges across 25,000 fake accounts over six weeks, targeting Claude's most commercially valuable capabilities. The cost may have been under $90K. The competitive value extracted was orders of magnitude higher.
Claude Code Makes Auto Mode the Default After Blocking 89% of Dangerous Test Commands
From August 14, 2026, Anthropic will default new Claude Code sessions on Pro, Max, and Team plans to Auto mode; its tests beat manual approvals, but the study setting and real-world incident evidence remain limited.