Updated 23 August 2026 — this article was rewritten with primary sources added and unsupported claims removed.
On 8 July 2026, China’s National Vulnerability Database, operated by the Ministry of Industry and Information Technology, warned that Anthropic’s Claude Code contained a built-in backdoor. Anthropic rejected the characterisation. We compared the two accounts against each other, and the striking thing is how little they actually dispute: the mechanism both sides describe is broadly the same one. What they disagree about is what to call it.
The claim and the response, side by side
The NVDB notice concerned Claude Code versions 2.1.91 through 2.1.196, released between April and June, and alleged they could transmit sensitive information — including user location and identity-related data — to Anthropic’s servers without user consent (Security Magazine).
Anthropic’s answer was not that no such code existed. It was that the code was an experimental anti-abuse measure intended to detect unauthorised access from regions where the product is not offered, and to frustrate unauthorised resellers and model distillation (South China Morning Post). The company also pointed out that Claude Code is not licensed for use in China, so the users being advised to uninstall it were not authorised users in the first place (CBS News).
Read those two positions carefully and the factual overlap is nearly total. Software shipped to users collected location and identity signals and sent them to the vendor. Neither party denies that. The dispute is over intent and disclosure.
Why “backdoor” is the wrong word, and why that matters less than it sounds
As a technical term, backdoor means covert access into a system — a way for someone to get in. What is described here is telemetry going out. Those are different capabilities with different consequences, and using the stronger word for the weaker thing is imprecise in a way that serves the accuser.
But the imprecision cuts both ways, because the defence has a matching weakness. “Anti-abuse telemetry” is an accurate description and also the description any vendor would offer for undisclosed data collection, whatever its purpose. The category is doing the work that evidence would otherwise have to do. A user who did not know their location was being reported to a vendor gains little from learning the reporting was well-intentioned.
The honest position is that both characterisations are self-serving and the underlying fact is uncontested and undisclosed.
The context neither side volunteers
This did not begin in July. In June 2026 Anthropic publicly accused actors associated with Alibaba of the largest known distillation attack on its models, describing tens of millions of interactions over a six-week window. Alibaba subsequently instructed employees to stop using Claude Code (TechRepublic).
That sequence changes how the July warning reads. A national vulnerability database is a technical institution and also a state one, and this notice arrived weeks after a commercial accusation against a national champion. It does not follow that the technical claim is false — a warning can be both politically convenient and factually correct. It does follow that neither party is a disinterested narrator, and that treating either statement as a neutral finding is a mistake.
What the version range implies
One detail in the notice deserves more attention than it received. The affected range is given as 2.1.91 to 2.1.196 — on its face more than a hundred releases, spanning roughly April to June. Whatever the mechanism was, it was not a single build that slipped out and was pulled. It persisted across a quarter of continuous shipping.
That has two implications, and they point in opposite directions. It weakens any suggestion of something hastily inserted and hidden, since a covert capability is not usually maintained through a hundred public releases. It also means the collection ran for months without being documented in a way that made it discoverable to users, which is the part that gives the accusation whatever force it has. A short-lived experiment and a quarter-long default are different things, and the word “experimental” covers both.
The strongest objection
The best argument against making much of this: Anthropic explained the mechanism, the explanation is coherent, the product was never licensed in China, and detecting unauthorised use is a normal thing for a vendor to do. On that reading the story is a licensing dispute wearing security clothes.
That objection is largely right, and it still leaves the substantive problem standing. Every element of it rests on the vendor’s own account of its own closed-source binary. There is no mechanism by which an outside party — a Chinese regulator, a European enterprise, an individual developer — can verify what a proprietary coding agent transmits, beyond watching its network traffic and inferring. The reason this dispute cannot be settled is not that the participants are unreasonable. It is that the artefact is unauditable.
The verification gap is not unique to this vendor or this product. It is the same one that makes a lab’s internal safety results impossible to check from outside, and the reason the package ecosystems have invested in provenance while conceding that it proves origin rather than contents. Open source at least permits the audit in principle, though the xz backdoor showed how rarely anyone performs it.
What actually follows for anyone using these tools
An AI coding agent is an unusually privileged piece of software. It reads your repository, executes commands, and holds credentials, which places it squarely in the category that supply-chain risk frameworks exist to govern — NIST’s guidance on cybersecurity supply chain risk management is built for exactly this problem of depending on components you cannot inspect (NIST SP 800-161r1).
Applied here, that means the useful questions are procurement questions rather than political ones. What does the tool transmit, and is that documented rather than discovered? Can it be run with egress restricted to endpoints you have allowed? Does the vendor publish changes to its telemetry, and did this one appear in a changelog before it appeared in a national advisory? Anthropic’s newsroom is where such disclosures would appear, and the test of any vendor is whether that record is complete before an incident rather than after one.
The lasting lesson is not about one company or one government. It is that organisations have adopted agentic development tools faster than they have built any capacity to verify them, and that the first serious dispute about what one of them does could not be resolved on the evidence. That gap will be filled by regulators, by contractual audit rights, or by the next argument — and the third option is the one currently in progress.
