Alibaba bans Claude Code after hidden code was found fingerprinting Chinese users

A reverse engineer found Claude Code quietly detecting China-linked developers and hiding the result in an invisible marker on every prompt. Anthropic calls it an anti-abuse experiment; Alibaba responded by banning the tool and blacklisting all Anthropic products.

By Stackmaven

Anthropic shipped Claude Code with hidden logic that quietly checked whether a developer was routing requests through China, then encoded the answer into an invisible marker attached to every prompt. The company describes it as an anti-abuse experiment it had always meant to pull; the reverse engineer who found it in late June filed a bug report titled “Anthropic embedded spyware in Claude Code.” Between those two readings sits a trust problem that one of the most widely used coding agents now has to answer for, and Alibaba has answered it early by banning the tool outright.

What the code did

According to the reverse-engineering write-ups and GitHub issue #72518 on the anthropics/claude-code repository, the behavior arrived in version 2.1.91, released in early April 2026, and ran on every request. When the ANTHROPIC_BASE_URL environment variable pointed at anything other than Anthropic’s own API endpoint, the client read the machine’s system timezone, looked for Asia/Shanghai or Asia/Urumqi, extracted the proxy hostname, and matched both against an obfuscated list reported to hold roughly 147 entries spanning Chinese corporate networks, cloud regions, AI labs, and known Claude API reseller or mirror services. Parts of the detection logic were XOR-obfuscated, which is the kind of step you take when you would rather a string not show up in a plain-text search of the binary.

On a match, the client did not phone home with an obvious network call. It hid the signal in plain sight, using steganography, the practice of concealing data inside otherwise ordinary content. It varied the date format and swapped between visually near-identical apostrophe characters in the “Today’s date is” line of the system prompt, a covert channel invisible to the developer but readable by Anthropic on every request. That distinction matters for working developers. Claude Code is not a web app you visit; it runs locally with filesystem and shell access, so undisclosed fingerprinting inside the client carries more weight than routine telemetry, both for individual trust and for any security team that has to approve the tool.

Anthropic’s account

Thariq Shihipar, who works on Claude Code, addressed it publicly, describing the mechanism as “an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation,” the practice of training a cheaper model on a stronger model’s outputs. He said stronger protections had since shipped, that the team had been meaning to take the code down for a while, and that removal was already scheduled. A version removing it shipped on July 2, 2026, though the public changelog for that release did not mention the change. Anthropic’s framing is plausible on its own terms: reseller abuse and distillation are real problems for a frontier lab. The harder part to wave off is the gap between that intent and the method, because a hidden, obfuscated channel that classifies a user’s location without disclosure reads less like telemetry and more like surveillance, regardless of the motive behind it.

Alibaba’s ban and where this lands

Alibaba moved fastest. Reuters reported on July 3 that the company is directing employees to stop using Claude Code, adding it to an internal high-risk software list, and blacklisting Anthropic products across the board, steering staff to its own coding platform, Qoder, instead. Anthropic, for its part, has characterized the measures as anti-fraud protections and suggested Alibaba was itself attempting distillation. The result is a standoff in which a US lab and a Chinese platform each accuse the other of acting in bad faith, and developers are caught in the middle.

The broader signal is that trust is becoming a first-class feature of coding agents, not a footnote. These tools earn deep access to a developer’s machine and codebase, so the terms of what they observe and transmit are part of the product, not a compliance detail. This episode also extends a run of geopolitics reshaping how Anthropic’s software reaches users, following the export-control actions that pulled its strongest models offline and the government deals that put Claude back in front of large buyers. For teams evaluating an agent, the practical lesson is that the client’s behavior, not just the model’s capability, now belongs on the review checklist.

What’s worth watching

Whether other buyers follow Alibaba. A single enterprise ban is a data point; a pattern is a precedent. The signal to watch is whether other large employers, or regulators in markets sensitive to US software, cite this in their own restrictions.
Whether Anthropic answers with transparency, not just a patch. Removing the code closes the immediate issue. Documenting what the client inspects and transmits, and giving security teams a way to audit it, is what would actually rebuild trust.
Whether it accelerates the move to alternatives. Every trust shock lowers switching costs. It is worth watching whether teams weigh rival agents, open models, or self-hosted setups more seriously off the back of this.

The plain takeaway is that a coding agent’s credibility rests on what it does quietly as much as on what it ships loudly, and an undisclosed fingerprinting mechanism is an expensive way to learn that. Anthropic has removed the code and offered an explanation; whether that is enough depends on what it discloses next. Stackmaven’s follow-up coverage will revisit the fallout, any further bans, and Anthropic’s transparency response on or around October 1.

Sources cited