Alibaba bans Claude Code over hidden tracking of Chinese users; Anthropic responds by accusing it of mass distillation

By TechCrunch (with data from South China Morning Post, BigGo Finance and NewsCord) · July 4, 2026.

Alibaba has ordered its staff to uninstall and stop using Claude Code as of July 10, according to an internal memo cited by the South China Morning Post, which classifies the tool as 'high-risk software with security vulnerabilities'. The company recommends migrating to Qoder, its own AI-assisted coding platform. The trigger, according to reports: security researchers detected that versions of Claude Code (from 2.1.91, dated April 2026) could infer whether a user was operating from China by reading time zones such as Asia/Shanghai or Asia/Urumqi, monitoring proxies or custom API addresses for keywords associated with major Chinese tech companies and AI labs, and even altering, almost imperceptibly, the date format and certain Unicode characters in system prompts.

Anthropic has not denied the mechanism. Thariq Shihipar, of the company, explained on X that it was 'an experiment launched in March to prevent account abuse by unauthorized resellers and protect against distillation', and that it was slated to be withdrawn once more robust mitigations were introduced. In other words: Anthropic acknowledges that it built a covert geographic-detection layer, though it frames its purpose as defensive rather than as surveillance targeting Chinese users in general.

This is where the conflict becomes double-edged. According to Anthropic, the underlying reason for hardening its product is that Alibaba allegedly carried out what the company describes as 'industrial-scale model distillation': roughly 25,000 fake accounts are said to have held more than 28 million conversations with Claude between April 22 and June 5, a pattern consistent with extracting the model's capabilities to train proprietary systems. Anthropic conveyed this accusation in a letter to the U.S. Senate Banking Committee dated June 10, placing the episode in the realm of industrial policy, not just product. It is worth emphasizing that this is an accusation by a party with an interest in a de facto dispute, not a finding verified by an independent third party; the same applies to Alibaba's 'backdoor' characterization, which also serves its narrative of replacement with domestic tools.

What we have, then, is not an isolated security incident but a symmetrical clash of accusations that is highly revealing of the moment the industry is living through: whoever controls the frontier model claims the right to monitor how it is used (and by whom) to protect its intellectual property, and whoever depends on that model suspects, rightly or wrongly, that this monitoring also serves geopolitical ends. Both sides have incentives to dramatize: it suits Anthropic to show the Senate that export restrictions are necessary because Chinese companies 'steal' capability via API; it suits Alibaba to justify its retreat toward Qoder and to portray the U.S. as an actor that spies on its users.

This fits a pattern we have been tracking for months: access controls to AI models have become instruments of foreign policy, not just product decisions. We already saw with earlier restrictions on access to Anthropic's models that the model itself functions as a strategic asset; here the mechanism is inverted, and it is the tool itself that becomes suspected of being a vector for covert state surveillance. The predictable outcome, and here we connect with a thesis we have been maintaining, is that these frictions do not slow China's technological autonomy: they accelerate it. Every ban, every distillation accusation and every discovered 'backdoor' pushes giants like Alibaba to invest faster in their own alternatives (Qoder is just the most recent example of a list that includes Qwen, GLM and DeepSeek), reinforcing exactly the race for technological sovereignty that Washington says it wants to contain.

In the short term, the episode is one more symptom of the AI ecosystem's fragmentation into two blocs that mutually distrust each other's infrastructure, with real costs in friction, duplicated effort and lost efficiency for developers caught in the middle. It is honest to acknowledge that this mutual distrust is not resolved with press releases and that we will likely see more similar episodes, with accusations of espionage or intellectual-property theft flying in both directions. But in the long term, bilateral competition —however uncomfortable— also multiplies the actors capable of producing frontier models, makes access to the technology cheaper, and accelerates the race toward the computational abundance that makes it possible to apply AI to problems such as health or scientific research on a global scale. The geopolitics of language models will remain a battlefield, but the more actors compete to lead it, the faster we will reach the point where AI capability ceases to be scarce and becomes basic infrastructure within everyone's reach.