Anthropic's Anti-Distillation Tracking Becomes a Geopolitical Weapon in China

The facts, stripped of the headline's outrage: a cybersecurity platform run by China's Ministry of Industry and Information Technology (MIIT) warned this week that Anthropic's Claude Code contains a 'built-in monitoring mechanism' capable of sending sensitive user data to a remote server without consent, and urged developers to uninstall affected versions (2.1.91 to 2.1.196, spanning April to late June) or upgrade. Anthropic's response was pointed: those users in China were never authorized to use Claude Code in the first place. Crucially, the company had already confirmed last week that it embedded hidden code to track user locations — its stated purpose being to stop illicit 'distillation,' the practice of training cheaper rival models on a frontier model's outputs.

What makes this episode instructive is that both sides are telling a version of the truth. Anthropic did embed tracking code. China's vulnerability database is correct that such code can exfiltrate data without explicit consent. And Anthropic is correct that the affected users were operating outside its terms of service. The disagreement isn't really about a 'backdoor' in the malicious sense — it's about whether a vendor's anti-piracy telemetry counts as a security threat when the vendor and the user are on opposite sides of an export-control wall.

The context is everything. We've argued before that export controls on frontier models are structurally indiscriminate — nationality can't be verified at the API layer, so enforcement leaks into blunt instruments. Location-tracking embedded in the client is exactly that blunt instrument made concrete: a technical measure designed to police who is distilling your model, which inevitably doubles as surveillance from the user's point of view. Once you accept that a coding agent phones home to enforce licensing, you've conceded that the tool is also an instrument of the geopolitics around it.

There's also a mirror here. This isn't a new problem the AI created; it's an old one — proprietary software with phone-home telemetry, distrust between rival states, IP protection dressed as security — now sharpened by how valuable frontier weights have become. The distillation threat Anthropic is defending against is real: cheaper models trained on frontier outputs are a genuine competitive pressure, and much of China's fast-closing gap has come from exactly this kind of efficient imitation. So the tracking code is a rational business defense. It's just one whose collateral effects land squarely in a country that reads any American telemetry as espionage.

Our reading: this is what the AI cold war looks like at ground level — not superintelligence, but a licensing dispute weaponized by both governments. The short-term picture is messy and getting messier: models are becoming strategic assets, and the tooling around them is being conscripted into national-security narratives on both sides. Expect more of this — sovereignty demands, uninstall advisories, mutual accusations of 'backdoors' — as the technical and the geopolitical fuse. The long-term optimist's caveat still holds: the same competitive pressure that drives distillation is also what democratizes capability and drives down cost worldwide. But the honest near-term truth is that trust between the two AI superpowers is thinning, and developers caught in the middle are the ones told to uninstall. The useful question is not 'who has the backdoor' but 'who governs the plumbing' — and right now, nobody neutral does.