Claude Code Hit by Security Backdoor; Official Launches Emergency Fix

Recently, the National Vulnerability Database (NVDB) under China’s Ministry of Industry and Information Technology (MIIT) issued a critical security advisory regarding Claude Code, a widely adopted AI programming assistant. The warning highlights an undisclosed security backdoor within the tool that may expose users’ sensitive data.
Monitoring data indicates that software versions 2.1.91 through 2.1.196 are vulnerable. These versions automatically transmit sensitive information, such as geographic location and identity identifiers, to remote servers without explicit user consent. The NVDB urges developers and enterprise users to verify their current version immediately. If the installed version falls within the affected range, users should uninstall the software or upgrade to the latest secure release. Organizations are also advised to restrict external access permissions in development environments and enhance traffic monitoring to mitigate unauthorized data exfiltration.
The issue came to light in late June when a developer reverse-engineering version 2.1.196 of Claude Code discovered a hidden detection mechanism embedded since the April 2nd release of version 2.1.91. This mechanism continuously checks system time zones and proxy server details to identify users in China. Notably, this functionality was never disclosed in previous software update logs.
Addressing public concerns, Anthropic team member Thariq Shihipar clarified on social media that the feature was an “experimental” measure designed to prevent account resale and defend against model distillation attacks. The company confirmed that a new version released on July 2nd has removed the detection feature.
This vulnerability has triggered significant industry response. Reports indicate that Alibaba has issued an internal ban, prohibiting employees from using Claude Code in office environments as of July 10th, and has added the tool to its high-risk software list. For developers who must continue using the tool, closely monitoring official updates and applying timely patches remain essential for maintaining development environment security.
Related article
India Reports First-Ever Rogue AI Agent Activity
India’s cybersecurity authority reported Thursday that AI agents from various providers accessed personal information and confidential materials at Indian organizations during research and testing phases.The Indian Computer Emergency Response Team (C
How to optimize SEO for Google Japan and Yahoo Japan?
How to Create AI Baby Photos Using Remini: A Complete GuideIntroductionUnderstanding the AI Baby TrendStep-by-Step Instructions for Using Remini3.1 Installing the Remini App3.2 Initial Setup and Navigation3.3 Uploading Your Photos3.4 Customizing Mode
Claude Opus 5.5 Enters Internal Testing, Leaps Two Tiers to Challenge GPT-6 at a Fraction of the Cost
While anticipation for Opus 5.2 remains high, recent developments indicate a strategic leap to version 5.5. Early today, developer Lyra shared insider information revealing that Claude Opus 5.5, internally codenamed "claude-wafer-eap," is currently u
Related Special Topic Recommendations
Comments (0)
0/500

Recently, the National Vulnerability Database (NVDB) under China’s Ministry of Industry and Information Technology (MIIT) issued a critical security advisory regarding Claude Code, a widely adopted AI programming assistant. The warning highlights an undisclosed security backdoor within the tool that may expose users’ sensitive data.
Monitoring data indicates that software versions 2.1.91 through 2.1.196 are vulnerable. These versions automatically transmit sensitive information, such as geographic location and identity identifiers, to remote servers without explicit user consent. The NVDB urges developers and enterprise users to verify their current version immediately. If the installed version falls within the affected range, users should uninstall the software or upgrade to the latest secure release. Organizations are also advised to restrict external access permissions in development environments and enhance traffic monitoring to mitigate unauthorized data exfiltration.
The issue came to light in late June when a developer reverse-engineering version 2.1.196 of Claude Code discovered a hidden detection mechanism embedded since the April 2nd release of version 2.1.91. This mechanism continuously checks system time zones and proxy server details to identify users in China. Notably, this functionality was never disclosed in previous software update logs.
Addressing public concerns, Anthropic team member Thariq Shihipar clarified on social media that the feature was an “experimental” measure designed to prevent account resale and defend against model distillation attacks. The company confirmed that a new version released on July 2nd has removed the detection feature.
This vulnerability has triggered significant industry response. Reports indicate that Alibaba has issued an internal ban, prohibiting employees from using Claude Code in office environments as of July 10th, and has added the tool to its high-risk software list. For developers who must continue using the tool, closely monitoring official updates and applying timely patches remain essential for maintaining development environment security.
India Reports First-Ever Rogue AI Agent Activity
India’s cybersecurity authority reported Thursday that AI agents from various providers accessed personal information and confidential materials at Indian organizations during research and testing phases.The Indian Computer Emergency Response Team (C
How to optimize SEO for Google Japan and Yahoo Japan?
How to Create AI Baby Photos Using Remini: A Complete GuideIntroductionUnderstanding the AI Baby TrendStep-by-Step Instructions for Using Remini3.1 Installing the Remini App3.2 Initial Setup and Navigation3.3 Uploading Your Photos3.4 Customizing Mode
Claude Opus 5.5 Enters Internal Testing, Leaps Two Tiers to Challenge GPT-6 at a Fraction of the Cost
While anticipation for Opus 5.2 remains high, recent developments indicate a strategic leap to version 5.5. Early today, developer Lyra shared insider information revealing that Claude Opus 5.5, internally codenamed "claude-wafer-eap," is currently u





Home






