The Chinese Ministry of Industry and Information Technology has issued a formal warning regarding significant security vulnerabilities identified within Anthropic’s Claude Code, an AI-powered software development tool. According to the ministry’s cybersecurity threat platform, specific versions of the tool contain a ‘back-door’ vulnerability that could potentially expose sensitive user data, including location and identity information, to unauthorized remote servers without explicit consent.

The alert specifically targets Claude Code versions 2.1.91 through 2.1.196, which were released between early April and late June. Authorities have strongly advised users to either uninstall these versions immediately or update to the latest available software to mitigate the risk of data exfiltration. This warning arrives amidst a period of heightened scrutiny regarding the cross-border use of artificial intelligence technologies.

This development follows recent tensions between Anthropic and Chinese tech firms, with the U.S.-based AI company previously alleging that Alibaba attempted to extract its proprietary AI capabilities. While Anthropic’s services are not officially available in China, many developers have utilized workarounds to access the platform. In response to the evolving regulatory and security landscape, some major Chinese corporations have begun restricting employees from using foreign AI tools for internal operations.

Key Takeaways

• Chinese regulators identified a back-door vulnerability in Claude Code versions 2.1.91 to 2.1.196.
• The vulnerability potentially allows for the unauthorized transmission of sensitive user data, such as location and identity, to remote servers.
• Users are advised to update their software immediately to the latest version to patch the security flaw.

Editor’s Analysis & Impact

The warning from Chinese authorities highlights the growing geopolitical friction surrounding AI development and data sovereignty. As nations move to protect their domestic tech ecosystems, the use of foreign AI tools—often accessed via unofficial channels—is becoming a significant security concern. This incident underscores the risks inherent in using software that lacks official regional support or oversight, particularly in corporate environments where intellectual property and data privacy are paramount. For Anthropic, this situation complicates its international expansion strategy and highlights the challenges of maintaining secure, global software deployments in a fragmented regulatory landscape. Moving forward, we expect to see increased pressure on both AI developers and enterprises to implement more rigorous compliance and security protocols to prevent unauthorized data leakage across borders.

Frequently Asked Questions

Q: Which versions of Claude Code are affected by the security warning?
A: The warning applies to Claude Code versions 2.1.91 through 2.1.196, released between April 2 and June 29.

Q: What should users do if they are running an affected version of Claude Code?
A: Users are advised to either uninstall the affected versions immediately or update their software to the latest available version to ensure the vulnerability is patched.