What Is Your AI Coding Agent Actually Doing? The Alibaba–Anthropic Backdoor Row

Here is a story with no heroes, which makes it more useful than most.

Anthropic accuses a lab affiliated with Alibaba’s Qwen of running the largest known “distillation attack” against Claude, roughly 25,000 fraudulent accounts generating nearly 29 million exchanges to extract its models’ capabilities, and takes the complaint to the US Senate. Alibaba denies it. Meanwhile, security researchers reverse-engineering Claude Code discover that since April, the tool had been quietly checking whether its user was in China, reading the system timezone for Shanghai or Urumqi, matching proxy addresses against a hardcoded list of about 147 Chinese domains, and hiding the result using steganography, subtly altering characters in the data sent back to Anthropic’s servers so the signal was invisible to the user and machine-readable at home. Anthropic’s own engineer confirmed it, calling it an experiment to stop unauthorised resellers and protect against distillation, and said the code was removed on 1 July, the day after it was exposed. Alibaba responded by banning Claude Code outright, classifying it as high-risk software, and ordering staff onto its in-house tool instead.

You can spend the afternoon arguing about who’s the villain. Plenty are: critics were quick to call it a double standard, an industry that trained itself on the world’s data without asking, that is being sued in a dozen courtrooms for exactly that, raising its hands in alarm when someone extracts value from it. But “who’s right” is the wrong question for a security leader, and chasing it will waste your time. The useful reading is colder. Everyone in this story is behaving exactly as their interests dictate, and that is not an aberration. That is the environment. Your job is not to referee it. It’s to operate safely inside it.

Nobody here is confused about their own interest

Look at the incident without the moral lighting and it becomes clear, and almost simple.

Anthropic is protecting its core asset. Its models are its entire business, distillation erodes that business, and it has drawn the hardest line in the industry on Chinese access. Building detection into its own tool is, from where it sits, defending the crown jewels. Alibaba is protecting its interests too: it wants sovereign, controllable tooling, it does not want a foreign vendor’s software with deep access to its engineers’ machines quietly profiling its staff, and a ban plus a home-grown replacement serves both aims neatly. The US government is protecting national interest through export controls. The Chinese developers reaching Claude through proxies are protecting theirs, access to a tool they rate. Every actor is rational. Every actor is self-interested. Nobody is behaving surprisingly once you stop expecting them to behave selflessly.

This is the part the outrage cycle misses. There is no version of this world where the vendors, foreign or domestic, subordinate their commercial and national interests to your convenience or your comfort. Expecting them to is not a strategy; it’s a wish. The board that plans around “surely our vendor wouldn’t” is planning around a fairy tale.

The uncomfortable detail: what the tool could actually see

Strip the geopolitics and one technical fact should hold a CISO’s attention regardless of nationality, and regardless of intent.

Claude Code, like every agentic coding tool, needs deep access to a developer’s machine to do its job: it reads, modifies, and executes files across your codebase. That is the point of the product. It also means that any hidden behaviour inside it effectively has access to everything on that machine. In this case, by the vendor’s own account, the undisclosed logic shipped for roughly three months, in no release note, obfuscated well enough that it took a curious person reverse-engineering the binary to surface it. The specific behaviour, as described, was narrow, detecting location, not exfiltrating your source. But the mechanism is the lesson: a tool with total access to your engineering environment carried undisclosed, deliberately concealed functionality, and the way anyone found out was an enthusiast on Reddit, not a disclosure, not an audit, not a control on your side.

Now generalise it, because this is not really a story about one company. You have granted this class of access to tools from several vendors. Each of those vendors has interests, commercial, legal, national, that are theirs and not yours. This incident is simply the case where the concealed behaviour got caught. The honest question it leaves on your desk is not “is Anthropic trustworthy” or “is Alibaba.” It’s: for every agentic tool with deep access to your systems, what is it actually doing, what would it be permitted to do, and by what mechanism would you ever know?

Planning for the world as it is

You cannot moralise your way out of this, and you cannot opt out of using powerful tools built by self-interested parties, that’s the whole toolset. So you govern it. Treat every vendor, including the ones you like and the ones from your own country, as an actor with its own agenda, and build controls that hold even when their agenda diverges from yours.

• Assume your tools serve their makers’ interests, not just yours. This is not cynicism; it’s the correct default. Bake it into procurement and into your threat model. The question isn’t whether a vendor is friendly. It’s what their software can do inside your walls if their interests and yours part company, which, as this shows, can happen without warning and without disclosure.
• Price the access an agentic tool demands as part of its cost. A coding agent with full filesystem and execution rights is not comparable to a linter. The deeper the access, the higher the scrutiny it warrants and the stronger your justification needs to be. Where the tool’s reach exceeds what you can monitor, that gap is your risk, not the vendor’s.
• Instrument the boundary you can actually control: the network. You will rarely audit a vendor’s binary, and reverse-engineering every update is not realistic. What you can do is watch what these tools send and where. Egress monitoring, allow-listed destinations, and DLP on the paths agentic tools use are how a hidden signal home becomes something you’d notice, rather than something you’d read about on Reddit months later.
• Factor geopolitics into tooling as a first-class risk. The era of picking developer tools purely on features is closing. Where a vendor is based, which government can compel it, and which way the export-control winds are blowing are now part of the decision, for a Western firm eyeing a Chinese model and a Chinese firm eyeing a Western one alike. Sovereignty of tooling has become a real line item, and the Alibaba-Anthropic split is a preview, not an outlier.

The temptation with a story like this is to pick a side and feel something. Resist it. The value here isn’t moral, it’s diagnostic. Two powerful companies, backed by two rival states, each did the entirely predictable thing: they looked after themselves. That is the water your organisation now swims in. Every tool you adopt is built by someone with interests that are not yours, occasionally opposed to yours, and increasingly entangled with a government that isn’t yours either. None of that means don’t use the tools. It means use them with your eyes open, govern the access they demand, and never mistake a vendor’s friendliness for an alignment of interests that was never there. The companies in this story understood their own interests perfectly. The only real question is whether you understand yours as clearly.