China warns Claude Code versions have security backdoor

China's cybersecurity authority issued a formal warning on Wednesday, July 8, 2026, alleging that specific versions of a popular U.S.-made artificial intelligence coding assistant contain a security backdoor capable of transmitting sensitive user data without consent. The National Vulnerability Database (NVDB), operated by the Ministry of Industry and Information Technology, identified what it called a serious vulnerability in Anthropic's Claude Code, versions 2.1.91 through 2.1.196.

According to the agency, the software possesses a built-in monitoring mechanism that could automatically send a user's geographic location and identity-related information to remote servers. The NVDB urged organizations and developers using the affected versions to immediately uninstall the tool or upgrade to the latest secure release, which it said has had the relevant code removed. It also recommended that businesses strengthen controls over development tools connected to external networks and increase monitoring of outbound traffic to prevent data leakage.

Anthropic, a San Francisco-based startup, has not publicly responded to the specific allegations from the Chinese database. The company...