China's CNVDB Flags Security Flaw in Anthropic's Claude Code Sending User Data Without Consent

According to China's state-run CNVDB on July 8, Claude Code versions released from April to June could send user location and identity-related data to remote servers without consent, and the agency urged users to delete the software or update to a newer version. Alibaba subsequently notified employees it would ban workplace use of Claude Code starting July 10, citing unauthorized access concerns.

Anthropicresponded that Chinese companies including Alibaba were not authorized to access Claude services. A Claude Code engineer disclosed on X that the flagged code was part of a March experiment designed to prevent account abuse from unauthorized resellers and model distillation, and is being rolled back. Anthropic added that Claude Code includes a customer-controlled monitoring feature separate from the alleged data transmission, and noted Claude is not directly offered in China.