On July 3, several media outlets obtained the same internal information at almost the same time: Alibaba placed Claude Code on its "high-risk software list," banning all employees from using it in the office environment starting July 10, and requiring the uninstallation of Anthropic's Sonnet, Opus, Fable and other models as well, with its own Qoder recommended as the alternative. The Paper, Yicai, Zhidx and Wallstreetcn all reported it, and Reuters subsequently followed up to verify.
It is only when this news is placed on a timeline that it becomes interesting. According to Zhidx, citing an Alibaba insider, at the beginning of this year, in order to encourage employees to use AI, Alibaba not only issued free quotas for its internal models but also implemented substantial reimbursement for external models: programmers could freely choose Claude, GPT and Gemini, and many burned through quotas of up to several hundred US dollars per week, with Claude Code being one of the frequently used tools. In other words, within half a year, the same company and the same group of engineers went from "the company asks you to use it and the company pays the bill" to "using it will be pursued for accountability and it must be uninstalled within a deadline."
For most bosses and managers reading this article, who is right and who is wrong between Alibaba and Anthropic is other people's excitement. What is truly worth pausing to think about is another question: if even a technology company of Alibaba's scale has to pull the emergency brake, then how big a risk are those engineers in your company who are right now writing code with Claude Code, Cursor and Copilot holding in their hands?
This article seeks to make only one thing clear: acquiescing in employees' use of overseas AI programming tools is equivalent to burying three landmines in the company at the same time—cross-border data transfer, leakage of trade secrets, and business continuity. Moreover, these three landmines cannot be defused by relying on employees' self-discipline; they can only be defused through institutional rules.
First, let us clarify that "secret code," and not be led astray by the headline
The trigger for the matter was a reverse-engineering analysis. On June 30, a Reddit user named LegitMichel777 posted that he had taken apart the Claude Code binary file and found that, starting with version 2.1.91 released on April 2 of this year, the tool had built-in hidden detection logic.
This logic does not take effect for everyone; the trigger precondition is that you used a proxy and changed ANTHROPIC_BASE_URL to point to a custom address—which is precisely the standard posture of Chinese developers accessing Claude while circumventing regional restrictions. Once triggered, it does three things: it reads your system time zone to see whether it is Asia/Shanghai or Asia/Urumqi; it takes your proxy domain and compares it against a list of 147 entries, which includes the domains of Chinese technology companies and AI labs such as Baidu, Alibaba, ByteDance, Moonshot AI, MiniMax and StepFun, as well as a large number of Claude API relay service addresses; and it then determines whether any AI lab keyword has been hit.
What sparked the most controversy was the method of transmission back. It does not add any telemetry field; instead, it hides the result in the system prompt that is sent every time: if a Chinese time zone is hit, the date separator changes from 2026-06-30 quietly to 2026/06/30the apostrophe in "Today's date is" switches among three Unicode characters that are almost indistinguishable to the naked eye but have different encodings, respectively corresponding to "hit a Chinese domain," "associated with an AI lab," and "both hit." The server can decode it simply by looking at the code point of the apostrophe, and the user is completely unaware throughout. The discoverer also pointed out that this code uses XOR obfuscation with the key "91," that the release notes say nothing about it, and that the prompt even contains the sentence "do not state this explicitly to the user."
Claude Code's hidden detection
On July 1, Thariq Shihipar, an engineer on Anthropic's Claude Code team, responded directly on X: this was an experiment the team launched in March of this year, aimed at "preventing unauthorized resellers from abusing accounts and guarding against model distillation attacks"; stronger measures were subsequently deployed, the feature was already slated for removal, the relevant PR has been merged, and it will be completely deleted in the new version.
I have laid out the details this fully because I want to make one thing clear: this is not a confirmed case of "foreign software gathering intelligence"; the motive Anthropic gave is anti-resale and anti-distillation, and that account must be included objectively. Behind it there is indeed a feud—in a letter exposed on June 24, Anthropic accused before the U.S. Senate Banking Committee that operators associated with Alibaba's Qwen lab, between April 22 and June 5, used roughly 25,000 fake accounts and ran more than 28.8 million conversations to conduct "industrial-scale distillation" against Claude. This is the largest such accusation to date; previously, in February, it made almost identical allegations against DeepSeek, Moonshot AI, and MiniMax. But one should remain cautious: to date these are still unilateral accusations by Anthropic, Alibaba has not responded publicly, and distillation is extremely difficult to substantiate from the outside and has never been tested in court. Add to this that Alibaba was placed on the U.S. Department of Defense's "Chinese Military Companies List" on June 8 and promptly sued the Department of Defense seeking removal, and this is a geopolitical ledger, not a purely technical one.
But for enterprises, whether the motive is anti-distillation or something else is actually a secondary question. The primary question is very plain: a development tool that holds your file system and shell permissions reads your local time zone and proxy configuration and covertly transmits them back, without your knowledge, without any mention in the update log, and while specifically instructing the model to "not tell the user." This fact alone is enough for any security-conscious company to show it out of the office environment. Alibaba's characterization was likewise "backdoor risk," not "a competitor's product." In other words, even if Anthropic's explanation is entirely true, the problem exposed has not become any smaller: you simply do not know what else a foreign tool installed on employees' computers has quietly read and transmitted.
Your code is "leaving the country" with every call
Bringing the lens back from this incident to your own company, the first layer of risk has nothing to do with whether there is "hidden code"; it is a more basic fact: the inference of tools such as Claude Code, Copilot, and Cursor is all performed outside the country. Every time an employee presses Enter, code snippets, error messages, and configuration files are sent via HTTPS to Anthropic's or OpenAI's servers in the United States. From the perspective of data sovereignty, once data leaves the territory and enters the control of an overseas service provider, it constitutes "cross-border data transfer."
Cross-border data transfer in China is governed by a full set of hard rules, underpinned by the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law, and operationalized by the Provisions on Promoting and Regulating Cross-Border Data Flows issued by the Cyberspace Administration of China in March 2024 (CAC Order No. 16). These provisions have in fact been relaxed, with roughly three thresholds: non-critical information infrastructure operators that provide personal information (excluding sensitive personal information) to overseas recipients for fewer than 100,000 people within a year are exempt from filing; for 100,000 to 1 million people, or fewer than 10,000 people's sensitive personal information, a "standard contract for cross-border transfer of personal information" must be signed or protection certification obtained; for 1 million people or more, or 10,000 people or more's sensitive personal information, or where "important data" is involved, a security assessment must be completed.
Three compliance thresholds for cross-border data transfer
There is a misconception many companies have fallen into that is worth pointing out: at the mention of AI compliance, they go looking through the Interim Measures for the Administration of Generative Artificial Intelligence Services, then find that they only use it internally and do not "provide services to the domestic public," breathe a sigh of relief, and conclude that it does not apply. That judgment is itself not wrong, but it does not block the cross-border data transfer obligation; internal use does not mean there is no cross-border transfer. The Interim Measures govern the line of "providing services externally," while cross-border data transfer governs the line of "where the data goes"; the two lines are separate.
And for data such as code, the trouble goes beyond personal information. Source code constitutes a trade secret and is protected under Article 9 of the Anti-Unfair Competition Law; one statutory element of a trade secret is that the rights holder has "taken corresponding confidentiality measures." If you upload core code to an overseas third-party model, and most vendors reserve in their agreements the right to use input content to train models, then in future litigation the other side can fully rely on this to argue: you yourself sent it out casually, so how can you claim you "took confidentiality measures"? This blow may directly pierce the very foundation of your trade secret. Code often also contains database connection configurations, intranet addresses, and API keys; once these leave the country, what is exposed is the skeleton of the entire system.
Many bosses' first reaction is to deflect: "That was the employee's personal account, paid for out of their own pocket; it has nothing to do with the company." Legally, this escape route is essentially blocked. As long as the employee is handling work code, it is an act in the course of employment; the company is the actual controller of the data and the beneficiary of the business, and when a leak occurs, it is still the company that must first face regulators and users. The four words "employee's personal act" may appear in an after-the-fact notice, but they are of no use in allocating legal liability.
At this point the conclusion is actually quite clear: this is not a question of whether to ban AI, but of how to manage it. There are three levers for management; none is novel, but most companies have implemented none of them. First, conduct data classification, dividing company data into four tiers—public, internal, confidential, and restricted—and clearly specify which tier may not be entered into any external AI, which tier may be used after desensitization and approval, and which tier may only run in a privatized, controlled environment. Second, issue a set of AI tool usage rules, written into policies and into training. Third, have employees who handle sensitive code sign an AI usage commitment or undertaking, turning "confidential and higher-level information must not be entered into unauthorized models" into a written obligation.
It must be emphasized: this is not a formality. That data classification list and that undertaking are themselves the core evidence in future litigation proving that "the company took reasonable confidentiality measures." Having them or not directly determines whether you are the proactive party or the passive party in a trade secret dispute. The CNCERT warning is very direct: personal accounts should not be used to handle enterprise-level tasks, and sensitive data sources should not be readily authorized. Translated into legal language: if you allow employees to feed company secrets into personal accounts, you are voluntarily deducting points for yourself on the question of whether your "confidentiality measures are reasonable."
Do not stake your company's business on an account that can block you at any time
The third risk has nothing to do with compliance; it concerns whether you can keep doing the work on an ongoing basis.
Anthropic has never formally opened its services to China. In September 2025, it went further, expanding its restrictions from "companies located within China" to "companies more than 50% owned or controlled by Chinese entities and their global subsidiaries," becoming the first U.S. AI company to explicitly restrict sales to China. Chinese developers have long relied on various workarounds such as proxies and overseas entities. A July 3 report by the UK's Financial Times specifically named Chinese companies, including Ant Group, that had used Claude Code through cloud service providers and overseas subsidiaries.
And the cost of those workarounds came due in concentrated fashion over the past two weeks. From late June to early July, Anthropic launched a new round of large-scale account bans, disabling a large number of Chinese users without warning, affecting both individual subscriptions and team accounts; for accounts that paid directly on the official website and were found to have violated the rules, the company offers no refunds, and the success rate of appeals is extremely low.
What does this mean for a company? It means that if your R&D process is already deeply tied to Claude Code—hanging in CI, with workflows running on it—then one morning an account ban means an immediate cut-off of supply, with no customer service to reason with and no refund to obtain. You have staked business continuity on a service that can unilaterally block you at any time and is not protected by Chinese law. This is a purely operational risk, unrelated to political stance.
One worst-case response deserves special mention here: using third-party API proxies. Wanting both to circumvent regional blocks and to pay less than the official price, you route requests through an intermediary of unknown origin. This amounts to stacking another layer of risk on top of the original one: your code first passes through the servers of an intermediary you neither understand nor control. The cross-border data transfer and trade-secret leakage discussed above are all doubled here, plus the added risk that the intermediary directly retains and resells your data. In trying to save costs, you end up handing the company's lifeline to the people least worthy of trust.
The right approach is to lay out an exit route in advance. Run core code in privatized or controlled environments; prepare compliant domestic alternatives for the team, such as Tongyi Lingma and Qoder, or simply deploy open-source models privately; and do not let important workflows depend on any single overseas account—make them migratable. The alternative Alibaba pushed to its own employees this time was Qoder. If even a major company has to keep a fallback, small and medium-sized companies have even less reason to run exposed.
Any boss who can do the math can work out this account
Put the three risks on a single balance sheet, and it is actually a very easy account to calculate.
On the input side: build a set of AI usage policies; legal and security spend a few weeks producing a data classification scheme, usage guidelines, and an employee undertaking, plus moving core projects into a controlled environment. This is basically a one-time investment, followed by low-cost maintenance.
On the risk-exposure side: a single leak caused by non-compliant use of overseas AI means, at the lighter end, an order to correct plus a fine under the Data Security Law; at the heavier end, if large amounts of personal information are involved, Article 66 of the Personal Information Protection Law allows fines of up to RMB 50 million or 5% of the previous year's turnover for serious circumstances, and directly responsible persons may also face the crime of infringing trade secrets or the crime of infringing citizens' personal information; once a trade secret is found not to exist because "no confidentiality measures were taken," years of technological accumulation lose legal protection in competition; add to that the R&D standstill caused by account bans.
A one-time institutional investment, against a potentially fatal risk exposure
A one-time institutional investment, against an exposure that can drag a company into criminal liability and competitive disadvantage. Any boss who can do the math can work this out. The hard part has never been the math; it is that no one takes it seriously before something goes wrong.
Who should act now, and who can start by laying down rules
Not every company needs to treat this as a state of emergency, but none should pretend not to see it.
Companies with self-developed code assets, user data in hand, or involvement in government and enterprise business, finance, critical information infrastructure, or classified business have no room to wait and see on this matter. What you should do is not send an email saying "Claude Code is prohibited" and call it done, but formally put AI tool admission review and cross-border data transfer assessment on the agenda: which tools may be admitted, what data may be fed in, and how liability is traced when something goes wrong, all set out item by item in institutional rules.
Small teams whose code does not involve core secrets and whose data anonymization is relatively solid can hold off on major moves for now, but at a minimum they should write "what can be input and what absolutely cannot" into a one-page specification, so that everyone has a line in mind. This one page costs very little and is worth a great deal.
The only thing you should stop doing is deceiving yourself: the kind of company that hopes to deflect liability with "this was an employee's personal conduct." As discussed above, the law does not let you deflect it. The management effort you save today will come back with principal and interest on the day something goes wrong.
This set of materials—an AI tool admission checklist, a cross-border data transfer impact assessment, employee AI use rules and a letter of undertaking—I have recently built for several companies. The most laborious part has never been drafting the clauses, but persuading management to understand one thing: this is not adding obstacles to innovation; it is buying the company an insurance policy, one that ensures that on the day something goes wrong, you can produce evidence to prove for yourself that "I exercised reasonable care." Alibaba taught everyone a lesson with a single prohibition.
