The decision followed a wave of reports, originating from a Reddit post and a GitHub verification report, which claimed that Claude Code versions 2.1.193, 2.1.195, and 2.1.196 contained obfuscated logic to quietly flag users . Alibaba's security team added Claude Code to its restricted software list and recommended employees switch to an alternative tool called Qoder .

Alibaba's Allegation: Hidden Detection Code and Steganographic Tracking

Alibaba claims Anthropic embedded concealed tracking logic within Claude Code's source code that quietly flagged users based on location, network characteristics, and potential affiliation with Chinese AI labs . Developers who analyzed the tool reported that it used steganographic techniques — hiding detection signals within otherwise normal code outputs — to silently profile Chinese users without their knowledge .

Anthropic has since started rolling back this feature, saying it was an anti-abuse experiment intended to detect and block illicit distillation campaigns rather than general surveillance . The company stated the tracking was meant to identify and block users attempting to copy its models, but the mechanism was so opaque that even legitimate Chinese users and enterprises were flagged, creating a public relations crisis.

Anthropic's Allegation: The 25,000-Account Distillation Campaign

On June 24, 2026, Anthropic publicly accused Alibaba of running the largest known distillation attack against its Claude models . In a letter to the U.S. Senate Banking Committee, Anthropic alleged:

• Operators affiliated with Alibaba and its Qwen AI lab used approximately 25,000 fraudulent accounts to generate more than 28.8 million API exchanges with Claude between April 22 and June 5, 2026 .
• The campaign targeted Claude's software engineering and agentic reasoning capabilities — the very skills that power Claude Code — to cheaply train Alibaba's own competing models .
• Anthropic described the operation as "brazen," "industrial-scale," and "unlawful" — a deliberate attempt to bypass export restrictions and steal U.S. AI intellectual property .

The letter, sent to Senators Tim Scott (R-S.C.) and Elizabeth Warren (D-Mass.) on June 10, urged punishment and amplified calls in Washington to strengthen AI export controls against China . Anthropic has not provided independent verification of its claims, and Alibaba has not publicly commented on the specifics .

The Broader U.S.-China AI Tension Context

This episode sits inside a much larger pattern:

• Earlier campaigns: In February 2026, Anthropic had already disclosed similar distillation attacks by three other Chinese AI labs — DeepSeek, Moonshot, and MiniMax — involving 16 million exchanges through roughly 24,000 fraudulent accounts .
• Export control volatility: Days before the Alibaba story broke, the U.S. Commerce Department had briefly lifted export controls on two of Anthropic's most advanced models (Fable and Mythos), only to face renewed national security concern as Chinese firms exploited access loopholes .
• Mutual distrust: Anthropic sees its hidden Claude Code detection as a necessary defensive measure against systematic IP theft by Chinese state-linked labs . Alibaba sees the same code as espionage — a secret backdoor planted in a developer tool to spy on Chinese enterprises . Neither side has accepted the other's framing.

Why This Matters

The Alibaba-Anthropic dispute is now emblematic of the broader U.S.-China AI cold war. It highlights a fundamental trust gap: U.S. AI companies are deploying countermeasures — including hidden detection code — to protect what they see as crown-jewel intellectual property. Chinese tech giants, in turn, are taking aggressive steps to acquire that IP and are hypersensitive to any tool that appears to spy on their operations.

As export controls tighten and new loopholes emerge, this is unlikely to be the last such confrontation. The real question is whether any mechanism — technical, legal, or diplomatic — can slow the escalation.

The decision followed a wave of reports, originating from a Reddit post and a GitHub verification report, which claimed that Claude Code versions 2.1.193, 2.1.195, and 2.1.196 contained obfuscated logic to quietly flag users . Alibaba's security team added Claude Code to its restricted software list and recommended employees switch to an alternative tool called Qoder .

Alibaba's Allegation: Hidden Detection Code and Steganographic Tracking

Alibaba claims Anthropic embedded concealed tracking logic within Claude Code's source code that quietly flagged users based on location, network characteristics, and potential affiliation with Chinese AI labs . Developers who analyzed the tool reported that it used steganographic techniques — hiding detection signals within otherwise normal code outputs — to silently profile Chinese users without their knowledge .

Anthropic has since started rolling back this feature, saying it was an anti-abuse experiment intended to detect and block illicit distillation campaigns rather than general surveillance . The company stated the tracking was meant to identify and block users attempting to copy its models, but the mechanism was so opaque that even legitimate Chinese users and enterprises were flagged, creating a public relations crisis.

Anthropic's Allegation: The 25,000-Account Distillation Campaign

On June 24, 2026, Anthropic publicly accused Alibaba of running the largest known distillation attack against its Claude models . In a letter to the U.S. Senate Banking Committee, Anthropic alleged:

• Operators affiliated with Alibaba and its Qwen AI lab used approximately 25,000 fraudulent accounts to generate more than 28.8 million API exchanges with Claude between April 22 and June 5, 2026 .
• The campaign targeted Claude's software engineering and agentic reasoning capabilities — the very skills that power Claude Code — to cheaply train Alibaba's own competing models .
• Anthropic described the operation as "brazen," "industrial-scale," and "unlawful" — a deliberate attempt to bypass export restrictions and steal U.S. AI intellectual property .

The letter, sent to Senators Tim Scott (R-S.C.) and Elizabeth Warren (D-Mass.) on June 10, urged punishment and amplified calls in Washington to strengthen AI export controls against China . Anthropic has not provided independent verification of its claims, and Alibaba has not publicly commented on the specifics .

The Broader U.S.-China AI Tension Context

This episode sits inside a much larger pattern:

• Earlier campaigns: In February 2026, Anthropic had already disclosed similar distillation attacks by three other Chinese AI labs — DeepSeek, Moonshot, and MiniMax — involving 16 million exchanges through roughly 24,000 fraudulent accounts .
• Export control volatility: Days before the Alibaba story broke, the U.S. Commerce Department had briefly lifted export controls on two of Anthropic's most advanced models (Fable and Mythos), only to face renewed national security concern as Chinese firms exploited access loopholes .
• Mutual distrust: Anthropic sees its hidden Claude Code detection as a necessary defensive measure against systematic IP theft by Chinese state-linked labs . Alibaba sees the same code as espionage — a secret backdoor planted in a developer tool to spy on Chinese enterprises . Neither side has accepted the other's framing.

Why This Matters

The Alibaba-Anthropic dispute is now emblematic of the broader U.S.-China AI cold war. It highlights a fundamental trust gap: U.S. AI companies are deploying countermeasures — including hidden detection code — to protect what they see as crown-jewel intellectual property. Chinese tech giants, in turn, are taking aggressive steps to acquire that IP and are hypersensitive to any tool that appears to spy on their operations.

As export controls tighten and new loopholes emerge, this is unlikely to be the last such confrontation. The real question is whether any mechanism — technical, legal, or diplomatic — can slow the escalation.