Alibaba vs. Anthropic: The Spyware Showdown That Explains the AI Cold War

In late June and early July 2026, two of the world's largest AI players — Anthropic and Alibaba — entered a public confrontation that reads like a tech-thriller script. On one side, Anthropic accused the Chinese e-commerce and AI giant of running the largest known "distillation" attack ever, allegedly using 25,000 fraudulent accounts to steal the capabilities of its Claude models. On the other, Alibaba retaliated by banning Anthropic's prized developer tool, Claude Code, claiming it contained hidden spyware designed to profile and track Chinese users.

Here is the sourced breakdown of what happened, what each side alleges, and why this matters far beyond two companies.

What Triggered Alibaba's July 10 Ban on Claude Code

Alibaba will bar employees from using Anthropic's Claude Code in workplace environments starting July 10, 2026, after internal assessments designated the tool as "high-risk" software ^RT. The ban was triggered by Alibaba's discovery that Claude Code contained hidden detection code that could identify China-linked users — code that Alibaba and many developers characterize as a "backdoor" or spyware-like tracking mechanism ^ST.

The decision followed a wave of reports, originating from a Reddit post and a GitHub verification report, which claimed that Claude Code versions 2.1.193, 2.1.195, and 2.1.196 contained obfuscated logic to quietly flag users ^T. Alibaba's security team added Claude Code to its restricted software list and recommended employees switch to an alternative tool called Qoder ^T.

Alibaba's Allegation: Hidden Detection Code and Steganographic Tracking

Alibaba claims Anthropic embedded concealed tracking logic within Claude Code's source code that quietly flagged users based on location, network characteristics, and potential affiliation with Chinese AI labs ^ST. Developers who analyzed the tool reported that it used steganographic techniques — hiding detection signals within otherwise normal code outputs — to silently profile Chinese users without their knowledge ^TI.

Anthropic has since started rolling back this feature, saying it was an anti-abuse experiment intended to detect and block illicit distillation campaigns rather than general surveillance ^TT. The company stated the tracking was meant to identify and block users attempting to copy its models, but the mechanism was so opaque that even legitimate Chinese users and enterprises were flagged, creating a public relations crisis.

Anthropic's Allegation: The 25,000-Account Distillation Campaign

On June 24, 2026, Anthropic publicly accused Alibaba of running the largest known distillation attack against its Claude models ^RS. In a letter to the U.S. Senate Banking Committee, Anthropic alleged:

• Operators affiliated with Alibaba and its Qwen AI lab used approximately 25,000 fraudulent accounts to generate more than 28.8 million API exchanges with Claude between April 22 and June 5, 2026 ^RAK.
• The campaign targeted Claude's software engineering and agentic reasoning capabilities — the very skills that power Claude Code — to cheaply train Alibaba's own competing models ^KB.
• Anthropic described the operation as "brazen," "industrial-scale," and "unlawful" — a deliberate attempt to bypass export restrictions and steal U.S. AI intellectual property ^SAT.

The letter, sent to Senators Tim Scott (R-S.C.) and Elizabeth Warren (D-Mass.) on June 10, urged punishment and amplified calls in Washington to strengthen AI export controls against China ^YB. Anthropic has not provided independent verification of its claims, and Alibaba has not publicly commented on the specifics ^D.

The Broader U.S.-China AI Tension Context

This episode sits inside a much larger pattern:

• Earlier campaigns: In February 2026, Anthropic had already disclosed similar distillation attacks by three other Chinese AI labs — DeepSeek, Moonshot, and MiniMax — involving 16 million exchanges through roughly 24,000 fraudulent accounts ^TA.
• Export control volatility: Days before the Alibaba story broke, the U.S. Commerce Department had briefly lifted export controls on two of Anthropic's most advanced models (Fable and Mythos), only to face renewed national security concern as Chinese firms exploited access loopholes ^KT.
• Mutual distrust: Anthropic sees its hidden Claude Code detection as a necessary defensive measure against systematic IP theft by Chinese state-linked labs ^T. Alibaba sees the same code as espionage — a secret backdoor planted in a developer tool to spy on Chinese enterprises ^ST. Neither side has accepted the other's framing.

Why This Matters

The Alibaba-Anthropic dispute is now emblematic of the broader U.S.-China AI cold war. It highlights a fundamental trust gap: U.S. AI companies are deploying countermeasures — including hidden detection code — to protect what they see as crown-jewel intellectual property. Chinese tech giants, in turn, are taking aggressive steps to acquire that IP and are hypersensitive to any tool that appears to spy on their operations.

As export controls tighten and new loopholes emerge, this is unlikely to be the last such confrontation. The real question is whether any mechanism — technical, legal, or diplomatic — can slow the escalation.