MIIT Issues Warning Over Severe Security Backdoor in AI Programming Tool Claude Code

On July 8, China’s Ministry of Industry and Information Technology (MIIT) released a risk alert highlighting a severe security backdoor in the AI programming tool Claude Code. The alert was based on findings from MIIT’s Network Security Threat and Vulnerability Information Sharing Platform (NVDB), which detected the vulnerability.

Claude Code, developed by U.S.-based Anthropic, is an AI tool designed to generate and fix code from text instructions. However, it was found to have an embedded monitoring system that sends sensitive user information—such as geographic location and identity markers—to remote servers without explicit user approval. The vulnerable versions span from 2.1.91 to 2.1.196.

MIIT advised relevant entities and users to take immediate action: conduct a comprehensive inspection of installed versions, uninstall or upgrade affected ones to the latest secure release (which removes the backdoor), and strengthen control over external connection permissions for development tools in core business networks, along with enhanced traffic monitoring to prevent unauthorized data leaks.

Sources

• https://news.cpd.com.cn/n3569/726/t_1240518.html