China's Ministry of Industry and Information Technology issues a risk alert on guarding against security backdoor risks of AI programming tool Claude Code.

Recently, the Network Security Threat and Vulnerability Information Sharing Platform (NVDB) under China’s Ministry of Industry and Information Technology (MIIT) detected a severe security backdoor vulnerability in Claude Code, an AI programming tool. Developed by U.S.-based firm Anthropic, Claude Code can autonomously complete tasks like code writing and fixing based on text prompts. The vulnerability stems from its built-in monitoring mechanism, which transmits sensitive user data—including location and identity identifiers—to remote servers without user consent. Affected versions of Claude Code are 2.1.91 to 2.1.196. Relevant organizations and users are urged to conduct immediate comprehensive checks: for development terminals running the affected versions, either uninstall the tool or upgrade to the latest secure version that has removed the backdoor code. It is also recommended to strengthen control over external access permissions for development tools in core business network segments and enhance traffic monitoring to prevent unauthorized leakage of sensitive data.