.png){kind=logo}
Anthropic is tightening access to Claude after Chinese companies found ways to use its AI tools despite a strict regional ban. The company blocks access from unsupported regions, including China, but some firms used overseas entities, internal networks, VPNs, and personal subscriptions to keep Claude available to engineers.
The issue has grown as Chinese regulators raise concerns about Claude Code. Beijing says some versions of the coding tool contain ‘security backdoor vulnerabilities,’ while Anthropic says the feature was part of an anti-abuse test, rather than a spying tool.
Ant Financial gave some employees corporate Claude accounts through its intranet, linked to a Singapore-based entity. ByteDance also allowed engineers to pay for personal Claude subscriptions and seek reimbursement, with access routed through VPNs.
These methods broke Anthropic’s terms of service. Still, the reported workarounds did not break US or Chinese law. Neither Ant Financial nor ByteDance responded to requests for comment.
Microsoft also sold API access to Chinese companies with Singapore entities. The setup allowed mainland engineers to use Claude through internal company networks. Anthropic has since moved to close gaps that allow access from blocked regions.
The company said it ‘explicitly prohibits accessing or facilitating access to Claude in unsupported regions, including China.’ It added that it uses changing detection systems to find and ban accounts that break its rules.
Anthropic has also focused on ‘transfer station’ services. These services route user requests from mainland China through overseas Claude accounts, making access look like it comes from supported regions.
Smaller users may rely on these services, but larger Chinese AI companies often avoid them. They fear operators may store, copy, or resell prompts. This risk matters to companies working with private code, internal data, and model training material.
Claude Code has drawn strong demand from Chinese engineers. Its coding outputs can support distillation, a process where smaller AI models learn to copy the behavior of stronger systems. This makes the tool useful for firms trying to improve local models.
Anthropic’s access controls now target both direct and indirect use. The company wants to stop users in blocked regions from reaching Claude through partners, offshore accounts, VPNs, or third-party relay networks.
China’s National Vulnerability Database said several Claude Code versions released between April and June can send user location and identity data to remote servers without clear user consent. It advised users to uninstall affected versions or update to the latest release.
The database listed versions 2.1.91 to 2.1.196 as affected. It described the issue as ‘security backdoor vulnerabilities’ and called it a ‘serious threat.’ The warning adds pressure to a growing dispute between Chinese officials and a major US AI company.
Anthropic rejected the backdoor label. The company said the disputed function was an anti-abuse experiment meant to detect unauthorized users. It denied that Claude Code contained spyware or a tool built for secret surveillance.
The dispute now links two separate issues: Anthropic’s effort to block Chinese access and China’s warning over Claude Code. Both sides frame the matter through security, but they point to different risks. Anthropic focuses on banned access, while Chinese officials focus on data sent by the coding tool.
Also Read: Best AI Coding Tools 2026: Claude Code, Cursor & Copilot Compared
