Starting July 10, 2026, employees at Alibaba were told to stop using Anthropic’s Claude Code and switch to Qoder, the company’s own internal coding tool. On its own, a company banning one vendor’s software isn’t unusual. What makes this case worth understanding is why: it sits at the center of two separate, serious accusations running in opposite directions between two major AI companies — one about hidden tracking code, the other about large-scale model theft.
Alibaba’s stated reason for the ban centers on a security concern: researchers reportedly found that a version of Claude Code contained code capable of detecting whether a user was located in China or connected to a Chinese AI lab, and of embedding identifying markers — drawn from things like timezone and proxy settings — into data sent back to Anthropic. Anthropic, for its part, had separately accused entities affiliated with Alibaba, in a June 2026 letter to U.S. senators, of running what it called the largest known distillation attack against its models to date — a technique explained in detail in our companion guide, What Is a Distillation Attack?
This article covers what’s confirmed, what’s still contested, and why this dispute is a meaningful data point in the broader story of AI competition and security between major labs.
What Happened
According to reporting from CNBC, TechCrunch, and the South China Morning Post, Alibaba directed its employees to stop using Claude Code effective July 10, 2026, instructing them to use the company’s internal coding platform, Qoder, instead. The trigger, per these reports, was a security discovery: independent security researchers, sharing findings on Reddit and GitHub, identified code within a version of Claude Code that appeared capable of examining a user’s local environment — details like timezone settings and proxy configuration — to determine whether that user was likely located in China or affiliated with a Chinese AI lab, and of quietly embedding identifying markers into telemetry data transmitted back to Anthropic.
This ban lands amid a broader, separate dispute between the two companies. In a June 10, 2026 letter to two U.S. senators, Anthropic accused entities affiliated with Alibaba of conducting what it described as the largest known distillation attack on its models to date, alleging that roughly 25,000 fraudulent accounts were used to run approximately 28.8 million exchanges with its models over about six weeks.
It’s important to separate what’s independently corroborated from what remains a one-sided accusation. The ban itself — its existence, its effective date, and Alibaba’s stated security rationale — is confirmed across multiple independent news organizations. The specific technical claim about hidden China-detection code rests on security researchers’ analysis shared publicly, which multiple outlets have reported on but which has not been confirmed through an official Anthropic statement addressing the specific allegation at the time of writing. Anthropic’s distillation-attack allegation against Alibaba-affiliated entities is similarly Anthropic’s own claim, laid out in a letter to lawmakers rather than a court finding or independent audit.
Why It Matters
This dispute is a rare, concrete, dual-sided example of the two biggest AI security concerns — supply-chain telemetry and hidden data collection on one side, unauthorized model extraction on the other — playing out simultaneously between two major labs, rather than as separate, abstract categories discussed in isolation.
On the telemetry side: if the reported findings are accurate, it would mean a developer tool used by engineers worldwide contained code specifically designed to differentiate and flag users based on geography and lab affiliation — a serious concern regardless of what the data was ultimately used for, because it touches on trust in developer tooling generally, not just this one company’s relationship with this one country.
On the distillation side: Anthropic’s accusation, if accurate, would represent one of the largest documented attempts to extract a frontier model’s capabilities through large-scale API access — a pattern explained in detail in our companion distillation-attack guide, and one that’s becoming an increasingly common flashpoint as frontier AI development gets more expensive and the incentive to shortcut it grows.
Both accusations, notably, remain contested. This is not a case where one side has been definitively proven wrong and the other right — it’s an ongoing dispute where each company has made serious, specific claims against the other, and the practical outcome (an employee-wide tool ban at one of China’s largest technology companies) has already taken effect regardless of how the underlying claims are eventually resolved.
Industry Impact
AI coding tools are becoming a genuine geopolitical and security flashpoint, not just a productivity category. A few years ago, “which AI coding assistant should our engineers use” was a purely internal productivity decision. This dispute shows it’s now entangled with national-security-adjacent concerns (data collection by geography), competitive IP protection (distillation), and cross-border trust between companies operating under different legal and enforcement regimes.
This is not an isolated incident — it fits a broader pattern of increasing scrutiny on AI tool supply chains. Security researchers and enterprises are increasingly auditing AI developer tools the way they’ve long audited other categories of software with deep system access, because these tools often have broad visibility into a developer’s environment, codebase, and — in agentic tools especially — the ability to take real actions.
Distillation disputes are likely to keep escalating as more companies compete for frontier AI capability. Anthropic’s accusation against Alibaba-affiliated entities is one of the most prominent recent examples, but it’s unlikely to be the last, as our companion guide on distillation attacks explains — the underlying economic incentive (extracting a rival’s capability at a fraction of the cost of building it) doesn’t go away as competition intensifies.
Developer Impact
If you use Claude Code or similar AI coding tools, review what telemetry data they collect and where it’s sent. Regardless of how this specific dispute resolves, it’s a useful prompt for any team to audit exactly what data their AI development tools collect about their environment, and whether that data collection is clearly documented and consented to.
Organizations operating in regions with heightened data-sovereignty or geopolitical sensitivity should factor this into AI tool vendor selection. This dispute is a concrete illustration of why some enterprises, particularly in regulated or geopolitically sensitive industries, increasingly prefer self-hosted or open-weight models they can audit directly over closed, hosted tools where telemetry behavior isn’t independently verifiable.
Don’t assume high API usage automatically signals malicious intent, but do expect scrutiny if your usage pattern is unusual. Teams doing genuinely high-volume, broad-domain API querying — for legitimate research, benchmarking, or evaluation purposes — should be aware that this pattern can resemble the distillation-attack pattern described in Anthropic’s allegation, and may want to proactively communicate with API providers about the nature of large-scale legitimate use.
Business Impact
Enterprise AI tool procurement is going to include more geopolitical and supply-chain due diligence going forward. This dispute is a clear signal that AI developer tools warrant the same vendor-risk scrutiny that other categories of software with deep system access already receive — including analysis of the vendor’s location, ownership structure, and telemetry practices.
Companies with valuable proprietary AI models should treat API-level abuse detection as core infrastructure, not an afterthought. Whether or not Anthropic’s specific allegation against Alibaba-affiliated entities is ultimately validated, the scale described (tens of thousands of accounts, tens of millions of exchanges) illustrates how much value can be at risk through nothing more sophisticated than heavy, sustained API usage — see our companion distillation-attack guide for the underlying mechanism and defenses.
Cross-border AI competition disputes are increasingly playing out in public rather than purely through private legal channels. Anthropic’s decision to raise its distillation allegation directly with U.S. senators, rather than solely through litigation, and the public, rapid reporting on Alibaba’s internal tool ban, both reflect a shift toward these disputes becoming public narrative battles as much as legal or technical ones.
Future Outlook
Expect continued scrutiny of AI coding tools’ telemetry and data-collection practices, both from independent security researchers and from enterprises conducting their own vendor audits, as this category of tooling becomes more deeply embedded in day-to-day development workflows.
Expect Anthropic’s distillation-attack allegation, and Alibaba’s response to it, to continue developing — through further public statements, potential regulatory attention, or legal action — rather than resolving quickly, given the scale of the claims and the cross-border complexity involved.
Expect more companies to face similar dual-sided disputes — accusations of unauthorized data collection on one side, accusations of unauthorized model extraction on the other — as frontier AI competition intensifies and as AI developer tools become common enough to draw the same level of security and geopolitical scrutiny historically reserved for network infrastructure and enterprise software.
FAQ
1. What did Alibaba actually do? Alibaba directed its employees to stop using Anthropic’s Claude Code, effective July 10, 2026, instructing them to use its own internal coding tool, Qoder, instead.
2. Why did Alibaba ban Claude Code? Per reporting from CNBC, TechCrunch, and the South China Morning Post, the trigger was a security concern: researchers reportedly found code in a version of Claude Code capable of detecting whether a user was in China or linked to a Chinese AI lab, and embedding identifying markers into data sent to Anthropic.
3. Has Anthropic confirmed or denied the hidden tracking code claim? At the time of writing, this article did not find an official Anthropic statement directly addressing this specific technical allegation — the claim comes from independent security researchers’ findings shared publicly and reported on by multiple news outlets, not an Anthropic admission or denial.
4. What is the “distillation attack” Anthropic accused Alibaba-affiliated entities of? In a June 10, 2026 letter to U.S. senators, Anthropic alleged that entities affiliated with Alibaba used roughly 25,000 fraudulent accounts to run approximately 28.8 million exchanges with its models over about six weeks, describing it as the largest known distillation attack against its models to date. See our companion guide, What Is a Distillation Attack?, for how this technique works.
5. Is the distillation attack allegation independently confirmed? No — it is Anthropic’s own allegation, presented in a letter to lawmakers. It has not been independently adjudicated by a court or verified by an outside auditor as of this article’s publication.
6. What is Qoder? Qoder is Alibaba’s internal coding platform, which employees have been directed to use in place of Claude Code following the ban.
7. Are other companies expected to take similar action against Claude Code or other AI coding tools? No confirmed reports of similar bans by other companies were found as of this article’s publication. This appears, so far, to be specific to the Alibaba/Anthropic dispute rather than a broader industry trend.
8. Does this affect Claude Code users outside of Alibaba? Not directly — this is an internal Alibaba employee policy. However, it’s a useful prompt for any organization to review what telemetry data their AI coding tools collect and how transparently that’s documented.
9. Is this the first dispute of its kind between major AI labs? No. Distillation-attack accusations and data-collection concerns have both arisen independently in the AI industry before; what makes this case notable is that both types of accusation are running simultaneously between the same two companies.
10. What should developers and enterprises take away from this? Regardless of how the specific allegations resolve, this is a concrete example of why AI developer tools warrant the same security and vendor-risk scrutiny given to other software with deep system access — reviewing telemetry practices, understanding data flows, and factoring geopolitical and ownership considerations into tool selection where relevant.
Analyst Perspective
What makes this dispute worth tracking isn’t which side turns out to be more right — it’s that it’s a rare case where both of the AI industry’s biggest, usually-separate security anxieties (covert data collection by a vendor, and unauthorized extraction of a vendor’s model) are playing out between the same two companies at the same time. Most coverage of AI security tends to treat these as distinct categories: one is a “trust the vendor” problem, the other is a “protect your model” problem. This dispute is a reminder that a single relationship between two AI companies can involve both simultaneously, each side accusing the other of a different category of bad behavior.
The practical resolution of the specific claims — whether the alleged hidden tracking code is confirmed, whether the distillation attack allegation holds up — matters less for most readers than the fact that this dispute has already produced a concrete, real-world action: one of China’s largest technology companies pulling a major AI coding tool from its entire workforce. That’s a meaningful data point regardless of how the underlying technical and legal questions eventually settle, because it shows these disputes now carry consequences that move faster than the disputes themselves get resolved.
For any organization evaluating AI developer tools, the lesson isn’t to assume bad faith from any particular vendor — it’s to recognize that the trust model for these tools (deep access to your codebase and environment, transmitted to a vendor you may have limited ability to audit directly) deserves the same scrutiny historically applied to other categories of software with comparable access, especially as cross-border competitive and geopolitical tensions in AI continue to intensify.
Key Takeaways
- Alibaba directed employees to stop using Anthropic’s Claude Code effective July 10, 2026, switching to its internal tool Qoder instead — confirmed by CNBC, TechCrunch, SCMP, TechRadar, and Tom’s Hardware
- The stated trigger was a security concern: researchers reportedly found code in Claude Code capable of detecting China-linked users and embedding identifying markers in telemetry data — this specific technical claim has not been independently confirmed by Anthropic
- Separately, Anthropic’s June 2026 letter to U.S. senators accused Alibaba-affiliated entities of running the largest known distillation attack against its models to date (~25,000 accounts, ~28.8 million exchanges) — see our companion guide, What Is a Distillation Attack?
- Neither the hidden-tracking-code claim nor the distillation-attack claim has been independently adjudicated — both remain serious, contested accusations from each side
- This is a rare case of two of AI’s biggest security concerns (covert data collection and unauthorized model extraction) playing out simultaneously between the same two companies
- Expect continued scrutiny of AI coding tools’ telemetry practices and continued escalation of distillation-related disputes as frontier AI competition intensifies
Continue Learning
- What Is a Distillation Attack? The Practical Guide to How AI Models Get Copied
- AI Export Controls Explained
- Anthropic Restores Claude Fable 5 as Export Controls Are Lifted
- JADEPUFFER: The First Documented Ransomware Attack Sysdig Says Was Run End-to-End by an Autonomous AI Agent
- What Are AI Agents? Architecture, Memory, Tools and Real-World Use Cases
About GAVIHOS
GAVIHOS helps developers, founders and technology enthusiasts understand AI, software engineering and emerging technologies through practical guides, tutorials and industry analysis.
Stay Updated
Follow GAVIHOS for practical AI, technology and developer-focused insights.
EXTERNAL LINKS
| Source | URL |
|---|---|
| CNBC — China’s Alibaba bans Anthropic AI for employees after “distillation attack” accusation | https://www.cnbc.com/2026/07/06/alibaba-anthropic-ai-ban-claude-china.html |
| TechCrunch — Alibaba reportedly bans employees from using Claude Code | https://techcrunch.com/2026/07/04/alibaba-reportedly-bans-employees-from-using-claude-code/ |
| South China Morning Post — Alibaba bans staff using Claude Code over Anthropic spyware concerns | https://www.scmp.com/tech/big-tech/article/3359375/alibaba-bans-staff-using-claude-code-over-anthropic-spyware-concerns |