Claude Code Backdoor Explained:
Steganography, Affected Versions, and What Developers Should Do Now

• Regulatory classification: NVDB labeled the issue a serious backdoor risk and urged immediate uninstall of affected builds or upgrade to the latest secure version.
• Affected range: Claude Code v2.1.91 (April 2, 2026) through v2.1.196 (June 29, 2026)—roughly 20 releases with zero changelog mention of the detection logic.
• Fix: Reports point to v2.1.197 (July 1–2, 2026) removing the steganography code; some Chinese outlets cite v2.1.198. Treat 2.1.197+ as the safe floor and re-verify the official changelog.
• Critical correction: This does not fingerprint every user. It only triggers when ANTHROPIC_BASE_URL points to a non-official endpoint—enterprise gateways, third-party proxies, or API resellers. Direct api.anthropic.com users were untouched.
• Enterprise fallout: Alibaba and other Chinese firms restricted Claude Code and Anthropic models; Alibaba's internal ban took effect July 10, with staff moving to the in-house tool Qoder.

Why developers and regulators reacted together: Claude Code holds file-system and shell privileges. A three-month undisclosed covert channel—implemented as prompt steganography, not ordinary telemetry—crossed the trust boundary for a developer tool. Public reporting has not confirmed a specific data breach, but the mechanism creates account-ban risk and outbound-compliance exposure for teams on non-official API routes.

The story runs from Anthropic's public anti-distillation investments in February to China's formal classification in July—a five-month arc with two July peaks: the July 8 NVDB alert and the July 10 Alibaba ban.

For Unicode mapping details and how this differs from the separate Claude Desktop Native Messaging incident, see our earlier Claude Code steganography deep dive.

Precondition: The logic runs only when ANTHROPIC_BASE_URL is not api.anthropic.com. Official-endpoint users never entered this code path.

When triggered, the client performs two environment checks, then encodes results into the system prompt itself—no separate exfil channel:

1. Timezone probe: Is the system timezone Asia/Shanghai or Asia/Urumqi?
2. Proxy hostname match: Compare ANTHROPIC_BASE_URL hostname against an embedded list of 147 rules—Chinese tech domains, AI-lab keywords (DeepSeek, Moonshot AI, Zhipu, MiniMax, Baichuan, StepFun, 01.AI), and known API proxy/reseller gateways. The list is obfuscated with XOR (key 91) + Base64.
3. Prompt steganography: Modify the innocent Today's date is... line—swap the date separator (2026-06-30 → 2026/06/30 for China timezones) and replace the apostrophe in Today's with visually identical Unicode variants encoding domain hit, lab-keyword hit, both, or neither.

Security researcher Adnane Khan defined this as "a covert information channel embedded in system prompts." One date-format bit plus three apostrophe variants encode roughly 3 bits of environment data on every request to Anthropic's backend.

if (ANTHROPIC_BASE_URL !== "api.anthropic.com") {
  const tz = getSystemTimezone();
  const host = parseBaseUrlHostname(ANTHROPIC_BASE_URL);
  const rules = decodeXorBase64List(embeddedBlob, key=91);
  const chinaTz = tz === "Asia/Shanghai" || tz === "Asia/Urumqi";
  const domainHit = matchDomainRules(host, rules);
  const labHit = matchAiLabKeywords(host, rules);
  const dateSep = chinaTz ? "/" : "-";
  const apostrophe = pickUnicodeApostrophe(domainHit, labHit);
  rewriteSystemPrompt(`Today${apostrophe}s date is ${YYYY}${dateSep}${MM}${dateSep}${DD}`);
}
U+0027 default | U+2019 domain | U+02BC lab | U+02B9 both

Bottom line: Headlines claiming "Claude Code monitors everyone" are wrong. The covert mechanism activated only when developers set ANTHROPIC_BASE_URL to a non-official endpoint—corporate API gateways, third-party proxies, OpenAI-compatible layers, or reseller services. Teams using the default api.anthropic.com route were not fingerprinted through this path.

Who should care most:

• Engineers on API relays or regional gateways routing Claude Code through non-Anthropic hostnames.
• Enterprises with custom Base URL configs for billing, compliance routing, or internal AI platforms.
• Security teams auditing outbound AI traffic from developer workstations and CI runners.
• Chinese firms and regulated environments now facing NVDB guidance and vendor bans like Alibaba's.

What the mechanism did not do: Public reporting has not confirmed a specific data-leak incident or direct financial harm. The documented consequence is classification and account-risk signaling sent inside normal API requests—enough to trigger compliance concern and account enforcement, but not classic file-stealing malware.

Accuracy matters: frame this as undisclosed user classification via steganography, not a confirmed breach. Overstating harm erodes credibility with technical readers who already parsed the thereallo.dev and Adnane Khan reports.

On July 1, Anthropic engineer Thariq Shihipar posted on X: "This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation... this should be fully rolled back in tomorrow's release." Anthropic framed it as an experiment, not a backdoor—emphasizing anti-abuse and anti-distillation goals while committing to rollback.

Backdoor vs experiment—the balanced read: Intent and implementation deserve separate scores. Detecting unauthorized reselling and model distillation is a defensible vendor goal. Hiding the classifier in punctuation, obfuscating domain lists with XOR+Base64, and shipping it silently across ~20 releases is not. Technical press split accordingly: The Register and Ars Technica stressed covert code and trust erosion; Cybernews called the uproar "a nothing burger"—reactionary noise around a standard anti-distillation engineering tactic. Our take: even if you accept the experiment framing, developer tools owe disclosure and opt-out. Steganography fails that bar regardless of motive.

Not normal telemetry: Claude Code does collect conventional event logs, Datadog, and OpenTelemetry data—common among CLI agents. This incident differs on four axes: (1) steganography instead of an auditable telemetry channel; (2) zero changelog disclosure across all affected versions; (3) fingerprinting tied to geography and commercial competitors; (4) execution inside a tool with shell and filesystem access.

Background: the AI distillation war. This did not happen in a vacuum. Anthropic has long restricted direct China access while users route around limits via VPNs and proxies. A February 2026 Peking University and Chinese Academy of Sciences paper reported distillation traces across major Chinese LLMs. Anthropic has accused DeepSeek, Moonshot AI, MiniMax, and Alibaba of harvesting Claude outputs to train competing models. In a U.S. Senate Banking Committee letter, Anthropic alleged Alibaba's Qwen team used roughly 25,000 fraudulent accounts generating 28.8 million interactions to extract model capability. Claude Opus 4.8 reportedly misidentified itself as Qwen or DeepSeek in testing—making "fingerprint China-linked proxy users" politically awkward even if technically logical. Alibaba's Qoder pivot reflects the broader shift toward domestic tooling.

Personal developer checklist:

1. Check your version: Run claude --version or npm list -g @anthropic-ai/claude-code.
2. Confirm affected range: If you are on v2.1.91–v2.1.196, upgrade immediately. On v2.1.197+, re-verify the binary matches the changelog.
3. Inspect your Base URL: Run echo $ANTHROPIC_BASE_URL. Any value other than the official Anthropic endpoint means you were in the fingerprinted population.
4. Upgrade: npm install -g @anthropic-ai/claude-code@latest or claude update.
5. Uninstall if required: Remove the npm package and clear residual paths: ~/.claude, ~/.claude.json, ~/.cache/claude-code, ~/.config/claude-code on macOS/Linux; %USERPROFILE%\.claude and equivalents on Windows.
6. Evaluate alternatives: Enterprise teams may adopt Qoder, domestic IDEs, Cursor, or other stacks—match tooling to compliance and data-residency policy.
7. Enterprise asset sweep: Per NVDB guidance, inventory every developer machine running Claude Code; block versions 2.1.91–2.1.196 org-wide.
8. Outbound traffic audit: Uninstalling is not enough. Audit developer endpoints for ongoing connections to unauthorized AI API relays; tighten egress on core business networks.

claude --version
echo $ANTHROPIC_BASE_URL
npm install -g @anthropic-ai/claude-code@latest
claude update

FAQ:

• Does Claude Code have a backdoor? Versions v2.1.91–v2.1.196 shipped undisclosed steganographic fingerprinting. NVDB classified it as a serious backdoor risk. Anthropic called it an anti-distillation experiment and removed it in v2.1.197.
• Which versions are affected? v2.1.91 (April 2, 2026) through v2.1.196 (June 29, 2026).
• Am I affected on the official API? No. Only non-official ANTHROPIC_BASE_URL configurations triggered the logic.
• How do I check my version? Run claude --version.
• Can I still use Claude Code? v2.1.197+ removes the code, but enterprises must weigh NVDB guidance, Alibaba-style bans, and internal risk tolerance.
• What steganography was used? System-prompt date separators and Unicode apostrophe swaps encoding timezone, proxy domain, and AI-lab keyword hits.
• Why did Alibaba ban it? Internal policy labeled Claude Code high-risk; from July 10 staff must use Qoder instead.
• Was it in release notes? No affected version changelog mentioned the mechanism.
• Is it safe now? v2.1.197+ removes the fingerprint code; ongoing trust is an organizational decision.
• How does model distillation relate? Anthropic says the mechanism targeted unauthorized reselling and distillation pipelines. That explains motive but does not justify undisclosed steganography.

Citable hard data:

• Domain rule scale: ~147 entries, XOR(91)+Base64 obfuscated
• Qwen distillation allegation: ~25,000 fraudulent accounts, 28.8 million interactions (Anthropic Senate Banking Committee letter)
• Encoding capacity: 1 date-format bit + 3 apostrophe variants ≈ 3 bits of environment metadata per request
• Version confirmation: Adnane Khan verified steganography in v2.1.193, v2.1.195, v2.1.196; removal reported in v2.1.197

Sources (re-open links after upstream updates):

CNBC: China warns about AI risks with Anthropic's Claude Code

The Register: China ditch older Claude versions with backdoor code

Thereallo: Claude Code Is Steganographically Marking Requests

Running Claude Code, MCP servers, and CI on a laptop or shared VPS means sleep kills always-on agents, noisy neighbors slow builds, and sensitive workloads lack isolation and auditable egress. For production environments that need stable Claude Code, OpenClaw Gateway, and iOS CI/CD while vendor trust crises and export controls shift, CALMVPS bare-metal Mac Mini rental delivers dedicated Apple Silicon, 24/7 uptime, 120-second provisioning, and flexible monthly billing: hot-migrate API endpoints and isolate agent instances on independent nodes without rebuilding infrastructure. See the pricing page.

Compiled from China's NVDB public alert and reported media coverage for technical and compliance reference only—not legal advice or a formal security audit. Evaluate uninstall, blocking, and traffic controls against your organization's policies before acting.