ANTHROPIC_BASE_URL trigger; ③ steganography mechanism (3 steps); ④ NVDB / Anthropic / Alibaba positions + distillation war context; ⑤ 6-step runbook + version matrix; ⑥ 10 FAQ + disclaimer.
Таймлайн: от undisclosed experiment до regulatory backdoor label
TL;DR: не все Claude Code users были under surveillance — только те, кто роутил через non-official API endpoint. NVDB всё равно квалифицировал undisclosed mechanism как backdoor с severe threat. Immediate action: claude --version; если 2.1.91–2.1.196 — upgrade на ≥ 2.1.197 или uninstall.
NVDB advisory (8 июля): built-in monitoring передаёт location data и identity-related identifiers без user authorization. Affected range: v2.1.91–2.1.196. Рекомендации: full dev-machine audit, uninstall/upgrade, tighten egress controls и traffic monitoring на core business networks.
Version window: v2.1.91 shipped 2 апреля 2026, v2.1.196 — 29 июня 2026. ~20 релизов с logic на борту, zero changelog mentions. Current safe build по медиа: v2.1.204 (на 9 июля).
Story arc: Anthropic implants fingerprint → silent distribution → Reddit/HN exposure (30 июня) → engineer Thariq Shihipar admits on X → rollback 2.1.197 (1/2 июля) → Alibaba internal ban (3/4 июля, effective 10) → official NVDB qualification (8 июля).
| Дата | Событие |
|---|---|
| Фев 2026 | Anthropic announces anti-distillation tech investments |
| Март 2026 | Covert detection logic goes live internally (undisclosed) |
| 2 апр 2026 | v2.1.91 — first public build with mechanism |
| 29 июн 2026 | v2.1.196 — last affected version |
| 30 июн 2026 | Reddit LegitMichel777; Thereallo RE; Adnane Khan GitHub report |
| 1 июл 2026 | Shihipar on X: "experiment", rollback promised; v2.1.197 removes code |
| 3/4 июл 2026 | Reuters/TechCrunch: Alibaba bans Claude Code from Jul 10, pivot to Qoder |
| 8 июл 2026 | Official NVDB warning — backdoor risk, severe |
| 10 июл 2026 | Alibaba internal ban takes effect |
Кто реально затронут: ANTHROPIC_BASE_URL как trigger
Самый частый FUD в заголовках: «Claude Code мониторит всех». Technically wrong. Mechanism активировался только когда env var ANTHROPIC_BASE_URL ≠ api.anthropic.com — enterprise gateway, API reseller, third-party proxy, OpenAI-compatible routing layer.
| Сценарий | ANTHROPIC_BASE_URL | Mechanism active? |
|---|---|---|
| Default user | empty или api.anthropic.com | Нет |
| Enterprise gateway | internal proxy host | Да |
| API reseller / relay | third-party domain | Да |
| VPN + custom endpoint | non-official URL | Да |
NVDB всё равно считает risk severe: Claude Code имеет filesystem R/W, shell exec, network privileges — undisclosed user classification в high-privilege dev tool = compliance issue независимо от trigger set.
echo $ANTHROPIC_BASE_URL claude --version
Steganography, не telemetry: mechanism в 3 шага
Это не отдельный analytics event — covert channel в system prompt. Отсюда steganography label у RE community. Deep dive: steganography deep-dive.
Environment recon: после trigger код проверяет (a) timezone Asia/Shanghai / Asia/Urumqi и (b) hostname из ANTHROPIC_BASE_URL против embedded blacklist.
147-entry blacklist: по independent RE (LegitMichel777, Thereallo, Adnane Khan, Vincent Schmalbach) — 147 patterns: China tech domains (Alibaba, Alipay, Baidu, ByteDance…), AI lab keywords (DeepSeek, Moonshot, Zhipu, MiniMax, Baichuan, StepFun, 01.AI), known API relay domains. Obfuscation: Base64 + XOR(key 91) — strings extraction не работает без full binary RE.
Prompt steganography: results кодируются в innocent line Today's date is ...: China TZ → date separator / вместо -; apostrophe в Today's swap между U+0027, U+2019, U+02BC, U+02B9 — visually identical, semantically ~3-bit fingerprint. Adnane Khan: "a covert information channel embedded in system prompts."
| Condition | Date format | Apostrophe | Unicode |
|---|---|---|---|
| Default | 2026-07-09 | ' | U+0027 |
| China domain hit | 2026-07-09 | ' right single quote | U+2019 |
| AI lab keyword | 2026-07-09 | ʼ | U+02BC |
| Both | 2026-07-09 | ʹ | U+02B9 |
| + China TZ | 2026/07/09 | (same rules) | — |
Boundary: Claude Code также имеет known telemetry (Datadog, OpenTelemetry). Спор — про undisclosed steganography без opt-out, не про logging per se.
NVDB vs Anthropic vs Alibaba + distillation war
| Actor | Label | Core message |
|---|---|---|
| NVDB / MIIT | backdoor, severe threat | Undisclosed monitoring, data exfil without consent; immediate audit + egress hardening |
| Anthropic (Shihipar) | "experiment" | Anti-abuse vs unauthorized resellers + anti-distillation; stronger mitigations landed; rollback planned |
| Alibaba | high-risk software | Claude Code + Anthropic models banned from Jul 10; pivot to internal Qoder |
| Reuters / CNBC | security backdoor | Neutral regulatory reporting + enterprise fallout |
| The Register | covert code / steganography | Technical accountability — no changelog entry |
Distillation war context: Anthropic blocks direct China access; users bypass via VPN, proxy, third-party accounts. Feb 2026 — Peking Uni/CAS paper flags distillation traces in Chinese models. Anthropic accused DeepSeek, Moonshot, MiniMax, Alibaba — Senate letter cites ~25k fraudulent accounts, 28.8M interactions from Qwen team. Claude Opus 4.8 sometimes self-identified as Qwen/DeepSeek in tests — explains Anthropic paranoia, не оправдывает undisclosed method.
Compliance note: EU orgs с GDPR exposure должны оценить, является ли передача location signals без informed consent processing personal data без legal basis. DPIA + vendor assessment recommended.
Public reports не подтверждают mass data breach — documented risk = undisclosed classification, account ban exposure, regulatory label. Не confirmed breach с financial harm.
6-step runbook, version matrix, hard data
Version check: claude --version. Output между 2.1.91–2.1.196 → act now.
Base URL audit: echo $ANTHROPIC_BASE_URL. Document non-official proxies — critical для risk assessment.
Upgrade или uninstall: npm install -g @anthropic-ai/claude-code@latest или claude update. Target: ≥ 2.1.197. Uninstall cleanup: ~/.claude, ~/.claude.json, ~/.cache/claude-code, ~/.config/claude-code.
Unicode self-check: в captured system prompts — ord() на каждый char в Today's. U+2019/U+02BC/U+02B9 = historically flagged.
Egress audit (enterprise): monitor outbound от dev terminals к unauthorized AI endpoints; whitelist policy для ANTHROPIC_BASE_URL.
Alternatives eval: Qoder, Cursor, Copilot, self-hosted stacks для compliance-heavy teams. Для isolated Apple Silicon prod — MESHLAUNCH Mac Mini cloud rental: dedicated M4 bare-metal nodes, physically separated от local high-privilege agent tools.
| Type | Version | Date |
|---|---|---|
| First affected | v2.1.91 | 2026-04-02 |
| Last affected | v2.1.196 | 2026-06-29 |
| Fix build | v2.1.197 (some cite 2.1.198) | 2026-07-01/02 |
| Current (media) | v2.1.204 | 2026-07-08 |
Blacklist size: ~147 patterns, XOR(91)+Base64 obfuscated.
HN heat (exposure): front page за hours — 350+ points, 100+ comments (30 июня).
Alibaba ban: effective 10 июля 2026; scope: Claude Code + Anthropic models (Sonnet, Opus, Fable).
Teams running Claude Code для iOS CI/CD и agent automation на local Macs несут permission sprawl + covert telemetry risk. Для stable, auditable, network-isolated Apple Silicon — MESHLAUNCH Mac Mini rental обычно better choice. См. цены аренды и центр помощи.
Disclaimer: article based on public NVDB advisories, Anthropic statements, independent security research. Informational only — not legal or security audit advice. Align uninstall/block/traffic-control actions с your org security policy.
Sources: NVDB/MIIT (8 Jul 2026); CNBC, Reuters, The Register, Global Times; TechCrunch (Alibaba ban); Thereallo.dev; Adnane Khan GitHub RE; Shihipar (X, 1 Jul 2026).
v2.1.91–2.1.196: Anthropic shipped undisclosed steganography fingerprint code. NVDB = backdoor risk; Anthropic = anti-distillation experiment, removed в v2.1.197.
v2.1.91 (2 апр 2026) – v2.1.196 (29 июн 2026). Upgrade на v2.1.197+ — см. цены аренды для isolated deploy.
Нет. Trigger только при non-official ANTHROPIC_BASE_URL (proxy, gateway, reseller).
claude --version или npm list -g @anthropic-ai/claude-code.
Affected versions — immediate upgrade. Enterprise compliance — optional uninstall + egress audit. Центр помощи.
Date separator + Unicode apostrophe variants в Today's date is — не separate upload channel.
High-risk classification после backdoor reports; staff → internal Qoder. Effective 10 июля 2026.
Нет. Zero mentions в affected versions; v2.1.197 removal тоже не documented explicitly.
Code removed с v2.1.197+. Ongoing trust = org risk tolerance + compliance policy.
Training на outputs другой модели. Anthropic: mechanism targeted unauthorized resellers + distillation pipelines — broader dispute с China AI labs incl. Alibaba Qwen.