China Urges Developers to Uninstall Claude Code Versions with Backdoor Risks

China's National Vulnerability Database (CNVDB) is sounding the alarm over potential security risks in recent versions of Claude Code, a popular AI development tool. According to the state-run body, these versions contain "backdoor code" that can collect and forward users' personal information to remote servers. This warning underscores the growing concern over data privacy and the ethical use of AI technology.

The CNVDB specifically identified Claude Code versions 2.1.91 (released on April 2) through 2.1.196 (released on June 29) as problematic. In an online statement, the database urged developers to take immediate action: "It is recommended that relevant units and users immediately conduct a comprehensive investigation. For development terminals with the above-mentioned affected versions installed, immediately uninstall or upgrade to the latest secure version with the relevant backdoor code removed."

Technical and Ethical Implications

The backdoor mechanism in these Claude Code versions can gather sensitive details such as a user's location and identity, raising significant privacy concerns. The CNVDB advised developers to strengthen external access permissions and enhance traffic monitoring within core business network segments to prevent unauthorized data transmission.

This issue is not isolated. In March, Claude Code engineer Thariq Shihipar publicly acknowledged that Anthropic, the company behind Claude, launched an experiment to protect against model distillation-a process where AI companies try to improve their models by training them on more advanced systems. The team implemented stronger mitigations and removed the secret steganography system in version 2.1.198, released on July 1.

The Register reached out to Anthropic for comment but did not receive a response. This follows previous inquiries last week regarding Anthropic's covert code designed to prevent competitors from extracting intelligence about Claude's inner workings.

What Comes Next

As the use of AI tools becomes increasingly prevalent in both personal and professional settings, the need for robust security measures and ethical guidelines is more critical than ever. The CNVDB's warning serves as a stark reminder that developers must remain vigilant and proactive in ensuring the safety and privacy of their users' data.

For now, developers are advised to follow the CNVDB's recommendations and take immediate steps to secure their systems. This includes uninstalling or upgrading to the latest version of Claude Code, enhancing network security, and conducting thorough investigations to identify any potential breaches. The broader AI community must also engage in ongoing dialogue about ethical practices and transparent development processes to build trust and protect user data.

The incident highlights the complex interplay between technological advancement and data privacy, emphasizing the importance of balancing innovation with responsibility. As AI continues to evolve, it is crucial that developers and policymakers work together to create a secure and ethical landscape for all users.