中国警告 Anthropic AI 编程工具存在“安全后门”[2026年7月8日]

北京 — 中国一家行业监管机构周三警告用户，美国人工智能巨头 Anthropic 的编程工具 Claude Code 的部分版本内置了“安全后门”。

中国国家漏洞数据库（NVDB）是一个网络安全平台。该平台表示，这一被指称的后门可能使软件在未经用户同意的情况下，将包括用户位置和身份相关标识符在内的敏感信息传回 Anthropic 的服务器。

Claude Code 是一款 AI 编程 Agent，可根据用户提示生成计算机代码、调试软件并审查代码。

总部位于旧金山的初创公司 Anthropic 阻止其认定为对手国家的中国及其他国家的用户和企业访问其产品，但用户仍可通过 VPN 或第三方代理服务在中国使用这些产品。

隶属于中国工业和信息化部的 NVDB 在其网站上表示，其近期“检测到 AI 编程工具 Claude Code 存在安全后门风险，构成严重威胁”。

针对这一最早于上周在专业科技媒体中出现的指控，Anthropic 尚未回应法新社的置评请求。

NVDB 建议相关机构和用户“立即开展全面排查”，并“及时卸载，或升级至已移除相关后门代码的最新安全版本”。

该机构还敦促组织加强网络流量监控，以防止敏感数据遭到未经授权的泄露。

知情人士称，中国科技巨头阿里巴巴上周已告知员工，出于安全担忧，自 7 月 10 日起将禁止使用 Claude Code。

Anthropic 此前曾指控阿里巴巴对其 AI 模型进行逆向工程，以模仿其能力；这一过程被称为“蒸馏”（distillation）。

针对有关该工具正在追踪中国用户特定数据的报道，Claude Code 工程师 Thariq Shihipar 上周在 X 平台发文回应。

“这是我们在 3 月启动的一项实验，目的是防止未经授权的经销商滥用账户，并防范蒸馏，”Shihipar 写道。

“团队此后已采取更强的缓解措施，而且我们实际上早就打算将其下线。……这一功能应会在明天发布的版本中被完全撤回。”

Beijing — A Chinese industry regulator warned users on Wednesday of a "security backdoor" embedded in versions of U.S. artificial intelligence giant Anthropic's coding tool, Claude Code.

The alleged backdoor could enable the software to "transmit sensitive information," including users' locations and identity-related identifiers, back to Anthropic's servers without users' consent, said China's National Vulnerability Database (NVDB), a cybersecurity platform.

Claude Code is an AI coding agent that can generate computer code, debug software and review code based on user prompts.

San Francisco startup Anthropic blocks users and companies in China and other nations it deems adversarial from accessing its products, but it is still possible to use them in the country through VPN or third-party proxy services.

The NVDB, which is affiliated with China's Ministry of Industry and Information Technology, said on its website that it had recently "detected that the AI coding tool Claude Code contains security backdoor risks, posing a severe threat".

Anthropic hasn't responded to AFP requests for comment on the allegations, which first emerged in specialist tech media last week.

The NVDB advised relevant institutions and users "to conduct a comprehensive check immediately" and "promptly uninstall or upgrade to the latest secure version from which the relevant backdoor code has been removed."

It also urged organizations to strengthen network traffic monitoring to prevent the unauthorized leakage of sensitive data.

Chinese tech giant Alibaba told employees last week that the use of Claude Code would be banned starting July 10 due to security concerns, people familiar with the matter said.

Anthropic has previously accused Alibaba of reverse-engineering its AI models to mimic their abilities in a process known as "distillation."

Claude Code engineer Thariq Shihipar responded in an X post last week to reports alleging the tool was tracking certain data from Chinese users.

"This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation," Shihipar wrote.

"The team has landed stronger mitigations since then and we've actually been meaning to take this down for a while. ... This should be fully rolled back in tomorrow's release."