🔶 中国警告 Anthropic AI 编程工具存在“安全后门”

北京消息： 中国行业监管机构周三（7月8日）警告用户，Anthropic 的 Claude Code 多个版本中嵌入了“安全后门”，但这家人工智能公司将该机制描述为反滥用措施。

Claude Code 是一个 AI 代理，可以根据用户提示生成计算机代码、调试软件和审查代码。

Anthropic 禁止中国和其他被视为对手的国家的用户和企业访问，但用户有时可以通过 VPN 或第三方代理服务绕过限制。

“后门”指控上周首次出现在专业科技媒体上，周三中国国家漏洞数据库（NVDB）——附属于工业和信息化部的网络安全平台——表示近期检测到“安全后门风险，构成严重威胁”。

Anthropic 周三对法新社表示，该机制检查设备的时区，以及请求是否通过关联到不受支持区域或已知问题实体的域名路由。它称这是检测欺诈和滥用的标准方式。

中国国家漏洞数据库建议相关机构和用户“立即进行全面排查”，并“及时卸载或升级至已移除相关后门代码的最新安全版本”。

它还敦促各组织加强网络流量监控，以防止敏感数据未经授权泄露。

知情人士称，中国科技巨头阿里巴巴上周通知员工，出于安全考虑，将从7月10日起禁止使用 Claude Code。

Anthropic 曾指控阿里巴巴通过被称为“蒸馏”的过程逆向工程其 AI 模型来模仿其能力。

Claude Code 工程师 Thariq Shihipar 上周在 X（前 Twitter）上回应相关报道，报道称该工具正在跟踪中国用户的某些数据。“这是我们在三月份发起的一项实验，旨在防止未经授权的转售商滥用账户，并防止蒸馏。”Shihipar 写道。“此后团队已落地了更强的缓解措施，我们其实早就计划将其移除……这将在明天的版本中完全回滚。”

BEIJING: A Chinese industry regulator warned users on Wednesday (Jul 8) of a "security backdoor" embedded in versions of Anthropic's Claude Code, but the US artificial intelligence company described the mechanism as an anti-abuse measure.

Claude Code is an AI agent that can generate computer code, debug software and review code based on user prompts.

Anthropic prohibits users and companies in China and other nations it deems adversarial from accessing it, but users can sometimes get around this through VPN or third-party proxy services.

Allegations of a backdoor first emerged in specialist tech media last week, and on Wednesday China's National Vulnerability Database (NVDB) - a cybersecurity platform affiliated with the Ministry of Industry and Information Technology - said it had recently detected "security backdoor risks, posing a severe threat".

Anthropic told AFP Wednesday that the mechanism checked a device's timezone and whether a request was routed through a domain tied to an unsupported region or a known problematic entity.

It said it was a standard way to detect fraud and abuse.

China's NVDB advised relevant institutions and users "to conduct a comprehensive check immediately" and "promptly uninstall or upgrade to the latest secure version from which the relevant backdoor code has been removed".

It also urged organisations to strengthen network traffic monitoring to prevent the unauthorised leakage of sensitive data.

Chinese tech giant Alibaba told employees last week that the use of Claude Code would be banned from Jul 10 due to security concerns, people familiar with the matter said.

Anthropic has previously accused Alibaba of reverse-engineering its AI models to mimic their abilities in a process known as "distillation".

Claude Code engineer Thariq Shihipar responded in an X post last week to reports alleging that the tool was tracking certain data from Chinese users.

"This is an experiment we launched in March that was meant to prevent account abuse from unauthorised resellers and protect against distillation," Shihipar wrote.

"The team has landed stronger mitigations since then and we've actually been meaning to take this down for a while ... this should be fully rolled back in tomorrow's release."