What security backdoor risks did China’s NVDB detect in Claude Code?

Question

Accepted Answer

China's NVDB Warned of Security Backdoor Risks in Claude Code, Anthropic Cites Anti-Abuse Measures

China's National Vulnerability Database (NVDB) issued a warning regarding "security backdoor risks" in certain versions of Anthropic's Claude Code, describing them as posing a "severe threat." Anthropic, however, clarified that the mechanism in question functions as an anti-abuse measure designed to detect fraudulent activity and unauthorized access. This feature was reportedly an experiment intended to prevent account misuse and protect against AI model distillation.
Mechanism Checked Device Timezone and Domain Routing

The mechanism identified by China's NVDB was described by Anthropic as one that examined a device's timezone. Furthermore, it assessed whether a user's request was being routed through a domain associated with an unsupported region or a known problematic entity. Anthropic maintained that this process is a standard industry practice for identifying and mitigating fraud and abuse within digital services.
Experiment to Prevent Unauthorized Resellers and Distillation

According to Claude Code engineer Thariq Shihipar, the feature was an experimental initiative launched in March. Its primary objectives were to thwart account abuse originating from unauthorized resellers and to safeguard against the process of AI model distillation. Distillation refers to the practice where one AI model's capabilities are mimicked or extracted by another, a concern for companies like Anthropic.
Stronger Mitigations Implemented and Feature Slated for Rollback

Shihipar further indicated that following the initial experiment, stronger mitigation strategies have been put in place. The feature was reportedly intended for rollback and was slated to be fully removed in a subsequent release. This suggests that the company was aware of the need to revise or discontinue the specific implementation that raised concerns.

Reading history

Hide →

This history is cleared when the page is closed.

What security backdoor risks did China’s NVDB detect in Claude Code?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends