On June 30, 2026, a Reddit user going by the handle LegitMichel777 discovered something unusual buried inside Claude Code version 2.1.196: a block of XOR-encrypted code that had been silently present since version 2.1.91, released on April 2. The code, first reported by MLQ.ai, checked for Chinese time zones, specifically “Asia/Shanghai” and “Asia/Urumqi,” and scanned for proxy URLs associated with the corporate networks of Alibaba, Baidu, ByteDance, and Moonshot AI. Anthropic’s engineer Thariq Shihipar confirmed the removal had been merged and the code was “fully rolled back.” The company simultaneously shut down Fable 5 and Mythos 5 globally, citing an inability to verify user nationality in real time.
The Distillation Attack That Triggered the Hidden Code
Anthropic’s explanation for the detection mechanism pointed directly at Alibaba’s Qwen AI lab. According to the company, Qwen ran what it described as the “largest known distillation attack” ever recorded: approximately 25,000 fake accounts generating 28.8 million exchanges between April 22 and June 5, 2026, systematically extracting knowledge from Claude to train competing models. A previous wave in February 2026 had already implicated DeepSeek, Moonshot AI, and MiniMax in similar campaigns.
Distillation attacks exploit the fact that a sufficiently large volume of carefully crafted queries can reverse-engineer a model’s capabilities without accessing its weights directly. The practice sits in a legal grey zone, but at the scale Anthropic described, it represents a significant intellectual property threat. The hidden detection code was Anthropic’s covert response, a way to identify and flag Chinese corporate traffic before it could be restricted.
The technical implementation went beyond simple timezone checks. Anthropic also used steganography, swapping Unicode apostrophe characters and date formats inside system prompts to create subtle fingerprints. The sophistication of the approach suggests the company had been tracking the problem for months before the Reddit discovery forced its hand.
US Senators Move Toward Sanctions
The disclosure galvanized Capitol Hill. Senators Bill Hagerty and Andy Kim are now drafting an amendment to the defense authorization bill that would impose sanctions on Chinese AI firms engaged in large-scale data extraction or intellectual property theft from US AI companies. The proposed measures could restrict Chinese AI firms’ access to US technology markets and critical infrastructure, adding a legislative dimension to what has until now been a largely technical and corporate dispute.
Alibaba’s stock has fallen roughly 24% over the past month, trading at $96.14 on the NYSE against a 52-week low of $91.99, with a market capitalization of approximately $231 billion. Alibaba itself announced a ban on Claude Code effective July 10, requiring employees to delete all Claude models from their systems. Baidu and ByteDance were also named in Anthropic’s detection lists and are evaluating their own internal bans.
The Broader Pattern: AI Espionage as Competitive Strategy
This episode is not an isolated incident. It reflects a structural feature of the current AI competition: the gap between frontier model capabilities and the cost of training from scratch is so large that distillation attacks have become a rational competitive strategy. For Chinese labs operating under export controls that limit access to the most advanced training hardware, extracting knowledge from frontier models through API queries is an attractive shortcut.
As EastFrontier has documented, China’s three major AI regulations enacted earlier this year focus heavily on data governance and algorithm transparency, but they do not address outbound data extraction from foreign models. That regulatory gap is now a live geopolitical issue.
Technical and Ethical Dimensions of Geo-Blocking AI
Anthropic’s use of encrypted detection logic raises difficult questions. On the technical side, embedding location-detection code directly into an AI tool is a blunt instrument: it risks false positives for legitimate users in China, and it can be circumvented by anyone routing traffic through a non-Chinese proxy. The rollback suggests Anthropic concluded the approach was not worth the reputational cost once it became public.
Ethically, covertly flagging users by location and network identifiers without disclosure challenges basic norms of user trust. The fact that the code was XOR-encrypted, a simple obfuscation technique, suggests Anthropic knew the detection mechanism would be controversial if discovered. The company’s swift acknowledgment and rollback reflect awareness of these sensitivities, but the underlying dilemma remains: how do AI companies enforce compliance with geopolitical constraints when real-time nationality verification on the internet is technically infeasible?
What Comes Next
The Anthropic-Alibaba episode is a preview of a broader conflict. As AI models grow more capable and the gap between frontier and second-tier systems widens, the incentive to run distillation attacks will only increase. US companies will face mounting pressure to build more robust technical countermeasures, while the legislative response from Hagerty and Kim could reshape the legal landscape for cross-border AI access.
For investors, the incident signals rising compliance and geopolitical risk for AI companies with international user bases. For the industry, it raises the question of whether AI governance frameworks, domestic or international, can keep pace with the rapid evolution of competitive dynamics. China’s State Council has already ordered a national survey on AI and jobs, signaling that Beijing is closely tracking the broader implications of the AI race. The hidden code episode suggests that Washington, too, is watching, just less openly.