Alibaba's Claude Ban Explained: The Truth Behind Three Converging Timelines

One Directive: The Entire Claude Ecosystem Flagged as High Risk

On July 3rd, Alibaba issued a company-wide internal notice banning the use of all Claude products — including every model in the lineup such as Sonnet and Opus — and classifying Claude Code specifically as high-risk software requiring immediate uninstallation, effective July 10th.

The scope of the ban exceeded many people's expectations. It wasn't a matter of restricting one particular model; the entire Claude ecosystem was packaged into the high-risk list in one sweep. Alibaba's stated rationale was straightforward: Claude Code had been reported to carry a backdoor implantation risk, and following an internal security assessment, the company opted for a clean cut.

For engineers who relied on Claude Code in their daily workflow, that door was now closed.

A 180-Degree Reversal in Under Six Months

What makes this particularly striking is that just six months ago, Alibaba's stance was the exact opposite.

Earlier this year, Alibaba was actively promoting AI adoption internally: internal models were made freely available, and external models including Claude, GPT, and Gemini all qualified for generous expense reimbursement. According to disclosures from those involved, frontline engineers were spending hundreds of dollars per week on external model API calls alone. Claude Code, OpenAI Codex, and Alibaba's own Coder were all high-frequency tools at the time.

In other words, engineers had barely adjusted to a "use whatever you want, the company will cover it" environment when they suddenly received notice that the whole suite had been flagged as high-risk. The same Alibaba went from encouragement to lockdown in the span of six months — a full 180-degree policy reversal.

That kind of dramatic turnaround is itself a signal. A routine security audit simply doesn't explain a shift of this magnitude. To find the real answer, you have to zoom out to a much broader context.

The Immediate Trigger: Anthropic's Distillation Attack Allegations

On June 24th, Anthropic submitted a letter to the U.S. Senate Banking Committee alleging that between April 22nd and June 5th, Alibaba had used approximately 25,000 fake accounts to conduct over 28 million conversations with Claude — characterizing it as an "industrial-scale model distillation attack" and framing the matter as a national security concern.

What is a "distillation attack"? Model distillation is a legitimate machine learning compression technique introduced by Hinton and colleagues in 2015. The core idea is to use the outputs of a large "teacher model" to train a smaller "student model," preserving most capabilities while dramatically reducing computational costs. However, when this technique is applied at scale to harvest outputs from a commercial API — replicating another company's model capabilities without authorization — it becomes what's known as a distillation attack. The crux of Anthropic's allegation is this: if 28 million conversations were systematically used to train Alibaba's own models, it would effectively amount to "stealing" the capability boundaries and alignment characteristics that Claude took years to develop, at minimal cost and without the associated R&D investment. This is why Anthropic elevated the matter to the level of commercial interests and national security — it's not just a copyright issue, but a question of controlling the proliferation of AI capabilities.

Following the submission of the letter, Anthropic significantly tightened its global risk management strategy.

Worth noting: the "distillation attack" framing wasn't new to Anthropic. Back in February, they published a technical blog post naming DeepSeek, Moonshot AI, and MiniMax as having conducted large-scale distillation from Claude. At the time, that piece had no particular political backdrop — it read as standard technical analysis.

This time, however, the targeting of Alibaba came at a strikingly different moment — precisely around the time Alibaba filed suit against the U.S. government. The same framing, deployed at a very different inflection point.

Three Timelines Converge: A Chronological Breakdown

Line up the key events, and the underlying logic becomes considerably clearer.

June 8th: Added to the 1260H List

The U.S. Department of Defense published its 1260H list, with Alibaba, Baidu, BYD, and other Chinese companies all included.

What does the 1260H list mean? The list stems from Section 1260H of the National Defense Authorization Act for Fiscal Year 2021, which authorizes the DoD to publish an annual roster of companies deemed to have ties to China's military. Being listed doesn't directly equate to sanctions, but it triggers a cascade of consequences: restrictions on federal procurement, some financial institutions proactively distancing themselves, and listed public companies facing investor pressure or even delisting risk. For Alibaba, inclusion on the list effectively foreclosed access to U.S. government procurement markets for its cloud computing and AI services, while simultaneously sending a clear political signal to global partners. This explains why Alibaba went straight to litigation: the "label effect" of the list far exceeds the direct economic harm, and with no formal administrative appeals process available, the courts are essentially the only outlet.

June 24th: Lawsuit and Allegations on the Same Day

Two events with remarkable timing overlap occurred on this single day:

• Alibaba filed suit in a California federal court against the U.S. Department of Defense, seeking removal from the 1260H list and submitting substantial supporting evidence.
• On that same day, Anthropic delivered its letter to the Senate Banking Committee alleging that Alibaba had conducted an industrial-scale distillation attack.

While Alibaba was in the process of building its legal case, the counter-allegation landed simultaneously. According to available disclosures, the U.S. Department of Defense has yet to respond to Alibaba's submitted evidence.

Set these three events side by side — being listed, filing suit, Anthropic submitting its letter — and the timing is too compressed to explain away as purely a technical security matter.

Late June to Early July: Mass Account Terminations

A wave of mass account bans followed. Anthropic terminated large numbers of Chinese user accounts — individual subscriptions and team accounts alike — without any advance warning. Users who had renewed through the official website and were flagged as violations received no refunds, and appeals channels proved essentially non-functional.

The Hidden Detection System Built Into Claude Code

How were accounts flagged with such precision? Developers who reverse-engineered Claude Code found the answer.

Starting with version 2.1.91, released in April of this year, the codebase includes a covert detection mechanism:

• Reading local timezone to infer the user's region
• Scanning proxy or custom API addresses for keywords associated with Chinese vendors such as Alibaba and ByteDance
• Using steganographic punctuation substitution within system prompts to tag individual users

How does steganography enable "invisible tagging"? Steganography is a technique for concealing information within a carrier medium in a way that makes it difficult to detect — historically applied to images and audio. The punctuation substitution method discovered in Claude Code is a text steganography variant: ordinary punctuation marks (such as commas and periods) are replaced with visually indistinguishable Unicode lookalike characters, embedding user identity tags within system prompts. The concealment is highly effective — a user reading the prompt directly would see nothing unusual, but the server can precisely identify the tag source by inspecting character encoding upon receiving the request. Combined with timezone reading and proxy address scanning, these three mechanisms together form a fingerprinting system capable of attributing regional identity without any awareness on the user's part. The engineering sophistication involved makes clear this was not a hasty patch, but a pre-designed compliance control infrastructure.

Members of the Claude Code team subsequently acknowledged the measures publicly, describing them as "experimental."

The direct consequences of this system were immediate: banned accounts received no refunds, and appeals went nowhere. Frontline engineers found their accounts terminated without warning, their workflows abruptly severed, and subscription fees already paid deemed non-refundable once a violation was determined. Appeals emails sent into the void received essentially no response.

More critically, this detection logic was designed specifically to target users in China's direction — not collateral damage from a neutral system, but deliberate by design.

A Geopolitical Contest That Has Moved Beyond the Technical

View the full sequence together: the distillation attack allegations, the mass account terminations, the detection system uncovered by reverse engineering — Alibaba's ban is simply the last piece of the puzzle falling into place.

When a user's timezone and proxy address can determine whether they're entitled to use a tool, the matter has long since left the purely technical domain. What it reflects is the reality that, against the backdrop of U.S.-China tech decoupling, AI foundational tools are becoming a new battleground for geopolitical competition.

It's worth noting that prior discussions of U.S.-China tech decoupling have largely focused on chips (such as GPU export controls) and hardware supply chains. This episode reveals that decoupling is now penetrating the software tooling layer. AI coding assistants have become deeply embedded in engineers' daily workflows: code completion, architecture suggestions, and debugging support now constitute the infrastructure of modern software development. When these tools can cut off service at any moment based on regional signals, "tool dependency" transforms into "tool risk." Once engineers develop habits around a particular tool, migration means retraining workflows, re-tuning prompt strategies, and absorbing short-term productivity losses — which means domestic alternatives are no longer just a policy slogan, but a real risk-hedging consideration for engineering teams.

For developers in China, this means reliance on overseas AI tools is becoming increasingly precarious — whether for model API calls or coding assistants, access can be cut off at any time based on a regional determination. This also indirectly explains why the push to advance domestic large models and homegrown development tools is becoming ever more urgent.

Note: The factual basis of this article draws primarily from the timeline compiled by Bilibili content creator "Matt," with certain technical details (such as the Claude Code built-in detection system) sourced from reverse-engineering analysis in the developer community. Readers are encouraged to consult multiple sources and draw their own conclusions.