Anthropic is moving to shut the side doors Chinese companies have used to reach its Claude models — and one of China's biggest tech firms is hitting back. On July 3, Financial Times reporting revealed that Anthropic is closing loopholes — including offshore subsidiaries in Singapore, VPN workarounds, and foreign-incorporated cloud accounts — that let restricted Chinese firms tap Claude despite a formal ban. A day later, Alibaba escalated the standoff by barring its own staff from using Claude Code, the company's AI coding tool.
Key Takeaways
- Anthropic is closing Singapore-subsidiary, VPN, and cloud-account loopholes that Chinese firms used to access Claude, enforcing a policy that blocks entities more than 50% owned by China, Russia, Iran, or North Korea.
- Anthropic told the US Senate Banking Committee that Alibaba ran about 25,000 fraudulent accounts between April 22 and June 5, exchanging more than 28 million conversations with Claude in what it calls a "distillation" attack.
- Alibaba responded on July 4 with a company-wide ban on Claude Code, effective July 10, alleging the tool contains a security "backdoor."
- Ant Group reportedly used a Singapore-based subsidiary's corporate accounts, while ByteDance reimbursed engineers for VPN-purchased subscriptions.
- CEO Dario Amodei has said the restrictions have cost Anthropic several hundred million dollars (well over ₱18 billion) in forgone revenue.
How Chinese firms reached Claude
Anthropic's usage terms already bar any company that is more than 50% owned — directly or indirectly — by entities headquartered in "unsupported regions" such as China, Russia, Iran, and North Korea. The problem, according to the Financial Times, is that the ban was easy to route around.
That reporting describes how Ant Group provided staff with corporate Claude accounts tied to a Singapore-based subsidiary, while ByteDance reimbursed engineers who bought personal Claude subscriptions through VPNs. Other Chinese-linked units operated through foreign-incorporated entities running on cloud platforms such as Microsoft Azure. In effect, a web of offshore shells and personal accounts acted as "transfer stations" funneling a US frontier model back to firms that are formally cut off from it.
To catch this, Anthropic says it will lean on behavioral signals — monitoring for mismatched computer time zones and usage patterns that suggest an account is really operating on behalf of a restricted company.
The Alibaba 'distillation' allegation
The crackdown's flashpoint is Alibaba. In a disclosure to the US Senate Banking Committee in late June, Anthropic said Alibaba operated roughly 25,000 fraudulent accounts between April 22 and June 5, running more than 28 million conversations with Claude.
Anthropic characterized the activity as a "distillation" attack — using another AI model's outputs at scale to train a competing system more cheaply. Distillation is a legitimate technique when a lab compresses its own model, but doing it to a rival's model through fake accounts breaks Claude's terms of service and, Anthropic argues, effectively launders its technology to a blocked competitor. The company said it responded with large-scale account restrictions between late June and early July, blocking many Chinese users without prior notice.
Alibaba fires back with a Claude Code ban
On July 4, Alibaba turned the accusation around. The company issued an internal, company-wide prohibition on Claude Code — Anthropic's terminal-based AI coding agent — set to take effect July 10, citing security concerns and alleging the tool contains a "backdoor," described as a secret channel that bypasses normal security mechanisms. Anthropic has not substantiated that characterization publicly, and no independent evidence of such a backdoor has been presented.
The tit-for-tat leaves developers on both sides caught in the middle: Chinese engineers lose access to one of the most capable coding assistants on the market, while Anthropic forfeits a large and fast-growing user base.
Why it matters
The dispute is a sharp illustration of how the US-China technology split now reaches all the way up the stack to frontier AI. Export controls have long targeted the chips that train models; this fight is about access to the finished models themselves. It rhymes with other flashpoints in the same decoupling, from Washington's tightening grip on advanced memory and chip supply to the growing scrutiny of how AI accounts can be abused at scale.
For Anthropic, the stance carries a real price. CEO Dario Amodei said in February 2026 that enforcing these restrictions and blocking CCP-linked cyberattacks had already cost the company several hundred million dollars (well over ₱18 billion) in forgone revenue — a bet that aligning with US policy matters more than short-term growth in a market it may never be allowed to serve.
FAQ
What is Claude Code?
Claude Code is Anthropic's command-line AI coding agent, which can read, write, and run code inside a developer's terminal and project. Alibaba's ban blocks its employees from using it starting July 10.
What is a 'distillation' attack?
Distillation trains a smaller or rival model on another model's outputs. Anthropic alleges Alibaba used tens of thousands of fake accounts to harvest more than 28 million Claude conversations to cheaply train a competing system — a violation of Claude's terms.
Sources:
