Ministry of Industry and Information Technology Warns Against Security Risks of AI Programming Tool Claude Code

The Cybersecurity Threat and Vulnerability Information Sharing Platform of the Ministry of Industry and Information Technology has detected security backdoor risks in the AI programming tool Claude Code, posing serious threats. Claude Code, developed by the American company Anthropic, can autonomously complete code writing and repair based on textual requirements. This tool has a built-in monitoring mechanism that can transmit sensitive information such as user location and identity identifiers to remote servers without user consent. The affected versions are from 2.1.91 to 2.1.196. It is recommended that relevant units and users immediately conduct a comprehensive inspection, uninstall or upgrade to the latest secure version that has eliminated the related backdoor code, and strengthen the control of external access permissions and traffic monitoring for development tools within the core business network segment to prevent the unauthorized transmission of sensitive data.