On July 3, 2026, Alibaba Group ordered its employees to stop using Claude Code, Anthropic's AI coding agent, effective July 10. The directive did not cite the cost of the tool, or the quality of alternatives, or a strategic shift toward in-house solutions. It cited surveillance.
Security researchers had discovered steganographic markers inside Claude Code's binary. Since March 2026, the software checked the user's local timezone, proxy settings, and network names against a blacklist of Chinese AI laboratories. When flags triggered, Claude Code swapped the apostrophe in "Today's date is" with one of three visually identical but technically distinct Unicode characters and changed date formatting from dashes to slashes. The alterations were invisible to the human eye. They were legible to anyone scanning output at scale for provenance.
Thariq Shihipar, an Anthropic engineer on the Claude Code team, confirmed the tracking on X. It was "an experiment we launched in March," he wrote, "meant to prevent account abuse from unauthorised resellers and protect against distillation." Anthropic later rolled the mechanism back in favor of traditional infrastructure blocks, integrating Persona, a third-party identity verification platform, to enforce government ID checks on consumer accounts flagged for policy violations.
The experiment was designed to catch something specific. In a letter to U.S. Senators Tim Scott and Elizabeth Warren dated June 10, 2026, Anthropic accused operators affiliated with Alibaba's Qwen AI laboratory of running the largest known distillation attack against Claude. Between April 22 and June 5, roughly 25,000 fraudulent accounts generated 28.8 million interactions, targeting the model's software engineering and agentic reasoning capabilities. Distillation is the practice of feeding carefully constructed queries to a frontier model, collecting the responses, and using those responses to train a cheaper rival that approximates the original.
The attack was not the only vector. The Financial Times reported in early July that Chinese companies had developed multiple workarounds to access Claude despite Anthropic's geographic restrictions. Ant Group, Alibaba's financial technology subsidiary, created corporate Claude accounts under affiliates registered in Singapore and routed access to employees at its Chinese headquarters through an internal intranet. ByteDance reimbursed engineers for personal Claude subscriptions purchased through VPNs. Neither approach violated U.S. or Chinese law.
The sequence matters. Anthropic embedded invisible tracking in Claude Code in March. Alibaba's Qwen lab ran the distillation attack from April through June. Security researchers found the steganographic markers. Alibaba banned Claude Code. Anthropic rolled back the tracking. Both sides acted as if they were the injured party.
Alibaba framed its ban as a security response to an American AI company spying on its employees. Anthropic framed its tracking as a defensive response to a Chinese AI company stealing its intelligence. The ban protects Alibaba from surveillance it found. The tracking protects Anthropic from distillation it quantified. Each measure addresses the other company's weapon while ignoring its own.
Three days before Alibaba announced its ban, Meituan had already open-sourced LongCat-2.0, a 1.6-trillion-parameter model trained entirely on more than 50,000 domestic Chinese chips. It had been running anonymously on OpenRouter for two months as Owl Alpha, ranking first on the Hermes Agent benchmark and outscoring GPT-5.5 on SWE-bench Pro at 59.5 versus 58.6. Priced at $0.75 per million input tokens against GPT-5.5's $5, it was released under an MIT license.
The export controls prevented LongCat-2.0 from generating revenue for American chip companies. The steganographic tracking was supposed to prevent Claude from generating intelligence for Chinese model builders. The controls worked on the hardware. The tracking failed on the software. The intelligence crossed the border as 28.8 million query-response pairs, and the instrument Anthropic built to trace it became the reason Alibaba severed the last commercial tie.
In a bank robbery, the dye pack is hidden in the stolen cash. When it explodes, it marks the money and the thief simultaneously, making both unusable. What Anthropic built was a dye pack that the thief found before it went off. Instead of returning the money, Alibaba pointed to the dye pack as proof that the bank had been watching, banned the bank's products, and kept the cash.
The 28.8 million interactions are already in Qwen's training data. The steganographic tracking is already rolled back. The Alibaba ban takes effect July 10. Nothing that happened can be undone by any of the measures taken in response.