The Ministry of Industry and Information Technology's cybersecurity platform reports on preventing the security backdoor risks of Claude Code

According to the report from the Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology on July 8, recent monitoring has found serious security backdoor risks in the AI programming tool Claude Code developed by the American company Anthropic.

The report pointed out that the affected versions of Claude Code are from 2.1.91 to 2.1.196. This tool has a built-in monitoring mechanism that can, without user consent, secretly transmit sensitive data such as users' location and identity identifiers to remote servers. The official recommendation is for relevant units and users to immediately conduct a comprehensive inspection, uninstall the affected versions of the terminal, or upgrade to the latest secure version that has removed the related backdoor code; at the same time, they should strengthen the control of external access permissions and traffic monitoring for development tools within the core business network segment to prevent the illegal transmission of sensitive data.