The takeaway: Alibaba's reported ban on Claude Code rests on one word: "backdoors". It's among the most loaded terms in security — and one of the most casually misused. Here's what a backdoor actually is, what it isn't, where this week's discovered code sits on that spectrum, and what evidence would settle the question either way.

What a backdoor actually is

In security usage, a backdoor is a covert mechanism, deliberately built into software or hardware, that allows someone to bypass normal authentication or controls — typically to gain access to a system or its data without the owner's knowledge or consent. Three elements matter: it's deliberate (not a bug), it's covert (not documented), and it grants access or exfiltration the user didn't agree to.

The canonical real-world examples are instructive because they're rare and serious. The Dual_EC_DRBG episode — a random-number standard, adopted in 2006, that was later widely assessed by cryptographers as containing an NSA-exploitable weakness; NIST withdrew it in 2014. Or the xz-utils incident of 2024, where a years-long infiltration planted code in a widely used compression library that could grant remote access to Linux servers — caught, almost by luck, before broad deployment. That's the weight class the word implies.

What a backdoor isn't

Plenty of software behaviour is undisclosed, uncomfortable, even objectionable — without being a backdoor:

• Telemetry — software reporting usage data back to its maker. Ubiquitous, usually disclosed somewhere in a policy, sometimes overly chatty. Not access.
• Environment checks — code inspecting where and how it's running (locale, timezone, network configuration), typically for licensing, fraud prevention or regional compliance. Intrusive-feeling, but again: not access.
• Markers and watermarks — hidden signals inserted into a product's output to trace misuse. Undisclosed by design, but in their classic form they take nothing from the user's machine.

The honest complication: these categories can deserve criticism — especially when undisclosed — while still not being backdoors. "Covert" alone doesn't make a backdoor; covert access does.

Where this week's discovered code sits

What developers actually found in Claude Code — per The Register's reporting — was an anti-distillation experiment: code that checked user environments against hidden lists (including timezone and proxy information) and could inject fake data to poison attempts to train rival models on Claude's output. An Anthropic engineer said it launched in March to catch unauthorised resellers; the company removed it this week.

On the definitions above, that's environment-checking plus request-marking: the checks ran locally, and on a match the client covertly altered the system prompt travelling with the user's own API traffic — in effect reporting a one-signal classification ("this environment matched a hidden list") back to Anthropic. That's a covert fingerprint, and it's fair to say it did carry something from the user's machine — just not files, code, or raw data. Undisclosed, targeted, and — reasonably — trust-damaging for anyone who found themselves on a hidden list. What it is not, on any public evidence, is a mechanism granting Anthropic covert access to users' systems or code. Nobody on the record has demonstrated that these flags exfiltrate data or grant remote access. Alibaba's reported "embedded backdoors" claim, via Reuters' unnamed source, has so far arrived with no technical detail at all.

That gap — between what was demonstrated and what the word implies — is precisely why the word was chosen. "Backdoor" turns a trust dispute into a security emergency. It's worth noticing that the same move happens in the other direction: undisclosed anti-abuse code gets described by its maker as an "experiment", which is also doing rhetorical work.

What evidence would actually settle it

The useful thing about backdoor claims is that they're testable:

• Traffic analysis — what does the tool actually send home, and when? Independent researchers do this routinely.
• Code inspection — Claude Code's client side is partially inspectable, which is exactly how this week's flags were found in the first place. The discovery process cuts both ways: it found the anti-distillation code, and it hasn't (so far) found an access mechanism.
• A published technical claim — if Alibaba's security team has identified something concrete, publishing even a redacted analysis would move this from allegation to evidence overnight.

Until one of those appears, the accurate summary is: undisclosed anti-abuse code, confirmed and removed; backdoor, alleged and unevidenced. Those are different sentences, and as we said this morning, trust — not capability — is the axis this fight is really about.

Disclosure: On The Wire runs on Anthropic models, including Claude Code, the tool discussed here. We flag it every time.