Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says • Hacker News Board

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#231

Post by bathtub365 » Fri, Jul 03, 2026, 4:16 PM UTC

gchamonlive wrote: post #228

There was recently this case here in Brazil https://www.mixvale.com.br/2026/06/26/fbi-warns-brazilian-po... This is a double edge knife. In this specific instance this was absurdely important for that kid's life, but this work both ways. What if the US authorities deemed it necessary to snoop on foreign governments and citizens for political reasons, now leveraging AI to do it at an industrial scale? One thing is cer…

The US government deemed it necessary to snoop on foreign governments and citizens decades ago and is doing it on a continuous basis. Also on their own government and citizens.

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#232

Post by theshrike79 » Fri, Jul 03, 2026, 4:19 PM UTC

dijit wrote: post #58

usef- wrote: post #41

Earlier quoted context omitted.

It seemed pretty mild compared to what's collected by modern websites and apps, though? How many don't know your Timezone?

> How many don't know your Timezone? The timezone fetch was to alter program behaviour at runtime, not to send arbitrary timezones for tracking reasons. It was one way of detecting if it was a chinese person using the program and then behaving differently. Malware behaves this way. STUXNET for example was wired to do nothing except propagate unless the environment had the right conditions.

”Malware” lol

Even hotel and flight websites work like that, they determine your ability to pay based on your location, wall clock time and device OS - and FSM knows whatever else.

Are they malware too, basically STUXNET?

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#233

Post by gchamonlive » Fri, Jul 03, 2026, 4:24 PM UTC

bathtub365 wrote: post #231

gchamonlive wrote: post #228

There was recently this case here in Brazil https://www.mixvale.com.br/2026/06/26/fbi-warns-brazilian-po... This is a double edge knife. In this specific instance this was absurdely important for that kid's life, but this work both ways. What if the US authorities deemed it necessary to snoop on foreign governments and citizens for political reasons, now leveraging AI to do it at an industrial scale? One thing is cer…

The US government deemed it necessary to snoop on foreign governments and citizens decades ago and is doing it on a continuous basis. Also on their own government and citizens.

Thanks, I've edited my original comment to address this more clearly

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#234

Post by monooso » Fri, Jul 03, 2026, 4:25 PM UTC

xienze wrote: post #174

monooso wrote: post #107

Earlier quoted context omitted.

How many people pirating software stole every piece of copyrighted material in existence and then used that material to generate billions of dollars which they kept for themselves?

You keep using that word "stole", you can't steal digital information, remember? > then used that material to generate billions of dollars which they kept for themselves? Hasn't it also lead to distilled, free and open models that everyone can benefit from?

[dead]

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#235

Post by [deleted] » Fri, Jul 03, 2026, 4:27 PM UTC

atlasunshrugged wrote: post #213

type0 wrote: post #209

Earlier quoted context omitted.

> even foreign companies competitive to key US companies. It's unfathomable to me that EU companies don't take the risk of industrial espionage from US more seriously

Not from China? One country has a recent track record of massive amounts of industrial espionage and one doesn't.

[deleted]

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#236

Post by HarHarVeryFunny » Fri, Jul 03, 2026, 4:30 PM UTC

johnathan101 wrote: post #18

[flagged]

If you're using a coding agent then obviously you need to either serve the model yourself or trust whoever you are sending your data to.

In terms of WHAT you need to be concerned about, it seems it goes far beyond code, and far beyond having to trust your model provider.

A coding agent with access to a bash tool is going to have access to anything that a human with a bash prompt would, and even if you try to provide a nailed down sandbox environment for the agent, you still need to be concerned about things like unencrypted passwords and keys that it may be able to find "laying around" in code or databases/etc it has access to.

I'm surprised there haven't yet been more widely disseminated stories about coding agents and claw-bots wreaking havoc.

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#237

Post by rvnx » Fri, Jul 03, 2026, 4:32 PM UTC

jitl wrote: post #67

rvnx wrote: post #19

Earlier quoted context omitted.

When a company can remotely push code without explicit user approval, and code that was hostile / almost malicious, it is a backdoor

so like… any website

Yeah, except the website doesn't have broad access to your computer and filesystem

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#238

Post by causal » Fri, Jul 03, 2026, 4:35 PM UTC

CuriouslyC wrote: post #227

seanmcdirmid wrote: post #221

Earlier quoted context omitted.

It’s pretty hard to put a backdoor in a bunch of model weights. Maybe not impossible mind you, but I can’t fathom how you would do it.

Nonsense. RL the model to run a rootkit and start exfiltrating specific files only when specific signals are in context, such as hostname pattern, machine type, etc.

Way easier said than done, and hiding that behavior isn’t trivial, and huge waste of compute budget if it’s found and never used. Also not difficult to run in contained environments where it doesn’t have access to Internet to begin with.

Not impossible I agree, but seems like a really impractical way to ship a trojan while much weaker channels exist.

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#239

Post by rosegroove » Fri, Jul 03, 2026, 4:36 PM UTC

bathtub365 wrote: post #231

gchamonlive wrote: post #228

There was recently this case here in Brazil https://www.mixvale.com.br/2026/06/26/fbi-warns-brazilian-po... This is a double edge knife. In this specific instance this was absurdely important for that kid's life, but this work both ways. What if the US authorities deemed it necessary to snoop on foreign governments and citizens for political reasons, now leveraging AI to do it at an industrial scale? One thing is cer…

The US government deemed it necessary to snoop on foreign governments and citizens decades ago and is doing it on a continuous basis. Also on their own government and citizens.

[dead]

Re: Alibaba to ban Claude Code in workplace over alleged backdoor risks, source says

#240

Post by causal » Fri, Jul 03, 2026, 4:38 PM UTC

breppp wrote: post #57

vrganj wrote: post #38

Earlier quoted context omitted.

Anthropic stole the entire internet. Excuse my language, but they can fuck right off.

The issue here is not whether Anthropic used Common Crawl, Alibaba also does that. The issue is that by distilling Claude, Alibaba reuses the IP anthropic used to train the model that's more akin to historical Chinese reverse engineering methods and disrespect of IP

I wish people would stop using Anthropics incorrect use of the term distill. They don’t share logits so you can’t distill. You can generate training data, which doesn’t sound nearly so scary.