Alibaba just drew a line in the sand. Starting July 10, its engineers lose access to Claude Code. The company has classified Anthropic's coding assistant as high-risk software and ordered staff to use Qoder, Alibaba's own alternative.
The move is reciprocal. Anthropic already bars Chinese companies from its models. The American startup has spent months plugging loopholes that let Chinese developers reach Claude through intermediaries. One of those plugs was a version of Claude Code designed to silently fingerprint Chinese users.
Anthropic calls it an experiment. Thariq Shihipar, a researcher at the company, confirmed on X that the detection system launched in March to "prevent account abuse from unauthorized resellers and protect against distillation." Distillation — the practice of training new models on the outputs of existing ones — is the bogeyman haunting every frontier lab. Anthropic fears Chinese actors are siphoning Claude's reasoning capabilities to bootstrap domestic competitors.
Shihipar added that "stronger mitigations" have since landed and the team had "been meaning to take this down for a while." Translation: the experiment got caught. The Reddit post exposing it forced Anthropic's hand.
Here is what neither side will say aloud. Anthropic built a tool to discriminate by geography, then deployed it without disclosure. Alibaba responded by banning the tool entirely and mandating a domestic replacement. Both actions are rational. Both accelerate the bifurcation of the global AI stack.
Model distillation works. A team with API access can generate millions of training pairs — prompts paired with high-quality responses — and use them to train a smaller, cheaper model that mimics the original's behavior. The technique powered early versions of Alpaca, Vicuna, and countless open-source projects. Frontier labs treat it as intellectual property theft. They are not wrong.
But Anthropic's response — secret user profiling — sets a dangerous precedent. If a model can silently tag you as "Chinese" and restrict functionality, it can tag you as anything. A competitor. A researcher. A journalist. The technical infrastructure for geographic discrimination is now proven and deployed. The only guardrail is corporate promise.
Promises break.
Alibaba's ban looks protective. It frames Claude Code as a security risk — data exfiltration, IP leakage, dependency on a hostile foreign service. The designation "high-risk software" carries bureaucratic weight in Chinese corporate governance. It justifies the mandate to switch to Qoder.
Qoder is Alibaba's answer to GitHub Copilot and Cursor. Built on the company's Qwen model family, it integrates with Alibaba Cloud infrastructure and keeps code inside the domestic perimeter. For Alibaba, the switch serves two masters: security compliance and strategic autonomy. Every engineer forced onto Qoder improves the tool through usage data and feedback. The flywheel spins faster.
Chinese developers lose access to what many consider the best coding model on the market. Claude 3.5 Sonnet sets the benchmark for reasoning, code generation, and instruction following. Qwen models are strong — increasingly competitive — but they trail the frontier. Alibaba has accepted that gap as the price of sovereignty.
This is not an isolated incident. The U.S. restricts chip exports to China. China restricts data exports and foreign AI services. American labs geofence their models. Chinese tech giants build walled gardens. The global AI commons is fracturing into two parallel ecosystems with different models, different tools, different standards.
Developers in Singapore, Dubai, or São Paulo will soon face a choice: which stack do they build on? The American stack offers frontier performance but political instability — access can be revoked by policy change or corporate decision. The Chinese stack offers reliability within its sphere but lags the absolute cutting edge.
Multinational corporations will run both. They have no choice. But startups and independent developers must pick. The cost of switching stacks — retraining, retooling, rearchitecting — creates lock-in. Lock-in creates monopoly power. Monopoly power raises prices and slows innovation.
Anthropic's secret experiment was deceitful. Alibaba's retaliatory ban is protectionist. Anyone claiming the moral high ground here is selling something.
Anthropic could have been transparent: "We are restricting access from China to protect our IP. Here is how we detect it." Instead, they hid the mechanism. The secrecy suggests they knew it would not withstand scrutiny. It did not.
Alibaba could have allowed engineers to choose their tools while monitoring for data leakage. Instead, it imposed a blanket ban that coincidentally eliminates a superior foreign competitor. The timing — right after the detection system was exposed — is convenient.
Both companies acted in rational self-interest. That is the problem. Rational self-interest in a zero-trust environment produces a fragmented, less productive world.
Expect more geofencing. Expect more secret detection. Expect more mandatory domestic tools. The technology to identify users by latency patterns, keyboard rhythms, code style, and network topology already exists. It will be deployed. The only question is whether any jurisdiction mandates disclosure.
The EU's AI Act requires transparency for high-risk systems. China's algorithm registry demands filing. The U.S. has nothing comparable. Anthropic's experiment would likely violate the AI Act if deployed in Europe. It operated in a regulatory vacuum.
Alibaba engineers will code in Qoder. Some will find workarounds — VPNs, intermediary accounts, local proxies. The cat-and-mouse game continues. Anthropic will build better detection. Alibaba will build better evasion. The arms race consumes resources that could have improved either model.
The real loser is not Alibaba or Anthropic. It is the developer in Shenzhen who cannot use the best tool for the job. The developer in San Francisco who cannot collaborate seamlessly with a counterpart in Hangzhou. The open-source project that must maintain two codebases for two incompatible AI assistants.
Fragmentation is a choice. Both sides are choosing it.