Alibaba To Ban Claude Code In Workplace Over Alleged Backdoor Risks 23
Alibaba has reportedly banned employees from using Anthropic's Claude Code and directed them to its own Qoder platform amid a growing dispute over features that can help identify China-linked users. Reuters reports: The ban is part of a deepening spat between the two companies after Anthropic accused Alibaba of illicitly extracting its Claude AI model capabilities -- a dispute that highlights the frantic race between the U.S. and China to take the lead in artificial intelligence. [...] Anthropic said last month that it had suffered a strike by Alibaba, which it described as a "distillation" effort that involves training a less capable model on the outputs of a stronger one. The distillation helps accelerate China's ability to reach Anthropic's advanced Mythos Preview capabilities, it said in a letter seen by Reuters that was sent to two U.S. senators.
Alibaba's ban comes just days after developers said Claude Code contained mechanisms that inspected user environments, including timezone and proxy-related information, and inserted subtle markers into prompts sent to Anthropic's servers. An Anthropic employee wrote on Tuesday on X that the feature was "an experiment we launched in March" intended to prevent account abuse by unauthorized resellers and protect against model distillation. The person who spoke to Reuters about Alibaba's ban said that Anthropic's restrictions targeting China were difficult to enforce on individual users who can deploy servers in the United States and make traffic appear as if it originated there. But companies were more aware of legal and compliance risks, the person added.
Alibaba's ban comes just days after developers said Claude Code contained mechanisms that inspected user environments, including timezone and proxy-related information, and inserted subtle markers into prompts sent to Anthropic's servers. An Anthropic employee wrote on Tuesday on X that the feature was "an experiment we launched in March" intended to prevent account abuse by unauthorized resellers and protect against model distillation. The person who spoke to Reuters about Alibaba's ban said that Anthropic's restrictions targeting China were difficult to enforce on individual users who can deploy servers in the United States and make traffic appear as if it originated there. But companies were more aware of legal and compliance risks, the person added.
Backdoor risks? (Score:2)
Did Slashdot just become a porn site?
Re:Backdoor risks? (Score:5, Funny)
I am surprised it took so long ... (Score:5, Interesting)
The other copyright risk is, of course, that AI-generated code does not have any copyright. If you use your own LLM, you may at least be able to obscure that origin and muddy the waters.
Re: I am surprised it took so long ... (Score:2)
Any LLM can probably rename your variables, function calls, etc. IANAL, but it may be difficult to prove if copyrighted code was used, if it wasn't just copy and pasted.
A big unresolved problem is the license of the code the dataset was trained on, also.
In the case of book authors getting ripped off, it was regurgitated unmodified, and thus easier to litigate. But LLMs could paraphrase also, and make it harder.
Re: (Score:2)
Proving it was stolen can be hard, agreed. But the LLM code does not have copyright and anybody copying it from you is not committing a crime.
Re: (Score:2)
Why do people talk about copyright that much. Software has two basic modes. Code available and you have to assume people take parts of it without even telling you and close source. Yeah, you can sure for your GPL code. Good luck proving Microsoft is using it in some closed component!
Re: (Score:3)
Why do people talk about copyright that much.
Because all the code we write is copyrighted by default. It is an important aspect of our craft. If you do not consider yourself a craftsman, as a programmer then you are just a code monkey.
Good luck proving Microsoft is using it in some closed component!
They used a lot of BSD [betanews.com], but that was noticed. The entire Windows 2000 source code was leaked, so it wasn't hard to check if open source was used (just time consuming).
Nowadays Microsoft contributes to open source [github.com] because they want people to use Azure Cloud.
Re: (Score:2)
That was noticed, because they have no problem complying with the BSDL. They name the authors and tell the code is BSDL and have done their obligations. Why should they break the license when the license allows them everything they need?
Re: (Score:2)
Why should they break the license when the license allows them everything they need?
I'll answer your stupid rhetorical question with a stupid rhetorical question of my own:
Why should Microsoft break the license when they can just write whatever code they want?
Re: (Score:2)
You post contains exactly the same question as my post. So I wonder why you think it would be your own question. Or did you think my question is public domain? ;)
Re: (Score:2)
Oops, got the wrong post, excuse me. So you want them to write it themselves. But why should they, if they can license it under a license that just requires them to give attribution?
Re: (Score:2)
When they did use open source, people noticed.
Most of the time Microsoft writes their own, they don't need to copy open source.
Re: (Score:2)
He is wrong. Binary forensics can now pretty much prove something was compiled from specific sources. When you use LLMs for it, code obfuscation does help a bit, but there are other ways and tools. In particular command and data-flow are impossible to hide. Also remember this is civil law, so the burden of proof is much lower.
I expect there will be tools that can identify code was written by an LLM in the future. This does not prove it has no copyright, but it does have an effect very important in the legal
Re: (Score:2)
Re: I am surprised it took so long ... (Score:2)
I haven't seen author's names in LLM generated code. I have seen signstures in LLM generated images.
Backdoor risks? (Score:2)
DPMS, governance, pretool use hooks, post tool use, auditability and so on need to be used with practically any LLM.
As they say, always use protection ðY
What's there to allege? (Score:2)
Claude Code is fundamentally a platform that calls a remote blackbox to tell it what it's supposed to do. There's no back; there's a back loading ramp for the trucks hauling shit back and forth.
My boss went out of his way to make it clear we're expected to use it, so I don't care. But also, it's laughable he's precious about so many security things and at the end of the day just feeds the whole codebase into the plagiarism machine. IMHO we might as well just open source but I guess at this point the bigger
dogfooding (Score:2)
If you have your own product, telling your staff to use it instead of the competitors product is common sense.
Tit for Tat retaliation. (Score:2)
- it's the China way - just don't get caught.