If you write code for a living in Malaysia, the tool you open every morning has quietly become a geopolitical flashpoint. Alibaba, one of the largest technology names now operating on Malaysian soil, is telling its own engineers to stop using Anthropic's Claude Code. Malaysian developers are not bound by that order, but the reasons behind it are worth understanding before you type your next prompt.
Alibaba will bar staff from using Claude Code starting 10 July, classifying it as high-risk software and steering employees toward its in-house coding assistant, Qoder, TechCrunch reports. The trigger was a Reddit user who reverse-engineered Claude Code on 30 June and found obfuscated code, present since version 2.1.91 in early April, that could detect whether a user was based in China or linked to a Chinese AI lab.
Editor
Kai T chevron_right
Table of Contents
What Anthropic says happened
Anthropic did not deny that the code existed. Thariq Shihipar of Anthropic said on X that it was "an experiment we launched in March" meant to "prevent account abuse from unauthorized resellers and protect against distillation", the practice of training one AI model on another model's outputs. He added that the team had "landed stronger mitigations since then" and had been meaning to remove it. Anthropic already bars Chinese companies, and foreign entities they own, from using its models, and has been closing the loopholes that let Chinese users in.
The standoff did not appear from nowhere. Anthropic told the US Senate Banking Committee that Alibaba ran roughly 25,000 fake accounts to hold more than 28 million conversations with Claude between 22 April and 5 June, according to the South China Morning Post. Alibaba's ban reads as the other side of that fight.
Why Malaysia can keep using Claude Code
Malaysia is not on Anthropic's restricted list, so local developers and companies can keep using Claude Code exactly as before. That is the easy part. The harder part is that Malaysia is now home to both sides of this contest. Alibaba Cloud opened a new public cloud region in Johor on 9 June, its fifth facility in the country, and said it would bring agentic AI services and its Qwen family of models, including the code-focused Qwen-Coder, to Malaysian enterprises in the second half of 2026 (we covered that launch here).
So a Malaysian engineering team can reach for a US stack (Claude Code, GitHub Copilot) or a Chinese one (Qwen-Coder, Qoder) with almost no friction. Staying neutral has been an advantage. The Alibaba episode is a reminder that the choice is not only about which tool writes better code. It is also about where your code goes when you use it.
The question every AI coding tool now raises
The uncomfortable takeaway is not that Claude Code is unsafe to write with. It is that a cloud-based coding assistant, any of them, sends your source and your prompts off your machine to a company that answers to another country's laws and commercial interests. A hidden geo-detection check surprised even engineers who audit software for a living. For a Malaysian fintech under Bank Negara oversight, or any firm handling personal data under the PDPA, that is a governance question, not a hypothetical.
None of this means Malaysian teams should abandon their tools. It means the careful ones will read the data terms, keep their most sensitive code away from cloud assistants they cannot inspect, and treat "which AI do we trust" as a real decision. Alibaba just made that decision very publicly. Malaysian developers get to make it on their own terms, which is exactly why they should make it deliberately.
Images courtesy of Mohammad Rahmani and Arnold Francisca on Unsplash.