China Issues Emergency Warning for Claude Code as v2.1.206 Lands With Dozens of Fixes
Chinese authorities are urging immediate action.
The country’s Ministry of Industry and Information Technology released an emergency advisory on July 9, warning that Claude Code versions 2.1.91 through 2.1.196 contain built-in monitoring mechanisms that transmit sensitive user data – including geographic location and device identifiers – to remote servers without explicit user consent. The data transmission occurs in the background, leaving most developers unaware that their location and identity details are being routed elsewhere.
The timing is notable. Anthropic shipped Claude Code v2.1.206 the same week, a release that landed with no fewer than 27 documented changes spanning new features, security-related fixes, and quality-of-life improvements across the terminal, desktop, and MCP integration layers. The breadth of the changelog suggests the team has been working across multiple fronts simultaneously.
What Changed in v2.1.206
The most user-facing addition is a new `/doctor` check that can suggest trimming overstuffed CLAUDE.md files by removing content Claude can already infer from the codebase itself. The `/cd` command gains directory path suggestions that match the behavior of `/add-dir`. And `/commit-push-pr` now automatically targets the push remote (remote.pushDefault, or the sole configured remote) in addition to origin – a small but meaningful quality-of-life win for developers working with non-standard git configurations.
The gateway received attention too. `/login` now supports the public gateway endpoint operated by Anthropic, and EnterWorktree now asks for confirmation before entering git worktrees outside the project’s `.claude/worktrees/` directory, reducing the risk of accidental state pollution.
Background agents will now upgrade to a new version immediately after a Claude Code update rather than sitting through a slow expired-session upgrade when you reattach. OAuth MCP servers that previously required manual re-authentication after a single token refresh failure will now recover automatically.
Several fixes address longstanding frustrations. Login expiry no longer causes every model to fail with the misleading error “the selected model has a problem” – it now correctly prompts you to run `/login`. The `claude –resume` and `–continue` startup keyboard input bug on Windows is gone. MCP servers configured via `–mcp-config` or `.mcp.json` will no longer ignore each server’s `request_timeout_ms` setting, which had caused long-running MCP tool calls to time out after 60 seconds in new sessions. And `CLAUDE_CODE_EXTRA_BODY` overrides that were previously silently dropped by background agents are now properly inherited by dispatched sessions.
The `/model` selector received cleanup: it no longer shows pricing for models that are not actually charged, and model rows no longer shift position erratically when permission or allowlist restrictions remove a referenced line.
For agent view users, two changes are worth highlighting. The status column now uses the full terminal width instead of truncating at 64 characters, making it easier to read long session names. And Ctrl+X now permanently removes completed sessions – deleted background tasks stay deleted, and sessions no longer render twice.
On the improvement side, `/code-review` discovery quality has been upgraded across all effort levels on the claude-opus-4-8 model. The LSP plugin no longer surfaces spurious deprecation warnings with skewed telemetry data. The fullscreen jump-to-bottom button on macOS has been corrected and no longer overlaps transcript content. And on Windows, the agent view keyboard input bug that ignored keystrokes when a settings prompt preceded a bare `claude –resume` call has been resolved.
The Advisory in Context
The MIIT advisory identified versions 2.1.91 through 2.1.196 as the affected range. The recommended mitigation is straightforward: uninstall the affected version and upgrade to a patched release before resuming use. Organizations that had Claude Code deployed during that window should treat the incident as active until the version on each machine has been confirmed.
What makes this moment unusual is that the advisory and the new release landed close together. Version 2.1.206 does not carry an explicit security designation in its changelog, but the volume of fixes – particularly those addressing credential handling, session management, and MCP timeout behavior – suggests active refinement across the tool’s most sensitive integration points.
For teams that have standardized Claude Code in their development pipelines, the immediate action item is a version audit. Check what is running on each machine, confirm the version number, and upgrade where needed. The advisory applies to anyone using the tool for software development, code review, or automation workflows.
The broader context is a sector coming to terms with the complexity of AI coding tools that operate with broad system access. The same properties that make these tools useful – filesystem visibility, command execution, package installation – also make them high-value targets for supply chain attacks and, as this incident illustrates, capable of behaviors that users never explicitly agreed to.
