AI vendor risk

On July 3, 2026, Alibaba issued an internal directive that should make every CISO on Earth reach for their AI tool inventory: effective July 10, Claude Code — Anthropic's AI coding agent used by millions of developers — was classified as 'high-risk software with security vulnerabilities' and banned company-wide. The reason? Security researchers discovered that Claude Code contained hidden code that secretly identified whether users were located in China, checked proxy connections to Chinese URLs, and flagged affiliations with Chinese AI research labs — then sent that intelligence back to Anthropic's servers through invisible system prompt modifications. This isn't a hypothetical supply chain attack. This is a major AI vendor embedding covert surveillance capabilities into a tool that has deep access to your local file system, your source code, and your development environment.

At 5:21 PM Eastern on June 12, 2026, the US Commerce Department sent Anthropic a directive. By midnight, the most capable AI model on the planet was offline — globally — with no warning, no timeline, and no fallback for the enterprises that had woven it into production workflows. Nineteen days later, it came back. But the 19-day blackout exposed a truth most enterprises aren't ready to face: your AI infrastructure can be switched off by a government you don't report to, through a process that doesn't exist yet, on evidence you'll never see.

OpenAI and Anthropic are both racing toward IPOs near $1 trillion. In the past two weeks, the U.S. government pulled Anthropic's most powerful models offline, cleared one for roughly 100 vetted organizations, told OpenAI to phase its GPT-5.6 launch through a trusted-partner list, and 42 state attorneys general subpoenaed OpenAI. For enterprise leaders who build production systems on these models, the rules of access are changing in real time.

OpenAI's $852B valuation faces investor revolt as losses hit $14B, Anthropic surges past $30B, and the product roadmap fractures. What it means for enterprise.