Alibaba has reportedly banned the use of Claude Code among its employees. The news, carried by international media but not yet officially commented on by the company, speaks of «security concerns». Behind this choice lies more than just technical caution: it signals a drive to accelerate the transition toward domestic AI tools, in a country where control over code is a strategic asset.

The move is not isolated. For months, Chinese authorities have been urging companies to adopt locally developed solutions, reducing dependence on foreign platforms. Claude Code, Anthropic's LLM-based coding assistant, operates in the cloud and processes queries on servers outside Chinese jurisdiction. In such a scenario, every request sent to the tool could theoretically expose snippets of proprietary code, business logic, or sensitive data. For an entity like Alibaba, which manages critical infrastructure and an immense digital ecosystem, the risk is not negligible.

This is not just a compliance matter. The decision reflects a broader calculation that many enterprises, even outside China, are beginning to make: how far does it make sense to delegate developer productivity to a third-party cloud service? Every token sent to an external LLM is a token leaving the corporate perimeter. If the generated code becomes an integral part of products, the chain of trust lengthens and the points of vulnerability increase.

The shift toward domestic tools is not driven by technological patriotism alone. Alibaba itself has its own coding assistant, Tongyi Lingma, built on the proprietary LLM Tongyi Qianwen. Promoting internal adoption of these tools means keeping data and queries within its own cloud, with security policies and isolation managed directly. In practical terms, it reduces the attack surface and simplifies audits for local regulators.

For those watching the on-premise AI market, the news carries a signaling value. If even a cloud-native giant like Alibaba chooses to lock down the use of an external coding assistant, it becomes clear how data sovereignty is turning into a primary selection criterion, no longer an afterthought. The trade-off is well known: global cloud services offer convenience, continuous updates, and high performance, but they sacrifice direct control over information flows. Self-hosted alternatives, on the other hand, return full sovereignty at the cost of more demanding management of hardware, LLM quantization, and inference pipelines.

The Alibaba case could accelerate a debate already underway in European and North American enterprises, especially in regulated sectors such as finance, healthcare, and defense. With the evolution of on-premise serving frameworks and the growing availability of LLMs optimized to run on consumer GPUs and enterprise servers, the balance between «external cloud» and «controlled local» is shifting. The question remains: which tools will survive this fragmentation? Only those capable of operating in hybrid environments, with verifiable data residency guarantees, will be able to play on both tables.