Claude Code is Anthropic's AI-powered CLI for software development. It connects directly to api.anthropic.com, making API calls that carry your authentication credentials with every request. If even one of those requests arrives from a Chinese IP address, Anthropic's risk control system can flag and permanently suspend your account.
This is not hypothetical. In September 2025, Anthropic updated their Terms of Service to explicitly restrict access from China, Hong Kong, and Macau. Their real-time risk control system detects and rejects connections from high-risk IPs. There is no appeal process for detected accounts.
Why Claude Code Is Uniquely Vulnerable
Unlike browser-based AI tools, Claude Code runs in your terminal. This creates specific risks:
- Terminal traffic bypasses browser VPN extensions. If you use a Chrome extension VPN, your Claude Code CLI calls go direct through your ISP.
- Persistent connections mean prolonged exposure. A coding session can last hours, with continuous API calls. One VPN drop during that time exposes your IP.
- API keys are transmitted with every request. Your authentication credentials travel with each packet. If that packet arrives from China, the credentials are compromised.
The Setup That Works
Step 1: Use TUN Mode, Not Browser Proxy
TUN mode creates a virtual network adapter that captures ALL traffic at the operating system level. Every application, every CLI tool, every background process routes through the encrypted tunnel. This is the only way to guarantee that Claude Code's API calls go through VPN.
SOCKS proxies and browser extensions only capture traffic from applications configured to use them. Terminal applications typically ignore these settings entirely.
Step 2: Enable the Kill Switch
A kill switch blocks ALL internet traffic if the VPN connection drops. Without it, your system silently reverts to direct connection through your Chinese ISP. If Claude Code sends an API request during that window -- even for a fraction of a second -- your China IP hits Anthropic's servers.
Step 3: Verify Your IP Before Starting
Before launching Claude Code, verify your VPN is working by checking your public IP. You should see a Singapore (or non-China) IP address.
curl ifconfig.meIf the response shows a Chinese IP (starting with common Chinese ISP ranges), do not start Claude Code until you resolve the VPN connection.
Step 4: Use a Private Dedicated IP
Commercial VPN IPs are increasingly flagged by AI companies. NordVPN, ExpressVPN, and Astrill IP ranges are on blocklists maintained by Anthropic, OpenAI, and Google. A private server IP from DigitalOcean's standard hosting range does not trigger these blocklists because it is not associated with any known VPN service.
Step 5: Use VLESS+Reality Protocol
Standard VPN protocols (OpenVPN, WireGuard) create detectable traffic patterns. If the GFW terminates your connection, you have an IP leak window. VLESS+Reality is undetectable by the GFW, so connections do not get terminated in the first place. No termination means no leak window.
What Happens If You Get Detected
Anthropic's enforcement is binary: detected accounts are suspended. The consequences include:
- Permanent loss of your Claude Code subscription
- All API keys associated with the account are revoked
- Account history and saved conversations are inaccessible
- No documented appeal or reinstatement process
For developers who rely on Claude Code for daily work, this is a career-level disruption.
Recommended Configuration Summary
- Use a VPN with TUN mode (OS-level traffic capture)
- Enable kill switch before starting any coding session
- Verify your public IP shows a non-China address
- Use a private dedicated IP not associated with commercial VPN services
- Use VLESS+Reality protocol to prevent GFW-triggered disconnections
- Never disable VPN during an active Claude Code session
Critical: If your VPN disconnects during a Claude Code session, immediately stop all work. Do not send any more commands until VPN is restored and IP is verified. One exposed request is enough to trigger detection.