Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
On November 12 the new “Supported Regions Policy” of Anthropic takes effect. The company defined in the official document the categories of users who are prohibited from accessing the service. The ban applies to Russian users and anyone working for Russian companies.
The new Anthropic policy applies to Claude.ai, Claude Code, Cowork, the official API, as well as models provided through cloud platforms and authorized resellers. Access via AWS Bedrock does not allow bypassing these limits. The key change is that the evaluation criteria now cover not only the mode of access, but also three additional aspects: the user’s physical location, the company’s legal domicile, and who actually controls it:
The first category includes users physically present in unsupported regions — even if they work for an international company that meets the requirements, but are on a temporary assignment, they cannot use Claude.
The second category concerns organizations registered or with legal headquarters in unsupported regions. Use of Claude by employees of such companies is considered a violation, even if the employees themselves are physically located, for example, in the United States.
The third category deals with capital and control issues: if an organization is directly or indirectly controlled by an individual or a company from a region where the service is unsupported, its access to the product is restricted. In this case, the control threshold is not limited to an ownership share exceeding 50%.
The new security monitoring system retains data for 30 days and identifies risks based on behavioral factors, such as the time zones in which requests are made and linguistic characteristics. Anthropic reported that in the first half of 2026, 11.4 million accounts were blocked and the company received 398,000 appeals.
Previously, in September 2025, Anthropic had prohibited the use of Claude for foreign organizations controlled by Chinese companies or other regions where the service is unsupported. The current changes aim for a clearer formulation of the three criteria — user location, company jurisdiction, and nature of control — simplifying the practical application of these rules.
The tightening of Anthropic’s service access rules coincides with the company’s preparation for an IPO. In the S‑1 filing submitted to regulators it is noted that in the last nine months, 5–7% of revenue came from customers later identified as rule violators. Cleaning up this revenue stream, preparing a more “transparent” prospectus for Wall Street, and closing the escape routes for key technologies are the main reasons for the current wave of account blocks.
For developers, the immediate consequences are mainly tied to business process continuity. Teams that use the Claude API to build their products must assess whether their capital structure and registration jurisdiction fall within the new limits. They should also export prompt and conversation histories as soon as possible to prepare for a potential move to other platforms.
In the long term, formalizing regional limits could accelerate the migration of some users to other providers — especially for international teams with complex capital structures, who will struggle to pass compliance checks. For Anthropic itself, the voluntary refusal of “problematic” revenue could have a short‑term impact on financial results, but it helps reduce regulatory risks in the IPO preparation process.
At a market level, the trend toward regional segmentation of AI model access becomes increasingly evident. Cloud platforms are no longer seen as a “buffer” that allows bypassing limits. This means that business models that previously accessed Claude through foreign legal entities or third‑party distributors are forced to reorganize. Moreover, the rising compliance costs will inevitably affect product pricing and implementation timelines for end‑developer users.
