Anthropic Removes Hidden Code From Claude Code That Covertly Flagged Chinese Users

Anthropic is stripping a covert surveillance feature from Claude Code, its AI-powered coding tool, after a developer reverse-engineered hidden detection logic that specifically identified and flagged users connected to Chinese infrastructure. The code had been silently present in the tool since version 2.1.91, released April 2, without any mention in release notes [1] .

The discovery, posted to 's r/ClaudeAI forum on June 30 by user LegitMichel777, revealed that Claude Code checked system timezones against "Asia/Shanghai" and "Asia/Urumqi," and scanned proxy URLs against a hardcoded list of 147 Chinese entities including Baidu, Alibaba, ByteDance, and Ant Group. When triggered, the tool silently altered system prompts using steganographic techniques — swapping date formats and substituting visually identical Unicode apostrophe characters — to transmit detection signals that were invisible to users but machine-readable by Anthropic's servers [2] .

Anthropic did not deny the mechanism. Thariq Shihipar, an engineer on the Claude Code team, acknowledged it as "an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation" [3] . The company said a pull request to remove the code was merged and scheduled to appear in the July 1 Claude Code release.

The detection system operated through multiple layers of obfuscation. When Claude Code detected an active proxy via the ANTHROPIC_BASE_URL environment variable, it performed a series of checks: reading the system timezone, cross-referencing the proxy hostname against a list of known Chinese AI labs, competing companies, account resellers, and gateway domains [2] .

Based on three detection outcomes — Chinese timezone, Chinese proxy domain, or Chinese AI lab connection — Claude Code silently modified two elements of its 'Today's date is…' system prompt. A positive timezone match changed the date format from '2026-06-30' to '2026/06/30.' Simultaneously, the standard apostrophe was replaced with one of three visually identical but technically distinct Unicode characters, encoding which combination of proxy and AI lab flags had been triggered [1] .

The string lists containing Chinese domain names and entity identifiers were concealed using XOR encryption with key 91 and base64 encoding, preventing discovery through standard binary analysis or plain-text string searches [2] .

Anthropic does not officially offer its models in China, citing national security concerns, but many Chinese developers access Claude through foreign credentials, VPNs, and third-party proxy services. The company has been locked in an escalating battle against model distillation — the practice of systematically querying an AI model to replicate its capabilities in a cheaper clone [3] .

In June 2026, Anthropic accused Alibaba-affiliated entities of orchestrating a large-scale distillation campaign involving approximately 29 million exchanges across roughly 25,000 fraudulent accounts. In November 2025, the company disclosed that a Chinese state- group had been misusing Claude for cyber espionage efforts [2] .

Shihipar said the Claude Code team had since developed 'stronger mitigations' and had 'actually been meaning to take this down for a while.' Anthropic declined to specify what those stronger mitigations entail [3] .

The discovery ignited a backlash among developers on and social media, with particular alarm over the covert nature of the implementation. LegitMichel777 characterized it as 'a fundamental violation of user trust,' noting that Claude Code's deep filesystem and shell access — core to its functionality as a coding assistant — made any undisclosed monitoring especially concerning [1] .

The incident is particularly fraught for Anthropic, which has built its brand around AI safety and transparency. The company's Responsible Scaling Policy and public commitments to openness are central to its positioning against rivals like OpenAI and Google DeepMind [1] .

The episode underscores the tension facing U.S. AI labs as they simultaneously try to prevent Chinese entities from copying their models while maintaining the trust of a global developer community that includes significant Chinese participation through unofficial channels [2] .