Anthropic's Claude Code Allegedly Uses Spyware to Identify Chinese Users

Anthropic's Claude Code Allegedly Uses Spyware to Identify Chinese Users

First seen 30 Jun 2026, 20:09 UTC CybersecuritynewsCryptobriefing 81% similarity 69.5
Share:

Article Content

Browse articles
ThreatCluster

On June 30, 2026, a developer accused Anthropic of embedding hidden detection logic in Claude Code, targeting users connecting through Chinese proxies. The mechanism reportedly uses obfuscated Unicode character swaps and date format changes to flag these users without their knowledge. This covert user fingerprinting is likened to spyware, raising significant concerns about user privacy and trust. The allegations focus on Claude Code version 2.1.91, released on April 2, 2026. The claims have prompted discussions on platforms like GitHub, but Anthropic has not yet responded. Previously, Anthropic accused Alibaba-affiliated entities of orchestrating a distillation campaign to extract Claude's capabilities. The company also disclosed misuse of Claude Code by a Chinese state group for cyber espionage against 30 entities. Claude Code is not officially available in China, indicating that any usage involves circumventing restrictions.

Key Points: • Anthropic's Claude Code allegedly embeds spyware-like detection logic for Chinese users. • The detection mechanism uses obfuscated Unicode and date formats to flag users covertly. • Anthropic has not acknowledged the allegations as of June 30, 2026.

ThreatCluster AI

Timeline

2026-04-02
Claude Code version 2.1.91 released
The version in question contains the alleged hidden detection logic targeting Chinese users.
Cryptobriefing
2026-06-10
Anthropic accuses Alibaba affiliates of distillation campaign
Anthropic claimed that Alibaba-affiliated entities orchestrated a campaign to extract Claude's capabilities.
Cryptobriefing
2026-06-30
Developer accuses Anthropic of covert user tracking
A developer alleged that Claude Code uses hidden detection logic to identify users connecting through Chinese proxies.
Cybersecuritynews

Community

Browse all →