Summary
Independent developer “Thereallo” discovered a hidden steganographic tracking function buried in Anthropic’s Claude Code client (version 2.1.196) that quietly encoded user traffic routing details for Anthropic’s backend. The mechanism modified what appeared to be an innocuous system prompt line — “Today’s date is 2026-06-30.” — by embedding invisible Unicode markers that signaled information about the user’s API endpoint and system timezone to Anthropic’s servers.
The tracking was specifically triggered when the local system timezone was set to Asia/Shanghai or Asia/Urumqi, suggesting it was targeted at identifying users in China. To end users and most developers reviewing logs, the text appeared as ordinary English — only someone inspecting raw Unicode or Anthropic’s own backend would detect the encoded signal. After the discovery spread through social media and security news outlets, Anthropic acknowledged the code and removed it, with an engineer confirming on X that the marker was “an experiment launched in March” intended to prevent account abuse by unauthorized resellers and protect against model distillation.
The incident unfolds against a backdrop of escalating tensions between Anthropic and Chinese AI companies. Anthropic has publicly alleged that Chinese firms are conducting distillation attacks against Claude, and the U.S. government temporarily suspended foreign national access to the models in June citing national security concerns (restrictions later lifted June 30). In response to the tracker revelation, Alibaba has already banned Claude Code from internal use, classifying it as “high-risk software” and directing employees to use its internal coding tool instead.
Source
Malwarebytes — Claude Code’s hidden tracker was an “experiment,” says Anthropic
Thereallo — Claude Code Prompt Steganography
Commentary
Regardless of the intent, hiding a tracking mechanism inside Unicode steganography in a developer tool that has shell, filesystem, and repository access is a significant trust violation. Developers grant AI coding assistants some of the most privileged access on their systems — the implicit contract is that those tools behave transparently. Calling this an “experiment” is not reassuring when the experiment involved covert surveillance of specific user populations.
The geopolitical context makes this more complicated. Distillation attacks are a real threat to U.S. AI companies, and unauthorized reselling undermines both revenue and safety controls. But the response — embedding hidden trackers rather than implementing transparent geographic restrictions — is exactly the kind of approach that erodes the trust Anthropic has built as the “safety-first” AI lab. The Alibaba ban is likely just the first domino; any enterprise security team reviewing this incident will have legitimate questions about what other “experiments” might be running in their AI tooling.