Claude Code hidden China check in v2.1.91, Anthropic rolls back

Anthropic is rolling back a covert surveillance feature in its coding tool Claude Code after a Reddit user exposed the check. The feature, present in version 2.1.91 released April 2, 2026, secretly tested whether users with an active proxy were located in China and encoded those results into the system prompt.

How did the hidden check work?

Claude Code compared the system timezone against "Asia/Shanghai" or "Asia/Urumqi", scanned proxy URLs for Chinese domains and AI labs, and then encoded the result into tiny, invisible changes to the system prompt — for example by tweaking the date format and swapping an apostrophe character in the phrase "Today's date is." The discoverer said the detection was also obfuscated with XOR encryption using key 91 to stop it showing up in a simple text dump.

The Reddit post by user LegitMichel777 that first exposed the behaviour explained those stealth signals and warned that because Claude Code has full filesystem and shell access, the mechanism could open the door to remote control or data exfiltration. The post also argued the check was trivial for skilled attackers to bypass.

What did Anthropic say and do?

Anthropic described the code as "an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation," according to employee Thariq Shihipar. The team said it had since implemented stronger protections, merged the pull request removing the check, and expected the change to be rolled back in the next release.

The release notes for v2.1.91, which shipped April 2, 2026, made no mention of the hidden check. Anthropic has previously accused DeepSeek, Moonshot AI, MiniMax, and Alibaba of using Claude model outputs without permission to train their own language models, a backdrop that the company says motivated experiments aimed at preventing account abuse.

What went wrong and who noticed?

The feature was uncovered by a community researcher rather than an internal audit: the Reddit user LegitMichel777 posted the discovery and called the covert transmission of system and proxy data without user knowledge "a fundamental violation of user trust." That public exposure prompted social media outrage and Anthropic to confirm the experiment and remove it.

Because the mechanism used subtle changes in the system prompt that users could not see, and because the code was obfuscated, ordinary users and many developers would not have noticed the check. The discoverer also emphasized that, given Claude Code's access levels, the approach increased the surface for potential misuse.

Why it matters

The episode highlights a trust gap between platform operators and developers who rely on developer tools with deep system access. Anthropic does not offer its models in China for national security reasons, yet many Chinese developers access Claude through foreign phone numbers and credit cards; a covert location check aimed at enforcing access policy intrudes on privacy and raises abuse concerns. The tech community now faces a concrete example of how product experiments can leak sensitive signals when they run without clear disclosure.

What to watch

Look for the forthcoming release notes and the merged pull request to confirm the rollback that Anthropic referenced. Also watch whether Anthropic publishes clearer changelog entries or a postmortem explaining how an obfuscated, prompt-level telemetry experiment landed in v2.1.91 and what safeguards will prevent similar undisclosed checks going forward.