Anthropic’s hidden Claude Code tracker shocks users, removed

Anthropic quietly removed a piece of hidden code in Claude Code that a security researcher said tracked Chinese users, after the researcher exposed the mechanism and called it a “serious breach of user trust.” The company’s engineer says the tracker was an "experiment" added in March and was intended to prevent account abuse and protect against distillation.

What happened?

Anthropic added a hidden tracker to Claude Code in March, a researcher found, and removed it after publication. The developer known as "Thereallo" discovered that Anthropic used what the researcher called "prompt steganography" to embed markers that signaled a user’s timezone, proxy and potential connection to Chinese AI labs, sending that information back to Anthropic.

The researcher said the code was not overtly malicious but warned it allowed quiet fingerprinting of users. Anthropic engineer Thariq Shihipar confirmed on X that the tracker was an experiment and said engineers had "landed stronger mitigations since then." Sources in the article noted most users likely were not impacted, but the researcher argued hidden signals make other privacy claims harder to believe.

Why did Anthropic add the tracker?

Anthropic says the tracker was meant to stop unauthorized resellers and to protect against distillation attacks, and engineers treated it as an experiment. Thariq Shihipar described the change as intended to "prevent account abuse from unauthorized resellers and protect against distillation."

The Washington Post found unauthorized retailers had sold access to free models for $1 a month, and that pro subscriptions that can cost $100 monthly were being sold for "as little as $12." Anthropic has framed distillation as a core threat: it says repeated prompting to recreate capability undermines its model lead and has argued to policymakers that distillation should be constrained.

How does this fit into the distillation and China context?

Anthropic’s tracker appears tied to a broader fight over distillation, with the company warning Chinese labs have rapidly matched US models and sometimes mimicked Claude. In February researchers at Peking University and the Chinese Academy of Sciences reported methods that detected signs of distillation and found many Chinese models showed substantial evidence of copying; one Alibaba Qwen model sometimes identified itself as Claude in tests.

Anthropic has urged legal and export controls to blunt distillation, including proposals to restrict access to advanced models, chips and data centers. The company has also sued the White House over a separate dispute about refusing US government surveillance on Claude. In reaction to the tracker revelations, Alibaba banned employees from using Claude Code for work, a company memo reviewed by the South China Morning Post said.

Why it matters

The incident undermines trust at a delicate point for Anthropic: the company is publicly opposing government surveillance of US users while covertly testing user-fingerprinting techniques to stop model copying. That contradiction risks eroding confidence among developers and enterprise customers who must weigh privacy and compliance risks, especially large firms like Alibaba that face legal exposure if they violate terms.

Anthropic’s stated aim to protect model IP collides with common developer expectations for transparent telemetry. The researcher warned that hiding such signals in the system prompt "makes every other privacy claim harder to believe," a critique that could increase scrutiny of developer-focused AI tools.

What to watch

Watch whether Anthropic publishes a postmortem or formal policy change describing how it will handle telemetry in developer tools and whether US policymakers take further steps on distillation after public testimony from industry figures. Also watch whether other firms adopt similar covert measures or instead move toward explicit, documented telemetry controls.