Anthropic removed a hidden Claude Code tracking system after markers were discovered in June identifying certain Chinese users. The company cites the fight against account abuse and the distillation of models. Does the transparency of AI tools remain compatible with this form of surveillance?
In brief
- Developer “Thereallo” spotted Unicode markers hidden in Claude Code’s system prompts in June.
- These signals made it possible to detect time zones, proxies and links with Chinese laboratories like DeepSeek or Zhipu.
- Anthropic announced a complete fix in the next version of the tool.
What does the discovery of the hidden tracker reveal?
In June, researcher Thereallo uncovered a code hidden in Claude Code’s system prompts. This mechanism flagged users suspected of circumventing Anthropic restrictions or extracting model capabilities.
The system relied on Unicode markers and encoded domain lists. A hostname containing “deepseek” or “zhipu” was, for example, a signal exploited by the tool.
Thereallo did not consider the functionality itself malicious. On the other hand, he criticized the total lack of documentation or release note on this point, for a development tool that relies on user trust.
Why was Anthropic monitoring certain users?
Engineer Thariq Shihipar confirmed on X that the experiment started in March. The goal was to prevent account abuse by unauthorized resellers and to limit distillation, the practice of training a competing model based on Claude’s responses.
Anthropic also accused, in February, Chinese developers DeepSeek, Moonshot AI and MiniMax of having siphoned millions of responses via fraudulent accounts. Dario Amodei then mentioned, in June, nearly 25,000 accounts linked to Alibaba and 28.8 million suspicious transactions.
This controversy is also part of an already tense climate: Alibaba has banned the use of Claude Code from its teams, deeming the tool high risk after this discovery. Another episode in the growing technological rivalry between the United States and China.
Anthropic therefore did not act in a vacuum. However, the chosen method, undisclosed monitoring, weakened developers’ confidence in the tool.
The patch should restore standard operation of Claude Code, without hidden markers. The question of transparency of anti-abuse detection systems remains fully open for the entire generative AI sector.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
