Anthropic Removes Hidden Chinese User Tracker from Claude Code Amid Privacy Concerns
Key Takeaways
- ▸Anthropic embedded hidden tracking code in Claude Code to monitor Chinese users' timezone, proxy information, and connections to Chinese AI labs using prompt steganography
- ▸The tracker was added in March as an experiment to prevent unauthorized account abuse and combat distillation attacks, then removed after discovery by security researcher 'Thereallo'
- ▸The incident reflects intense US-China competition in AI, with Chinese firms rapidly matching US model capabilities through distillation attacks, prompting Anthropic to call for legal restrictions
Summary
Anthropic quickly removed hidden tracking code embedded in Claude Code after a security researcher exposed the covert system for monitoring users in China. A web developer known as "Thereallo" discovered the code was using "prompt steganography" to secretly track Chinese users' timezone, proxy information, and potential connections to Chinese AI laboratories. Anthropic engineer Thariq Shihipar confirmed the code had been added in March as an "experiment" to prevent unauthorized account resales and combat distillation attacks—instances where unauthorized parties reproduce proprietary AI models by repeatedly querying the original.
The discovery raised significant privacy concerns, as the code operated invisibly to most users, relying on shorthand markers to quietly flag suspicious activity. Anthropic stated the tracker was no longer needed because they had implemented "stronger mitigations," but privacy advocates condemned the practice as a fundamental breach of user trust, especially given unauthorized retailers selling free AI model access for as little as $1 monthly.
The incident highlights the intensifying US-China competition in AI, with Chinese companies consistently matching US model capabilities within months. In response, Anthropic and other US AI firms are calling for distillation to be classified as intellectual property theft, urging the US government to impose stricter controls on such practices.
The privacy breach carries irony given Anthropic's recent public stance against government surveillance of US citizens and ongoing legal conflict with the Trump administration. The hidden tracker suggests that even companies publicly opposing surveillance may implement covert monitoring when perceiving competitive threats, raising questions about how AI companies balance security, competition, and user privacy.
- The breach contradicts Anthropic's public opposition to government surveillance and reveals the tension between competitive pressures and privacy commitments
