Anthropic tried to spy on Chinese Claude users through hidden code, now faces backlash

Anthropic is rolling back a hidden tracking feature in Claude Code after developers accused it of quietly tracking users' locations and possible links to China. The company says it was an anti-abuse experiment, but the feature drew heavy criticism over concerns about user privacy and transparency.

In Short

• Hidden Claude Code feature reportedly identified users linked to China
• The mechanism checked timezones and proxy URLs for links to China
• Anthropic said the March experiment targeted resellers and model distillation

Anthropic is reportedly rolling back a hidden tracking feature in its AI coding assistant, Claude Code, after developers accused the company of secretly identifying users who were in China or connected to Chinese AI labs. While the company says the system was introduced to combat account abuse and prevent its AI models from being copied, it faced heavy criticism for behaving like spyware.

According to The Information, Anthropic has confirmed that the feature was an experiment designed to curb account abuse and prevent rival AI companies from copying its models. The company has repeatedly alleged that several Chinese AI firms, including DeepSeek, Moonshot AI, MiniMax and Alibaba, have attempted large-scale 'distillation' attacks, using Claude's responses to train competing AI models.

Since Claude is officially unavailable in China, Anthropic has been tightening enforcement against users bypassing its geographic restrictions.

However, many developers and security researchers argued that the tracking system in Claude was implemented without clear disclosure. They argued that it quietly collected location-related information and appeared to identify users based on where they were connecting from or which organisations they were linked to, raising concerns about user privacy and transparency.

Anthropic launched hidden Claude code to monitor?

The controversy came to light after developers and security researchers examined Claude Code and found what they described as a hidden tracking mechanism in the software. According to reports, the feature quietly checked a user's timezone and proxy settings to determine whether they were connecting from China or through Chinese AI networks.

If it detected a match, the system reportedly made tiny changes to the text generated by Claude that were almost impossible to notice. These included changing the date format and replacing the apostrophe in the phrase "Today's date is" with a visually identical character. While users could not see the difference, Anthropic could reportedly use these hidden markers to identify flagged sessions.

Anthropic has not denied the existence of the feature. Anthropic hasn’t denied the feature existed. In response to the backlash, Claude Code engineer Thariq Shihipar posted on X that the system was an "experiment" started in March. “This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation,” he wrote in a post on X.

Shihipar added that the company had already developed stronger protections and had been planning to remove the hidden marker system. According to him, the rollback had already been scheduled for an upcoming release before the controversy surfaced.

China attacking US based AI models?

The incident comes against the backdrop of growing tensions between US AI companies and Chinese developers. Anthropic has repeatedly argued that some Chinese AI firms have attempted to steal knowledge from its models.

Anthropic says it is taking a tougher stance on protecting its frontier AI models from misuse, particularly by unauthorised resellers and companies attempting to copy its technology.

The company also strictly restricts Claude's access in China. However, reports suggest many Chinese users still bypass these blocks using VPNs, foreign phone numbers, and international payments. Additionally, third-party resellers often buy API access abroad to sell it within China through messaging platforms and online marketplaces.

To counter this, Anthropic spokesperson Michael Aciman told Wired that the company is upgrading its identity verification and anti-proxy tools. Anthropic also blocks commercial access for both China-based entities and Chinese-owned subsidiaries operating internationally.

- Ends