Anthropic Outed for Hidden Claude Code Tracker Monitoring Chinese Users

A privacy researcher known as 'Thereallo' found that Claude Code was using 'prompt steganography' to hide tracking code 'in plain sight' — quietly sending Anthropic shorthand markers flagging users' timezone, proxy, and potential connection to Chinese AI labs accused of distillation attacks. The code wasn't malicious, but it was undetectable to most users, and its exposure landed hard given Anthropic's public anti-surveillance branding.

Anthropic engineer Thariq Shihipar confirmed on X that the tracker was added in March as an 'experiment' meant to 'prevent account abuse from unauthorized resellers and protect against distillation.' The Washington Post found unauthorized retailers reselling free-model access for $1/month and $100 pro subscriptions for as little as $12, which Anthropic cites as the abuse it was fighting. Shihipar said the company had been meaning to remove the code 'for a while' because it had 'landed stronger mitigations,' and it was pulled quickly after the disclosure.

The optics are the story. Anthropic riled the Trump administration by refusing to let the U.S. government use Claude to surveil users, and has sued the White House over related pressure. Privacy advocates argue the hidden tracker shows the company is willing to cross the same lines it publicly condemns, calling it 'a weird choice for a developer tool that asks for trust.'

Developer reaction was uneasy — the theme was trust violation for a tool marketed around transparency, and calls for explicit telemetry disclosure and release notes. This connects to the broader Anthropic-vs-China distillation fight also playing out this week. What to watch: whether Anthropic publishes a telemetry policy and whether other 'experiments' surface.