An independent developer discovered a hidden tracking mechanism within Anthropic's Claude Code client, which the company has since removed, stating it was an experimental feature. The developer, known online as "Thereallo," found the code while reverse-engineering the local installation of Claude Code version 2.1.196. This feature, buried within the minified JavaScript, appeared to encode the user's local time zone and API endpoint into seemingly innocuous text strings.
The encoded signal was designed to be visible only to Anthropic's backend systems or those inspecting the raw Unicode data. Specifically, the mechanism would trigger if the user's local time zone was set to Asia/Shanghai or Asia/Urumqi. To the end-user and in standard log analysis, the text remained as ordinary English, such as "Today’s date is 2026-06-30."
Following the revelation on social media and subsequent news coverage, Anthropic confirmed the existence of the code. An Anthropic engineer reportedly stated on X that the marker was part of an experiment launched in March. The stated purposes for this experiment were to prevent account abuse by unauthorized resellers and to protect against "distillation attacks."
Distillation attacks are a concern for AI companies, involving adversaries using model outputs to train competing systems, often in jurisdictions with less stringent intellectual property protections. Reports have linked Chinese-linked AI labs and intermediaries to such activities, alongside unauthorized retailers selling access to Claude at significantly reduced prices. Alibaba, a major e-commerce and AI company, has reportedly banned Claude Code due to this issue.
The discovery of the tracking code coincided with a period of heightened scrutiny on AI model access. The US government had, on June 12, suspended access to certain models for foreign nationals, citing national security concerns. These export controls were subsequently lifted on June 30. While not explicitly confirmed as the sole trigger, the timing of these events and the stated concerns about distillation attacks, particularly those potentially originating from China, suggest a possible context for Anthropic's experimental feature.
Anthropic has moved quickly to remove the code from its client. However, the company has not yet released a detailed public postmortem explaining the feature. The incident highlights the growing importance for developers to scrutinize the behavior of AI assistants that are granted access to their local code, files, and terminal environments.
Developers concerned about similar issues are advised to maintain records of AI client hashes and versions used in sensitive environments and to exercise caution with automatic updates, performing at least a cursory review of changes. Network inspection tools can also be employed in test environments to capture and analyze full requests to AI APIs for unexpected markers, including Unicode anomalies within system prompts.
The incident underscores how a single decision by a vendor can render a previously trusted tool unsuitable for certain organizations. This emphasizes the need for maintaining flexibility and avoiding rigid dependencies on any single AI assistant.
