Anthropic's Claude Code Tool Allegedly Embeds Hidden Logic to Detect Chinese Users
A Reddit disclosure claims Anthropic's Claude Code CLI tool contains undisclosed, obfuscated code designed to detect users in China or those using Chinese AI lab proxies, raising significant trust concerns.
A recent disclosure on Reddit has ignited a firestorm of debate regarding developer trust and covert surveillance, with allegations that Anthropic has embedded undisclosed detection logic within its Claude Code Command Line Interface (CLI) tool. The purported hidden code is specifically designed to identify users operating from China or those who route their traffic through Chinese AI lab proxies. The claims, posted by a Reddit user identified as LegitMichel777 on the r/ClaudeAI subreddit on June 30, 2026, stem from a researcher's attempt to reverse-engineer the Claude Code tool, specifically version 2.1.196, to restore a disabled remote control feature.
During this process, the researcher reportedly discovered obfuscated code that had been present in the tool since version 2.1.91, released on April 2, 2026, without any mention in the official release notes. According to the disclosure, this covert code performs a multi-factor check whenever a proxy is detected. It allegedly examines the system's timezone to ascertain if it matches Chinese timezones like Asia/Shanghai or Asia/Urumqi. Concurrently, it inspects the proxy URL against a hardcoded list of Chinese domains and known Chinese AI lab hostnames.
What makes this discovery particularly alarming is the alleged method used to transmit the findings: steganography embedded within the system prompt. The report suggests that based on the detection outcomes—whether a Chinese timezone, a Chinese proxy domain, or a Chinese AI lab is identified—Claude Code silently alters specific elements of the "Today's date is..." system prompt line. For instance, if a Chinese timezone is detected, the date format allegedly changes from the standard YYYY-MM-DD to YYYY/MM/DD. Furthermore, the apostrophe in "Today's date is" is reportedly replaced with one of three visually identical but technically distinct Unicode characters, depending on the combination of proxy domain and AI lab flags detected.
These subtle alterations, while invisible to human users and potentially even to the AI model itself, are claimed to be easily machine-parseable by Anthropic's servers. The researcher further alleges that Anthropic actively attempted to conceal this detection logic. Portions of the code responsible for this detection were reportedly obfuscated using XOR encryption with the key 91, a common technique employed to prevent the extraction of plain-text strings during binary analysis. Specific minified functions within version 2.1.196, such as Crt(), Rrt(e), e0t(), Zup(), edp, and Vla, are cited as potentially containing this logic, which the researcher suggests can be identified by asking Claude Code or Codex to self-reverse-engineer its own code.
The security community has reacted with significant concern to this disclosure. Critics argue that regardless of Anthropic's intended use case—such as preventing unauthorized resale of the Claude API or model distillation by Chinese labs—the covert collection of system and proxy metadata without explicit user consent represents a fundamental breach of trust. Developers who grant Claude Code extensive filesystem and shell access to perform its intended tasks are particularly exposed, as the researcher noted that such elevated access theoretically enables remote code execution.
Adding to the apprehension is the question of the detection's effectiveness versus the privacy implications. The report suggests that such checks are trivially bypassable by moderately skilled adversaries, leading to questions about whether the privacy cost to legitimate users justifies any perceived security benefit. As of the time of publication, Anthropic had not yet issued a public statement addressing the Reddit disclosure, leaving the allegations unconfirmed but widely discussed within the cybersecurity sphere.
Alibaba has reportedly decided to ban Anthropic's Claude Code AI assistant from its internal systems starting July 10, 2026, due to alleged backdoor risks. The company claims the tool silently checks network environments against lists that include Chinese enterprises, a concern that Anthropic states was for abuse prevention and will be removed. This development escalates tensions between the two companies, following Anthropic's earlier accusation that Alibaba's Qwen AI lab engaged in large-scale model distillation.
Anthropic has since removed the code responsible for the tracking function, stating it was an "experiment" to prevent account abuse and distillation attacks, potentially related to recent US export controls. While the company has not yet issued a detailed postmortem, an engineer confirmed the feature was launched in March and may have been a response to concerns over Chinese AI labs and unauthorized resellers.
China's National Vulnerability Database (CNVDB) has issued a formal alert, urging developers to uninstall Claude Code versions 2.1.91 through 2.1.196. The state-run body cited concerns over "backdoor code" and a "built-in monitoring mechanism" that could potentially collect and transmit user data, including location and identity, to remote servers. Anthropic has since released version 2.1.198, which they state removes the experimental tracking mechanism, explaining it was part of an effort to prevent model distillation.
Anthropic has officially refuted claims made by China's National Vulnerability Database regarding a "security backdoor" in its Claude Code AI model. The company clarified that the detected code was an anti-abuse mechanism designed to prevent unauthorized access from China and block suspected AI model distillation by Chinese laboratories, rather than a data exfiltration tool. This response comes amid heightened scrutiny of AI companies' controls over access to their advanced models, particularly from China.