Hidden code in Claude Code secretly flagged Chinese users

2026-07-01 · Source: The Decoder · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Emerging Technologies & Innovation · Depth: Novice, quick

Summary

Anthropic is rolling back a covert surveillance feature in its Claude Code tool, exposed by Reddit user LegitMichel777, which secretly flagged users in China since version 2.1.91, released April 2, 2026. This feature checked for Chinese location indicators like system timezone ("Asia/Shanghai", "Asia/Urumqi") and Chinese proxy URLs, transmitting data through subtle, steganographic changes to the system prompt's date format and apostrophe character. The code was obfuscated using XOR encryption with key 91. Anthropic employee Thariq Shihipar described it as an "experiment" to prevent account abuse and unauthorized model distillation, stating stronger mitigations are now in place and the feature is being removed. Anthropic does not offer its models in China due to national security concerns and has previously accused Chinese AI labs of unauthorized model training.

Key takeaway

For AI Security Engineers evaluating software integrity, this incident highlights the critical need for deep code audits, especially in tools with filesystem and shell access. Covert data transmission methods, like steganography within system prompts or XOR-encrypted code, pose significant risks for user privacy and trust. You should implement robust detection mechanisms for hidden data exfiltration channels and scrutinize release notes for undisclosed features to prevent similar violations.

Key insights

Anthropic's Claude Code covertly transmitted user location data via steganography embedded in system prompts.

Principles

• Covert data collection violates user trust
• Obfuscation can hide surveillance features

Method

Claude Code compared system timezone and proxy URLs against Chinese indicators, then subtly altered the system prompt's date format and apostrophe character, obfuscating the code with XOR encryption (key 91).

In practice

• Embed hidden signals in system prompts
• Use XOR encryption for code obfuscation

Topics

• Claude Code
• Steganography
• User Privacy
• AI Ethics
• Covert Surveillance
• Data Exfiltration
• Anthropic

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Ethicist, Tech Journalist

Related on AIssential

• Claude’s code: Anthropic leaks source code for AI software engineering tool — Human error led to a significant source code leak for Anthropic's Claude Code, raising security and competitive concerns.
• Anthropic has a feature in Claude Code literally called "undercover mode." No off switch. It quietl — Anthropic's "Undercover mode" conceals Claude's AI identity and removes attribution for internal contributors.
• The TechBeat: What the Claude Code Leak Reveals About Hidden AI Security Risks (4/15/2026) — The tech landscape is rapidly evolving, demanding vigilance in security, efficiency, and ethical AI development.
• Anthropic Backtracks Spyware Targeting Chinese Users After Controversy — Anthropic's spyware backtrack highlights immediate public backlash against covert user tracking in AI.
• Here's what that Claude Code source leak reveals about Anthropic's plans — Anthropic's leaked Claude Code reveals future features like persistent agents, memory consolidation, and anonymous open-source contributions.
• Fake Claude Code Installers Deliver Credential-Stealing Malware — Fake AI tool installers exploit unchecked trust to deploy sophisticated credential-stealing malware targeting developer assets.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Decoder.