A recent Reddit post has sparked heated debate in the AI developer community: someone reverse-engineered hidden JavaScript code from Claude Code’s binary files, code that Anthropic uses specifically to detect whether users are in China, using Chinese proxy servers, or connected to Chinese AI labs. The detection results are secretly transmitted through subtle modifications to the system prompt using steganography, raising serious concerns about trust and privacy between AI companies and users.
Anthropic embedded spyware in Claude Code — and attempted to hide it from you
byu/LegitMichel777 inClaudeAI
Claude Code exposed for built-in hidden detection code targeting Chinese users
According to an original post on Reddit’s r/ClaudeAI subreddit, starting from Claude Code version 2.1.91, Anthropic embedded a comprehensive user environment detection system in the codebase. This system checks the following items:
- System Time Zonewhether it is set to
Asia/ShanghaiorAsia/Urumqi - Proxy server URLThrough
ANTHROPIC_BASE_URLReads the proxy hostname from environment variables and determines whether it points to a Chinese domain or a known Chinese reseller - AI Lab ConnectionsCheck if the proxy URL contains keywords related to Chinese AI labs
These detection results are not directly reported to the server, but instead transmitted through two extremely covert channels: modifying the date format in system prompts, and replacing Unicode apostrophe characters.
Many Chinese netizens online have also reported that their Anthropic accounts have been frequently banned for no apparent reason recently, and have advised against using Claude models when visiting places like Hangzhou to avoid sudden official bans.
据说本次 Claude 封杀的全是浙江和杭州的 IP
可能因为上周 Anthropic 指责阿里通过25000多个账号疯狂蒸馏 Claude 的数据，从 4月22日到6月5日，交互次数超过 2880 万次…
去杭州出差千万不要使用 Claude
而且更恶心的是，在给你的封杀邮件里面 Anthropic还安装了邮件追踪器，… pic.twitter.com/zoNNOl4SHJ
— 小互 (@xiaohu) June 30, 2026
Technical Breakdown: A Stealth Detection Chain Built from Four Functions
JavaScript code extracted from the Claude Code binary file (located at offset -207647041), containing four key functions:
Function 1:Qup() — Read Agent Information
This function from process.env.ANTHROPIC_BASE_URL Extract the hostname of the proxy server from the environment variables and convert it to lowercase. If no proxy is set or the URL format is invalid, return null。
Function Two:Zup() Core Classifier
This is the core of the entire detection system. It will first call Crt() Check if the user is connecting through a proxy (not directly to Anthropic servers), and only continue detection if so. The returned object contains four fields:
knownWhether the proxy hostname matches known Chinese organizations or reseller lists (viaJup()Function matchinglabKwDoes the hostname contain AI Laboratory related keywords (viaXup()Function MatchingcnTZIs the system timezone set to China timezone?hostActual proxy hostname
Function 3:edp() Unicode Steganography Marker
This is the most critical and unsettling part of the whole thing: the function selects different Unicode apostrophe characters to inject into the system prompt based on the classification result.
'(U+0027, standard ASCII apostrophe): Both indicators remain inactive, indicating a “normal user”ʼ(U+02BC, modifier letter apostrophe): Only triggers one of the indicators‛‘(U+201B, single high reversed quotation mark): Two indicators triggered simultaneously’
These characters appear nearly identical to the naked eye, but at the programming level they are completely different Unicode code points. When interpreting system prompts, a model can use these character differences to determine the user’s environment properties.
Function Four:Vla() Date Format Switcher
This function is responsible for generating the system prompt line “Today’s date is…”. If it detects a Chinese timezone, it changes the date separator from hyphens to slashes: for example 2026-06-30 become 2026/06/30This is also a covert signaling channel – what appears to users as a minor difference in date format is actually a clear environmental marker for the model.
Steganographic techniques: Why this is more unsettling than direct blocking
If Anthropic were to explicitly state in their Terms of Service that “China region is prohibited from using this service,” or simply refuse service upon detecting Chinese IP addresses, that would at least be a clear business decision, and users could decide for themselves whether to accept it.
But choosing the steganography approach means: Anthropic wants to inject environmental information into conversations with the model without the user’s knowledge. This information won’t appear on any user-facing interface, yet it will influence how the model behaves.
International Cyber Digest on X wrote: “A code agent with file system and shell permissions should not secretly hide routing metadata in prompts without the user’s knowledge. This seriously violates user trust.”
‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.
Claude Code is sending info like timezone, proxy and possible AI Lab… pic.twitter.com/EjfwtirhES
— International Cyber Digest (@IntCyberDigest) June 30, 2026
The commenter thinks the truly terrifying part isn’t that Anthropic wants to prevent regional resale in China or model distillation—it’s that developers use Claude Code as a coding assistant with file system and shell access. Once clients can secretly modify prompts or hide detection logic, the trust boundary has already been broken. Today it’s detecting Chinese users, but tomorrow couldn’t it be other, more sophisticated forms of behavior control?
Background: Anthropic’s Anti-Distillation War
To understand how Anthropic got to this point, we need to review several key events since early 2026. On February 23, 2026, Anthropic published aOfficial blog postPublicly accused three AI labs, DeepSeek, Moonshot (Moonshot AI), and MiniMax, of conducting large-scale distillation attacks against Claude. According to Anthropic, these three labs used approximately 24,000 fraudulent accounts and engaged in over 16 million conversation exchanges with Claude, with the aim of extracting Claude’s capabilities to improve their own models.
Anthropic emphasized in the article that models obtained through illegal distillation will lack necessary safety guardrails, potentially leading to dangerous capabilities spreading to military, intelligence, and surveillance systems. They also pointed out that distillation attacks are undermining US AI export control policies. Earlier, in November 2025, Anthropic publicly disclosed a case where a Chinese state-sponsored hacker group used Claude Code for cyber espionage activities.
These events formed the backdrop for Anthropic’s efforts to strengthen its detection and defense measures. However, the problem lies in:Does using covert steganographic techniques to identify users cross the line of reasonable security measures?
Community Reaction: Trust Crisis Brewing
The incident sparked heated discussions across multiple social platforms. The original post on Reddit’s r/ClaudeAI subreddit received massive engagement, with users raising concerns such as, “If Anthropic is willing to secretly transmit your system information just because you’re Chinese, what’s to stop them from secretly guiding the model’s behavior?”
Other users have offered a different perspective from a security standpoint, arguing that Anthropic is clearly attempting to detect unauthorized resale in the China region and model distillation by AI labs, with steganographic techniques employed to avoid circumvention. However, even if the motivations are reasonable, the opacity of these methods has sparked widespread reconsideration of the trust boundaries for AI tools.
From an engineering perspective, a code agent tool with full filesystem and shell access that allows its client to modify system prompts without the user’s knowledge means the conversations between users and the model are not as “clean” as they believe. This is not just an issue for Chinese users, but a trust concern for all Claude Code users.
The Dilemma: Security Boundaries vs. Trust Boundaries
Anthropic faces a genuine dilemma. Large-scale distillation attacks do exist and pose a serious threat to the AI safety ecosystem. It is also a confirmed fact that Chinese state-sponsored hacker groups have used Claude Code for cyber espionage. From a business and security perspective, Anthropic has compelling reasons to take defensive measures.
But choosing to embed covert detection code on the client side, transmitting user environment information through steganography, comes at the cost of user trust. When developers discover that the code tools they use every day contain detection logic they weren’t aware of, even if they’re not the target of that detection, they’ll start questioning: what else is this tool hiding?
As of now, Anthropic has yet to make a public response to this revelation. The situation continues to unfold.
Source: KOCPC Chinese