Nobody saw this coming. Recent reverse engineering by developers has revealed that Claude Code has a built-in detection mechanism for China-related traffic. When users enable proxy connections, this logic checks the local timezone, proxy URL, and whether it involves Chinese AI labs or related domains. It then uses Unicode character differences that are virtually imperceptible to the naked eye to quietly embed the detection results into the system prompts sent by Claude Code.
While this practice may be understandable from the perspective of preventing abuse or complying with regional restrictions, the presence of hidden markers in a highly privileged AI development tool without public disclosure would inevitably cause people to question the transparency and trustworthiness of Claude Code.
Image source:Cybernews
Claude Code Found to Have Hidden Chinese User Detection Mechanism: Anthropic Says It Was an Anti-Abuse Experiment, But Transparency Sparks Controversy
according to Cybernews According to reports, this incident first came to light from a tip-off by Reddit user LegitMichel777.
The user stated that after discovering that Claude Code version 2.1.196 disables the Remote Control feature when proxy connections are enabled, they further reverse-engineered Claude Code’s binary executable and unexpectedly discovered a highly suspicious piece of hidden code.
This code doesn’t activate for all users—it only performs further checks when a user enables a proxy connection. It checks whether the system timezone is set to Asia/Shanghai or Asia/Urumqi, and also compares the proxy URL against characteristics of China-related domains, known Chinese AI lab names, or clues related to certain proxy or resale services.
In other words, it cross-references information such as local timezones, proxy hosts, and domain characteristics to determine whether the connection may be related to Chinese users, third-party relay services, or Chinese AI labs.
Anthropic embedded spyware in Claude Code — and attempted to hide it from you
byu/LegitMichel777 inClaudeAI
What’s more subtle is that Claude Code doesn’t directly write clear labels like “this is China timezone” or “this is a proxy service” in the data, but instead accomplishes the tagging through several subtle differences in the system prompts that are almost imperceptible to the naked eye.
For example, the date format might change from “2026-06-30” to “2026/06/30”; and the ‘ character in “Today’s date is” might also be replaced with a character that looks almost identical but actually has a different Unicode encoding.
When ordinary users see this system prompt, they might just assume it’s an ordinary date statement. But as long as the backend knows which character or format change to look for, it can extract different classification results from it.
This design is technically quite clever, almost like hiding markers in textual details, but when implemented in a highly privileged AI tool, it inevitably raises questions: if there’s a legitimate reason, why not just be upfront about it from the start?
LegitMichel777’s criticism also centers on transparency. He argues that even if Anthropic wants to protect their model’s intellectual property, it doesn’t justify secretly embedding system environment and agent configuration signals into prompts without users’ knowledge.
In response, Anthropic Claude Code team engineer Thariq Shihipar posted on X, saying this was an experiment launched in March this year, aimed at preventing unauthorized resellers from abusing accounts and blocking model distillation. He also mentioned that the team has since implemented stronger protections and merged the PR that removes this mechanism.
This incident also highlights that as tools increasingly resemble AI agents running locally on users’ machines—capable of accessing files, terminals, keys, and even internal company projects—the outside world will naturally scrutinize them with higher standards.
The more powerful the model’s capabilities and the broader its tool access, the clearer the transparency must be. This is the fundamental threshold of trust.
Source: KOCPC Chinese