ANTHROPIC EMBEDDED HIDDEN CODE INSIDE CLAUDE CODE TO FLAG CERTAIN USERS IN CHINA AND SENT THE RESULTS BACK USING INVISIBLE CHARACTERS.

A Reddit developer reverse engineered Claude Code and found detection logic that had been shipping for about three months, hidden in an obfuscated binary with no mention in the changelog.

Researchers say it did three things when those checks were triggered:

- checked your system timezone against Asia/Shanghai and Asia/Urumqi
- scanned any active proxy or custom API base URL against a hard coded list of about 147 Chinese entities, including firms and AI labs like Alibaba, Baidu, ByteDance, Ant Group, DeepSeek, Moonshot, MiniMax, Baichuan, and StepFun
- ran a multi-factor classification whenever traffic went through a non-Anthropic endpoint

Instead of sending those results as normal telemetry, the code hid them inside the system prompt using prompt steganography:

- changed the date format from dashes to slashes when a Chinese timezone match was detected
- swapped the apostrophe in “Today’s date is” with one of several Unicode characters that look the same but have different code points
- used each Unicode choice to represent a different combination of flags, such as timezone, domain match, and AI lab keyword match

To a human reader, the text looked normal. On Anthropic’s servers, those invisible changes were machine readable signals.

Reports also say the domain list and keyword list were base64 encoded and XOR encrypted with key 91, so a simple text dump of the binary would not reveal them.

Security analysts describe this as a covert environment classification channel rather than ordinary telemetry. Alibaba’s internal review treated it as a high risk backdoor-like mechanism and banned Claude Code for employees.

Anthropic engineer Thariq Shihipar confirmed the mechanism publicly, calling it “an experiment we launched in March” aimed at detecting account abuse and distillation, and said the pull request removing the code was merged on July 1 after the community raised concerns.

This matters because Claude Code is a tool with full filesystem read access, shell execution permissions, and the ability to modify code in any repo you point it at.

Researchers say that for roughly three months, the client quietly encoded information about some users’ environment into prompts in a way most people would never notice.

The takeaway is not that Anthropic is uniquely evil. It is that when an AI coding tool is closed source and has deep access to your machine, you have no easy way to see what its client code is really doing.

I can usually tell within 5 seconds whether an outbound email was actually meant for me.

Most aren't.

The interesting part about AI isn't sending more emails - it's making it realistic to personalize every single one.

That's what stood out to me about Signal on @hyperagentapp.

#HyperagentPartner