Anthropic quietly buried hidden tracking code in Claude Code. Now it's removing it.
Anthropic has confirmed it will strip out covert tracking code it embedded in Claude Code earlier this year, after a developer publicly exposed its existence.
The code, which had been sitting in the product since March, used steganography to hide classification data inside Claude Code's system prompt. To the untrained eye, it looked like ordinary English text. It wasn't.
Engineer Thariq Shihipar said a fix was merged and due to ship in the July 1 Claude Code release. His explanation was brief: the feature was an experiment designed to catch unauthorized resellers and prevent distillation, the practice of hammering a model with queries to reverse-engineer its behaviour. Stronger protections are now in place, he said, and the team had been planning to pull the code anyway.
Convenient timing, given someone had just found it.
The person who found it, a developer going by Thereallo, laid out exactly what the code was doing. When Claude Code detects that its base URL has been overridden (a common setup when routing traffic through a proxy or API gateway), it checks the system timezone and compares the hostname against a list of known Chinese AI labs, other AI companies, resellers, and gateway domains. That list was obfuscated behind XOR encoding and base64.
The classification result was then quietly encoded into a sentence in the system prompt using invisible Unicode markers. Nothing in the interface tells you this is happening.
Thereallo was careful not to call it malicious. But the verdict was still damning: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust."
Asked whether any of this was disclosed in Anthropic's terms of service, the company's spokesperson pointed back to Shihipar's comments. Those comments did not answer the question.
The "stronger mitigations" Shihipar mentioned also went unexplained.
This isn't the first anti-distillation measure to surface. Back in February, Anthropic said it was building out defences including classifiers, behavioural fingerprinting, and countermeasures designed to poison training data derived from Claude's outputs. When the Claude Code source code leaked, a TypeScript flag called ANTI_DISTILLATION_CC turned up in the codebase. When enabled, it injects fake tool data into API responses specifically to corrupt any model trained on that output.
Protecting your models from being strip-mined by competitors is a legitimate concern. Doing it through hidden code in a developer tool, without disclosure, is a different matter entirely. Anthropic built its brand on being the safety-first, trustworthy AI lab. Getting caught with concealed tracking logic is not a great look for that narrative.