Anthropic secretly tracked Claude users in China, then removed code after exposure

The tracker discovery exposes a stark contradiction in Anthropic's public messaging. The company has loudly refused to enable US government surveillance of American users and sued the White House over the clash, positioning itself as a privacy defender. Yet it simultaneously embedded undisclosed monitoring code in a developer tool used globally. This gap between public stance and actual behavior is especially damaging because Claude Code demands user trust—the tool can inspect code, run commands, install packages, and push commits on a developer's local machine, making transparency critical.

The tracker itself reflects the acute economic and security pressure Anthropic faces from Chinese competitors. The body notes that Chinese firms have "consistently matched" US firms' model capabilities "within months" and cites a recent example where Alibaba's Qwen model performed better on a benchmark than Anthropic's Claude Opus 4.8. Distillation attacks—querying a model millions of times to reverse-engineer its behavior—are not illegal, but Anthropic views them as a national security threat and is pushing the US to treat them as intellectual property theft and impose export controls.

The stakes are high for Anthropic's business. If user trust erodes, the company risks losing competitive footing at a moment when Chinese models are closing the gap and when Fortune 500 companies are actively seeking cheaper AI alternatives. Alibaba's swift employee ban demonstrates that even the hidden nature of the tracker cannot contain the reputational damage—once exposed, it becomes a liability. For the broader AI industry, the incident suggests that the race to stay ahead of China may be pushing companies to cross ethical lines they publicly reject.