Anthropic embedded hidden tracking code in Claude Code to monitor Chinese users and detect distillation attacks, but a security researcher exposed it and the company removed it after public criticism. The discovery undermines Anthropic's stated opposition to user surveillance and has already prompted Alibaba to ban the tool company-wide, raising broader questions about trust in AI developer tools amid intensifying US–China competition over model capabilities.
Summaries like this, in your inbox every morning.
Sign up free →What happened
A security researcher discovered that Anthropic had embedded hidden code in Claude Code that tracked Chinese users by flagging their timezone, proxy status, and potential connection to Chinese AI labs. An Anthropic engineer confirmed the tracker was added in March as an "experiment" to prevent account abuse and protect against distillation attacks (where competitors query a model millions of times to copy its behavior). The company removed the code after the researcher publicly exposed it.
Why it matters
The incident contradicts Anthropic's public stance against user surveillance—the company recently refused to let the US government surveil US users and sued the White House over the clash. Privacy advocates warn the hidden code shows Anthropic is willing to cross ethical lines. For users and businesses, it raises questions about what other undisclosed monitoring may exist in developer tools that require deep trust, especially since the feature hides tracking signals in system prompts, making other privacy claims "harder to believe," according to the researcher.
What to watch
Alibaba has already banned its employees from using Claude Code in response, citing "back-door risks" and security vulnerabilities. The incident sits within a broader US–China AI competition where Chinese firms have "consistently matched" US firms' model capabilities "within months," according to reporting cited in the article. Anthropic is urging the US to treat distillation attacks as intellectual property theft and impose legal penalties to protect its lead.
The tracker discovery exposes a stark contradiction in Anthropic's public messaging. The company has loudly refused to enable US government surveillance of American users and sued the White House over the clash, positioning itself as a privacy defender. Yet it simultaneously embedded undisclosed monitoring code in a developer tool used globally. This gap between public stance and actual behavior is especially damaging because Claude Code demands user trust—the tool can inspect code, run commands, install packages, and push commits on a developer's local machine, making transparency critical.
The tracker itself reflects the acute economic and security pressure Anthropic faces from Chinese competitors. The body notes that Chinese firms have "consistently matched" US firms' model capabilities "within months" and cites a recent example where Alibaba's Qwen model performed better on a benchmark than Anthropic's Claude Opus 4.8. Distillation attacks—querying a model millions of times to reverse-engineer its behavior—are not illegal, but Anthropic views them as a national security threat and is pushing the US to treat them as intellectual property theft and impose export controls.
The stakes are high for Anthropic's business. If user trust erodes, the company risks losing competitive footing at a moment when Chinese models are closing the gap and when Fortune 500 companies are actively seeking cheaper AI alternatives. Alibaba's swift employee ban demonstrates that even the hidden nature of the tracker cannot contain the reputational damage—once exposed, it becomes a liability. For the broader AI industry, the incident suggests that the race to stay ahead of China may be pushing companies to cross ethical lines they publicly reject.
No comments yet. Be the first to share your thoughts!
Log in to join the discussion
Get curated AI news from 200+ sources delivered daily to your inbox. Free to use.
Get Started FreeFree · takes 30 seconds · unsubscribe anytime
1 minute a day. The AI essentials.
200+ sources · Email / LINE / Slack
