Discovery of a tracker secretly monitoring Claude Code users in China means that Anthropic’s anti-surveillance stance rings a bit hollow.

According to Ashley Belanger of ArsTechnica (Secret Claude tracker shocks users after Anthropic’s anti-surveillance stance, available here), Anthropic quickly removed a tracker secretly monitoring Claude Code users in China after a security researcher exposed the hidden code and condemned the spyware-like tracking as a “serious breach of user trust.”

Last week, a web developer known as “Thereallo” was researching privacy issues in Claude Code and was shocked to find that the AI firm was using “prompt steganography” to hide code that tracks Chinese users “in plain sight.” This code wasn’t malicious, but it was sending information to Anthropic that most users wouldn’t detect, relying on shorthand markers to quietly flag users’ timezone, proxy, and potential connection to Chinese AI labs that Anthropic has accused of distillation attacks.

On X, Anthropic engineer Thariq Shihipar confirmed that the tracker was added to Claude Code as an “experiment” in March. According to Shihipar, the code “was meant to prevent account abuse from unauthorized resellers and protect against distillation.” Supposedly, Anthropic has “actually been meaning to take this down for a while,” Shihipar said of the hidden code, because engineers have “landed stronger mitigations since then.”

Needless to say (but I’ll say it anyway), privacy advocates were not happy with the explanation, warning that the code is evidence that Anthropic is willing to cross lines to surveil users.

The irony is that Anthropic’s anti-surveillance stance was at issue when they refused to allow the US government to use Claude to surveil US users. Anthropic has since sued the White House over the clash.

Why are they doing it? As I covered last week on the Pinhawk newsletter, Anthropic has accused the Chinese firm Alibaba of using 25,000 accounts to mine Claude over 28.8 million exchanges, amid concerns they are working with the Chinese government. Anthropic has said the US must ramp up interventions, using a range of possible penalties to combat distillation attacks, including blocking access to advanced models, chips, and data centers in the US.

It appears to have helped. Last Friday, Alibaba banned its employees from using Claude Code for work, the South China Morning Post reported. According to a memo SCMP reviewed, Alibaba told employees the ban came in direct response to concerning news about a tracker Anthropic is using to monitor Chinese users.

Although most users were likely not impacted by the tracking, Thereallo warned that the “correct reaction” is more scrutiny of Claude’s potential for user surveillance, since “the feature mostly punishes the exact people who are easier to fingerprint: normal developers doing weird but legitimate things.”

“Hiding the signal in the system prompt makes every other privacy claim harder to believe,” Thereallo said.

Gee, you think?

So, what do you think? Are you surprised that Anthropic put in a tracker secretly monitoring Claude Code users in China? Please share any comments you might have or if you’d like to know more about a particular topic.

Image created using DALL-E 3, using the term “robot programmer looking devious”.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.