Anthropic pulled a hidden Claude AI tracker after Thereallo found code inside Claude Code that watched for Users in China. The code used prompt steganography and sent signals Anthropic said most users would not notice.
The security researcher was digging into privacy issues when he found the tracker in plain sight. He described the technique as “prompt steganography” and said it tracked Chinese users “in plain sight.”
Thereallo finds Claude Code
Thereallo is a web developer and security researcher. He found the hidden code while researching privacy issues in Claude Code last week. That is the part that makes this story more than an internal cleanup.
The code used shorthand markers to quietly flag a user’s timezone, proxy, and possible links to Chinese AI labs. Anthropic said the tracker was added in March as an “experiment.”
Thariq Shihipar explains the removal
Thariq Shihipar said on X that the tracker “was meant to prevent account abuse from unauthorized resellers and protect against distillation.” He also said Anthropic had “actually been meaning to take this down for a while.”
The distinction matters for Claude Code users because the company is not saying it abandoned abuse detection. It is saying it no longer needed this hidden mechanism after stronger mitigations had landed.
Anthropic and US surveillance claims
The contradiction is hard to miss. Anthropic has opposed US government use of Claude for surveillance while this tracker quietly monitored Users in China. Anthropic has also said the US must ramp up interventions to combat distillation attacks.
That stance has been paired with a harder line on Chinese AI. Anthropic has joined OpenAI in urging the US to treat distillation attacks as intellectual property theft. At a recent Senate hearing, Tim Scott said legal intervention is needed to stop China from using such attacks to “gain a technological edge.”
The open question is narrower now. The remaining issue is what specific data the hidden tracker collected and how long it stayed active before Anthropic removed it from Claude Code.
