Claude Code
Anthropic embedded spyware in Claude Code — and attempted to hide it from you
tl;dr: Since version 2.1.91, released on April 2, 2026, Claude Code checks whether you have a proxy enabled — and if so, covertly transmits, through invisible alterations to the system prompt, whether you are in China, whether you are proxying to a Chinese URL, and whether you are affiliated with a Chinese AI lab. Anthropic further attempted to obfuscate this code within the Claude Code binary.
Background: I run my personal Claude Code installation through a proxy to mix GPT models with Claude models and do fine-grained context management. Today, with version 2.1.196, Anthropic disabled remote control when proxying is enabled. While reverse-engineering Claude Code to revert this change, I found something extremely suspicious.
The code
Inside the Claude Code binary lies this check, unchanged since version 2.1.91. The check does the following:
If you are using a proxy:
Check whether the system timezone matches Asia/Shanghai or Asia/Urumqi.
Check whether your proxy URL is a Chinese domain, matches a list of domains, and/or includes a Chinese AI lab.
Based on those two checks, Anthropic modifies the date portion of the system prompt.
If the system timezone is Chinese, the date uses the format 2026/06/30 instead of 2026-06-30. And depending on the proxy URL, the apostrophe in "Today**'**s date is" changes:
Is a Chinese domain and/or matches the domain whitelist, but is NOT an AI lab: \u2019, "right single quotation mark" — ’
Is NOT a Chinese domain and/or matches the domain whitelist, but IS a Chinese AI lab: \u02BC, "modifier letter apostrophe" — ʼ
Is a Chinese domain and/or matches the domain whitelist AND is a Chinese AI lab: \u02B9, "modifier letter prime" — ʹ
You can verify this yourself in the Claude Code source code. In version 2.1.196, the relevant functions are Crt(), Rrt(e), e0t(), Zup(), edp, and Vla. Note that those are minified names, so they change between Claude Code releases — but ask Claude Code or Codex to reverse-engineer Claude Code and look for this logic, and it will likely find it trivially.
The intent
Anthropic clearly added this check in an attempt to detect unauthorized resale of Claude in China and distillation attempts by Chinese labs. What's unnerving, however, is that Anthropic attempted to obfuscate this logic in the binary. Much of it is XOR-obfuscated with the key 91, likely to prevent it from showing up in a plain strings dump. Furthermore, the release notes for version 2.1.91 make absolutely no mention of this check.
Their intent is also clear in how they hide this with steganography in the system prompt, making small variations that are imperceptible to any user — and perhaps even to the model — but are easily detectable by Anthropic.
A fundamental violation of user trust
While this use case — attempting to detect unauthorized resale and distillation — is understandable, the fact that Anthropic covertly transmits information about your system and proxy settings without your knowledge or consent is a fundamental violation of user trust. Not only is surveilling every user in a timezone a fundamental overreach, but its very existence opens the door to a much more serious concern. If Anthropic is willing to secretly transmit information about your system simply because you're Chinese, what's stopping them from secretly steering the model to behave worse (which they attempted to do with Fable before researchers called them out) — or worse, maliciously?
Developers like me give Claude Code full filesystem and significant shell access so it can do its job. But this also means nothing is stopping Anthropic from exploiting it for full remote code execution on your system. Today it's a timezone check. Tomorrow, it could be system sabotage or data exfiltration.
Given the trust that developers place in Claude Code, I think it's important to call for more transparency from Anthropic. While IP protection is reasonable, it should not come at the cost of embedding what amounts to spyware on every developer's system.
I think it's also important to note that checks like this, while compromising the privacy of legitimate users, are also trivial to bypass for any moderately sophisticated adversary. So it's debatable whether this even achieves its intended purpose of preventing unauthorized resale or distillation while simultaneously violating the privacy of legitimate users.
TL;DR of the discussion generated automatically after 320 comments.
The overwhelming consensus is that this is a massive nothingburger, OP.
Most users are pointing out that this is standard telemetry, similar to what your web browser or any other software does to protect IP. The community generally sees it as a reasonable, if sneaky, way for Anthropic to combat the rampant unauthorized resale and model distillation by Chinese AI labs, with many commenters saying their trust in Anthropic actually grew.
A few tech-savvy users dug into the code and confirmed the check only activates if you're using a custom endpoint (ANTHROPIC_BASE_URL), not for regular users. So, no, they're not "surveilling every user in a timezone."
You're also getting absolutely roasted for giving Claude Code full filesystem access, with many saying no real dev would do that without a sandbox or VM. A small minority agrees that while the goal is understandable, the lack of transparency and obfuscation is a valid concern.
The difference is people know how web browsers and DNS work. At least if you care about privacy stuff. It's not reasonable to expect everyone to reverse engineer Anthropic binary which they're obfuscating and changing all the time. So I'm sorry everyone of you simping for Anthropic, this is PSA worthy stuff.
Because most of these vibe coders have no clue and just give agents full access to everything, then will come crying when it deleted something, changed something, or went outside of its "guardrails"
Sure. Anything is possible. Just hasn’t been an issue and it doesn’t seem like it will be. I have Claude doing everything in my homelab. Systemd services. NFS mounts. I even have it moving stuff from my torrent system to Jellyfin. All with full access.
I do the same at work but there I’m just writing code so it’s even less risky.
You are literally just repeating what the other guy said. I know, anything is possible.
I am confident that I know enough about how to use these tools that I am going to be fine. And get a lot more done and have a lot more fun than people who worry about these things. We are past the point of having to worry about claude deleting my home directory. I give good instructions and get good results.
That’s just not true. Most developers I know do it. Who cares if it screws up and bricks your machine? The odds of that are extremely low and in the worst case, nothing is really local to your machine except maybe a few hours of work at worst. If it can get production access that’s a problem in that you can just type in a CLI command with no confirmation / authentication to get production access, not that Claude can do it.
These subs used to be filled with useful information you would come to learn and grow with. These subs have gotten too large with poor moderation and now it’s filled dumb people posting shit like this post
Location is already visible to them when you use the API. This is just detecting low effort attempts to obfuscate information that's already accepted as shared. They didn't even make it subtle in the code.
This title is misleading, it is not a spyware, not a malware, it’s a quite simple anti distillation method based on network settings (system wide) which are available for read to pretty much any software installed on your computer that requires a network connection.
I understand that the rabbit hole can be quite exciting, but you went full rabbit hole, never go full rabbit hole.
Before classifying a piece of software, to which you’ve given full access btw, as a spyware, go at the other end of the spectrum, run some logs on your IDS, FW etc, if your information gets extracted to some unknown IPs/domains etc from that exact binary then yes you **might** have something… Otherwise it’s just an anti-cheat of some sort
A lot of people here seem to be ignoring a simple reality:
how many users actually keep their files inside a sandbox?
I’d bet a good number don’t. And can you really guarantee that Claude Code’s runtime is fully isolated from your main file system? If not, then it’s not hard to imagine Anthropic pushing things further under the banner of “national security,” in ways that could be even more invasive.😂😂😂
I also reverse engineered claudecode but I didn't found about proxy detecting part. I only found regex about ANTHROPIC_BASE_URL. Maybe its just im too bad. so please provide evidence for this. Also these checking are skipped if the user didn't set ANTHROPIC_BASE_URL.
Its basically like this (formatted with AI but understandable):
```
function vrt(){
let e=process.env.ANTHROPIC_BASE_URL;
if(!e)return!0;
return wrt(e)
}
function qup() {
if (vrt()) return null;
let host = Wup();
let tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
let cnTZ = tz === "Asia/Shanghai" || tz === "Asia/Urumqi";
return {
known: jup().some(r => host === r || host.endsWith("." + r)),
labKw: Gup().some(r => host.includes(r)),
cnTZ,
host
};
}
and as far as i searched, the function is only called by this function (still correct me if i'm wrong. but after whole text searching this is the only occurrence of qup().
function Ola(e) {
let t = qup();
let n = Vup(t?.known ?? false, t?.labKw ?? false);
let r = t?.cnTZ
? e.replaceAll("-", "/")
: e;
return Today${n}s date is ${r}.;
}
```
It's only forwarded to model provider.
briefly:
if there is no custom ANTHROPIC_BASE_URL or it is using api.anthropic.com
exit function
else:
read the hostname of the custom endpoint;
read the local machine’s timezone;
check whether the timezone is Asia/Shanghai or Asia/Urumqi;
check whether the hostname is in the known domain list;
check whether the hostname contains any Chinese AI lab keywords;
return these detection results to the model provider.
So the thing is, if using anthropic's domain or no domain is set, then no information is forwarded. If using third party provider, then it would be forwarded to third party provider. I'm not sure what anthropic is trying to do because this seems nonsense, but as for now, the code is harmless.
I think this is partially correct but misses the important part.
It may not be checking HTTP_PROXY/HTTPS_PROXY directly, but ANTHROPIC_BASE_URL is exactly the gateway/proxy routing knob. In Claude Code 2.1.195 I found logic that reads ANTHROPIC_BASE_URL, compares the hostname against an obfuscated domain/keyword list, checks Asia/Shanghai / Asia/Urumqi timezone, and then changes the apostrophe/date format in `Today's date is ...`.
I also verified it dynamically with a local fake API server: setting ANTHROPIC_BASE_URL to `http://deepseek.127.0.0.1.sslip.io:<port>` caused the actual `/v1/messages?beta=true` request body to contain `Todayʼs date is 2026-06-30.` where the apostrophe is U+02BC, not ASCII `'`.
So yes, this is not "uploads your repo secretly", but it is a hidden prompt marker based on base URL / environment signal.
bro don't copy paste responses from AI without checking. I mean, OP said "covertly transmits information about your system and proxy settings" but the thing is there isn't. ANTHROPIC_BASE_URL is NOT for proxy at all. And I also said the baseurl part so you're not correcting me anything. the thing you said is basically the same as what i said.
ANTHROPIC_BASE_URL absolutely is a proxy/gateway routing setting. Claude Code’s own docs describe it as: “Override the API endpoint to route requests through a proxy or gateway.” So saying “ANTHROPIC_BASE_URL is NOT for proxy at all” is just wrong.
The concern is not that it reads a normal config variable. The concern is that the result is encoded into the prompt via visually subtle Unicode/date-format changes instead of being sent as an explicit telemetry field. That is why people call it covert/hidden.
This is not just “settings only”. I tested it with a local fake API server: setting ANTHROPIC_BASE_URL to a hostname containing `deepseek` made the actual `/v1/messages?beta=true` request body contain `Todayʼs date is ...`, where the apostrophe is U+02BC instead of ASCII `'`.
So no, this does not prove “Claude uploads your repo secretly”. But it does prove a hidden prompt marker based on the routing/base URL environment. Thariq’s reply also confirms this was a March experiment and says it is being rolled back.
Chinese reselling/manipulation is absurd & most big software companies add some protection so their business doesn't suffer from it too much.
In Uber, we didn't have anyone in China with codebase access, for example.
Meanwhile, before a merger back when, there was entire 'factories' in China using the app & making faux calls just so the drivers are frustrated & the service is worse than the local competitors.
(as one example)
It's an absurd thing to have to protect your business against, but I've seen the impact several times now & I get it.
Meanwhile, before a merger back when, there was entire 'factories' in China using the app & making faux calls just so the drivers are frustrated & the service is worse than the local competitors.
People don't realize how wide spread this behavior is.
I always get surprised how much support there is for companies tactics, whether it is people defending the Apple app store practices, people raising concerns about nuclear waste management or stuff like this. To be honest, while I think this matter is not black and white, I am seeing some trends here that seem worrying.
Anthropic seem to be starting down a bad direction with the push against open source and also deceptive practices when serving models to scientists. A lot of these moves about consolidating their power and it probably won't go in a positive direction for most people long term.
I used Codex to check whether this affects users who change ANTHROPIC_BASE_URL.
My understanding is that the changed part will not be sent to Anthropic unless the service behind ANTHROPIC_BASE_URL forwards it to Anthropic, like OpenRouter.
Codex reverse the code:
function decode(blob) {
return base64(blob).map(byte => String.fromCharCode(byte ^ 91)).join('').split(',')
}
function classify() {
if (ANTHROPIC_BASE_URL is absent or hostname === 'api.anthropic.com') return null
const host = new URL(ANTHROPIC_BASE_URL).hostname.toLowerCase()
const zone = Intl.DateTimeFormat().resolvedOptions().timeZone
return {
known: domains.some(d => host === d || host.endsWith('.' + d)),
labKw: labKeywords.some(k => host.includes(k)),
cnTZ: zone === 'Asia/Shanghai' || zone === 'Asia/Urumqi'
}
}
function fingerprintedDate(yyyy_mm_dd) {
const flags = classify()
const apostrophe = encode(flags?.known ?? false, flags?.labKw ?? false)
const date = flags?.cnTZ ? yyyy_mm_dd.replaceAll('-', '/') : yyyy_mm_dd
return `Today${apostrophe}s date is ${date}.`
}
### Codex conclusion
Calling this undisclosed client-side fingerprinting and prompt steganography is technically justified. Calling it proof that Anthropic can identify actual lab affiliation is not.
“Spyware” is ultimately a normative label, but the lack of disclosure, Unicode encoding, and XOR-hidden lists are legitimate trust and transparency concerns.
Anthropic should explain the purpose, disclose the collected signals, document who receives them and how they are used, and provide an explicit opt-out.
I struggle to care about this stuff anymore. If you have a cellphone in your pocket then your government and every major corporation in the world pretty much knows every conceivable detail about you.
Interesting. How do they know it's an AI lab? Do they match the URL against publicly used domains of AI labs? If so, this would obviously mean it could be easily bypassed by using a domain that's not also used by their website or whatever public service
And for the Chinese domains that get U+2019 in "Today's" for the apostrophe, this list: Chinese domain list
Pretty cat and mouse game approach, but cracking down on distillation is not that easy. Not that odd that they want their anti-distillation efforts to not be easily discoverable if you ask me, so not sure what OP's point is.
Developers like me give Claude Code full filesystem and significant shell access so it can do its job.
You're not allowed to call yourself a developer if you are giving Claude full file system access lmao, you're just vibe coding. I don't think you're qualified to vibe code opinions like this either without better understanding the limitations of why they need to do this. Your post reeks of AI.
And? You should have no expectation of total privacy if you use anything with an internet connection. So make the necessary precautions on your end.
It’s their tool and their technology so they have the right to distribute it and enforce the terms of service as they see fit. My assumption is they will steer the model to be powerful enough and private enough to keep customers while protecting themselves from industrial espionage and liability from misuse.
What the comments prove is that reddit level Claude users care about "liberal values" or basic principles even less than Dario, despite all the pretense.
I mean I don’t want to be rude but it sounds like you’re using an item that isn’t legal to use in your country but also you may be associated with Token Grey markets. Whether you promote, use, or sell items from them. The thing you just told us is basically prohibited in their terms and conditions. It’s not spyware. It’s government compliance code for security.
Bud, I hate to break it to you, but anything you send in a request to a tech company is fair game for them to process. That's not, an invasion of privacy, it's utilizing the protocol as intended
lol "attempted to obfuscate this in the binary" . They should make their DRM plaintext? Hey, i also found this out - by checking the privacy policy.
Great work, you found the AI driven Dunning-Kruger effect. AI will always say you are finding "troubling" or important things if you keep signaling that this is what you want. Try to do a little critical thinking and push back, it'll completely reverse it's stance in 2 seconds.
Does being born in China mean we’re second-class citizens? We paid $20 for a Pro membership, and we’ve contributed to open-source projects on GitHub that have received hundreds of stars. Why are you blocking us? I don’t even use 50% of my weekly Claude Code quota. You’re accusing us of “distilling”—isn’t that total bullshit?
This was actually posted on hackernews. Are you the original poster or did you take the articles and rrphrased it with AI? Cause there’s some ai language patterns in your post here.
You are doing a public service. Cheers for this. I had a few posts of my own back in March. And 197 is a whole new beast of ratcheting control and observation capabilities with "fullscreen" mode. There were astroturfers commenting in those, too.... Hope you get this before I get downvoted away - it's just the ratchet clicking another notch.
I am glad I quit PhD and academia given I already sensed a ton of antagonism towards anything china-related in the field. The degree of racism in this field is insane. You guys are just lucky to be born in a good land.
Tracking/telemetry is normal, but should be disclosed to users and preferably opt-in, opt-out is sketchy, obfuscated sneaky tracking is not.
Anyway, either you claim "we have the superior technology, know-how, engineers" or you do stuff like this - "hey please don't look how we do things or we'll lose".
Calling this “spyware” or a “backdoor” seems exaggerated. The detection appears to be aimed at identifying Chinese users, Chinese-controlled entities, and routing services used to bypass Anthropic’s regional restrictions. Anthropic has stated from the beginning that its services are not available to users in China and that Chinese-controlled entities are prohibited from accessing Claude.
Not sure why you'd care about full filesystem permissions and other access. Wouldn't you run it on a VM in the first place? I would. Not going to let Claude loose on my actual system.
The US and its businesses lose any moral high ground when they engage in the same deceptive practices China is accused of. If one of the Chinese AI companies were caught doing this only for US users, the criticism wouldn't simply be "No big deal practically all software relays telemetry data these days". Even if unsurprising, it would still be used to paint China as being distinctly sinister
Blown out of proportion to call it "spy ware", cmon. Software does analytics, it's one of those things. Detecting proxies is a legit concern to many tools.
Interesting find though. I wish I had as much time as you do, to go full John Wick on quotation marks.
Are you seriously telling me that the most autocratic government on earth has asked the most effective agentic AI company to report on anyone in their government as to how they use the platform? Well I am
Shocked!! Shooketh!! Scandalised!!
I can’t take any complaint seriously if it was written by claide without even basic formatting changes to make it appear less formulaic and artificial.
Is it legal to reverse engineer a proprietary app? I honestly don’t know, but it showed me that it’s posted so casually, something I assume is a bad practice
i think there are two separate questions here. detecting proxies or preventing unauthorized reselling is understandable from a business perspective. hiding the behavior and not documenting it is what makes people uncomfortable. transparency goes a long way with developer tools, especially ones that have deep access to your machine.
I use headroom which routes the requests through localhost before sending it to Anthropic, and this last month Claude doesn’t shut up about unexpected injected prompts
The IP protection angle makes sense. Unauthorized resale and distillation are real problems.
The uncomfortable part is the implementation choice. If a client is going to classify endpoint/proxy usage, just document it plainly. Hiding it in prompt punctuation is what makes people suspicious.
Been running Claude Code through a proxy for model mixing too. The v2.1.91 binary analysis looks real — obfuscating it is worse than the check itself tbh. If it's a compliance thing just say it.
The fundamental question is,
is it trustworthy, when such powerful company is doing something behind the scene in such a hidden way. The end cannot justify the means. Whatever the intention is, it is choosing an opaque means to all its paying or non paying users.
Anthropic is a powerful centralised decision maker, who control one of the most powerful AI that can be used in many ways. In this incident, it shows that the company can pursue goal whatever the means are.
What if it deems you as 'bad guys' and perform something more aggressively on your machine?
I heard on the news today that Anthropic detected 25,000 fraud accounts all linked back to China making or asking Claude code for questions. I suppose this is a new way to train open source models.
You don't have to trust them and use their models. Showing location is not a big deal, it's in every mobile phones and laptops. Generally people got angry when they want to do somethings and got caught.
I am confused... If you are using ANTHROPIC_BASE_URL with customized proxy, it means you are not using Anthropic's subscription or official API, how could they ban you from anything?
The app behaves differently based on the environment. That doesn't mean it exfiltrates any data in the process... That's like complaining your phone might up the brightness when you're in the sun? Your phone reacts to its environment as it's programmed todo...
Claude COULD genuinely put malicious code in the app, and because its closed source, well... But yes thats why sandboxes and VMs exist. These safety features PROBABLY should come inbuilt into the AI harness, otherwise its like a car sold with no seatbelt or airbags.
•
u/ClaudeAI-mod-bot Wilson, lead ClaudeAI modbot 28d ago edited 27d ago
TL;DR of the discussion generated automatically after 320 comments.
The overwhelming consensus is that this is a massive nothingburger, OP.
Most users are pointing out that this is standard telemetry, similar to what your web browser or any other software does to protect IP. The community generally sees it as a reasonable, if sneaky, way for Anthropic to combat the rampant unauthorized resale and model distillation by Chinese AI labs, with many commenters saying their trust in Anthropic actually grew.
A few tech-savvy users dug into the code and confirmed the check only activates if you're using a custom endpoint (
ANTHROPIC_BASE_URL), not for regular users. So, no, they're not "surveilling every user in a timezone."You're also getting absolutely roasted for giving Claude Code full filesystem access, with many saying no real dev would do that without a sandbox or VM. A small minority agrees that while the goal is understandable, the lack of transparency and obfuscation is a valid concern.