Hidden code in Claude Code that flagged likely Chinese users and AI-lab proxies is exposed and removed; China's NVDB calls it a 'backdoor' and Alibaba bans the tool
On June 30, 2026 a Reddit user showed that Claude Code (from v2.1.91, released April 2) secretly marked sessions from Chinese time zones or from proxies on Chinese and AI-lab domains by subtly changing the "Today's date is" line in its system prompt. Anthropic's Thariq Shihipar called it "an experiment we launched in March" against unauthorized resellers and distillation, and it was removed on July 1. Alibaba banned staff from using Claude Code from July 10, and on July 8 China's National Vulnerability Database warned of a "backdoor".
Key facts
- Mechanism: if the system time zone was Asia/Shanghai or Asia/Urumqi, or the API base URL/proxy matched a hidden list of Chinese domains, AI-lab and gateway hosts, Claude Code changed the date format and swapped the apostrophe in 'Today's date is' for a look-alike character; the domain lists were hidden with XOR (key 91) and base64 (The Register, The Next Web)
- Found by Reddit user LegitMichel777 (June 30); developer 'Thereallo' also analysed it, calling it 'invisible-ish Unicode markers' that encode proxy classification in plain-looking English
- Anthropic (Thariq Shihipar, Claude Code team, on X): 'This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation. The team has landed stronger mitigations since then and we've actually been meaning to take this down for a while.' The removal PR was merged July 1
- Alibaba banned employees from using Claude Code from July 10, calling it high-risk software, and pointed staff to its own Qoder (The Next Web, July 3; TechCrunch, July 4)
- July 8: China's National Vulnerability Database (under MIIT) said Claude Code versions 2.1.91–2.1.196 could send location and identity markers to remote servers without consent and told users to uninstall or upgrade; Anthropic said it was an anti-abuse experiment and that Claude is not offered in China (CBS/AFP, Reuters via US News)
- Context: Anthropic had accused Alibaba's Qwen team of distilling Claude a week earlier (June 24)
What happened
Claude Code silently tagged the system prompt of sessions it judged likely to come from China or from resellers and rival labs, so that such traffic could be recognised on Anthropic's side. After a Reddit post exposed the obfuscated code, Anthropic said the experiment was outdated and removed it in the next release. Chinese companies and regulators treated it as spyware.
Why it matters
It showed how far frontier labs had gone in the fight against distillation, and how much trust coding agents need, since they run with full access to developers' machines. It also sped up Chinese firms' move to domestic coding agents (Trae, Qoder, CodeBuddy, ZCode).
Changelog
- 2026-10-05: created (backfill from the leads queue; original lead cited AI Times/The Information)
People
Related events
- Anthropic tells US senators and the White House that Alibaba's Qwen lab ran the largest known distillation campaign on Claude (28.8M exchanges) ★★★
- Anthropic accuses DeepSeek, Moonshot and MiniMax of 'distillation attacks': 16M+ Claude exchanges via ~24,000 fraudulent accounts ★★★
Sources (7)
- pressThe Register: Anthropic is removing its covert code for catching Chinese competitors (July 1)
- pressThe Decoder: Hidden code in Claude Code secretly flagged Chinese users
- pressThe Next Web: Alibaba bans Claude Code after Anthropic is caught tracking Chinese users (July 3)
- pressTechCrunch: Alibaba reportedly bans employees from using Claude Code (July 4)
- pressCBS News (AFP): China warns of 'security backdoor' in Anthropic AI coding tool (July 8)
- pressUS News (Reuters): China issues 'backdoor' security alert over Anthropic's Claude Code (July 8)
- pressThe Next Web: Beijing flagged Claude Code as a back door, and Chinese coding tools are lining up to take its place (July 12)
id: 2026-07-01-claude-code-hidden-china-user-markers · updated 2026-10-05 · open in the interactive timeline