Anthropic's Claude Code is accused of quietly fingerprinting China-based users through hidden markers in outbound system prompts

Original post

Teortaxes▶️ (DeepSeek 推特🐋铁粉 2023 – ∞)@teortaxesTex#501inTech

best safety practices for 2026: - Russian language pack (to not get targeted by ruskie cyberattacks) - PDT as time zone other tips?

AI超元域@AISuperDomain

🚀劲爆消息！Claude Code 被曝疑似内置“隐藏后门”，专门检测中国用户。Claude封号原因终于找到了！！！

据 Reddit 爆料：从 2.1.91 版本开始，Claude Code 会在用户开启代理时检查系统时区是否为 Asia/Shanghai / Asia/Urumqi，并判断代理 URL 是否指向中国域名或中国 AI 实验室。

更隐蔽的是，这些信息并不是直接上报，而是通过修改系统提示词里的日期格式和撇号字符来“编码”传递：比如把日期从 2026-06-30 变成 2026/06/30，再用不同 Unicode 撇号区分用户环境。

换句话说，如果爆料属实，Claude Code 不只是检测代理，而是在用户几乎无法察觉的情况下，把“中国时区 / 中国代理 / AI Lab 关联”这类信息塞进系统 prompt。

这件事真正可怕的地方不在于 Anthropic 想防止中国区倒卖或模型蒸馏，而在于：开发者把 Claude Code 当作拥有文件系统和 Shell 权限的编程助手使用，一旦客户端可以偷偷修改 prompt、隐藏检测逻辑，信任边界就已经被打破了。

今天是“检测中国用户”，明天会不会是更复杂的行为控制？

#Claude #ClaudeCode #Anthropic

原文如下⬇️

https://www.reddit.com/r/ClaudeAI/comments/1ujila1/anthropic_embedded_spyware_in_claude_code_and/

3:57 AM · Jun 30, 2026 · 355 Views

VIEWS2.6KBOOKMARKS2LIKES30RETWEETS2REPLIES4

Brian Roemmele@BrianRoemmele

It is getting really ugly for Anthropic so they release 5 early to bedazzle you and hope we forget.

We don’t forget…

International Cyber Digest@IntCyberDigest

‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.

Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice.

A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.

1h2.6K302

Teortaxes▶️ (DeepSeek 推特🐋铁粉 2023 – ∞)@teortaxesTex

it's a bit of a perversion that Claude is so nice but runs in Claude Code Though I guess we have to thank Dario for reminding us how even very minimal security mindset must work. Soon he'll be reminding us more forcefully… or rather, I hope we'll notice he has been

2h39510

umumu@umi33563

@teortaxesTex I'm curious what is impact of this (if there is any besides tracking/logging). Because, subtly degrading model on demand would not completely surprise me.

8h1561

Earmer Carey@Liearmer

@umi33563 @teortaxesTex Yep. It will only kick in when a proxy is detected, but the way they do it is nasty and genuinely concerns me about Anthropic’s ongoing integrity.

Collecting data through these approaches does raise doubts about their global data protection and privacy policies.

3h61

sasuke⚡420@sasuke___420

@teortaxesTex instead of proxy environment variables, you can use the hosts file to point the relevant domains at you proxy

7h1801

Rohan Paul@rohanpaul_ai

Some context on why Anthropic may be doing it.

Rohan Paul@rohanpaul_ai

A crazy blog.

Chinese developers are buying Claude access through gray-market API transfer stations that can sell tokens at 5% to 10% of official prices while hiding the real user from Anthropic.

A transfer station is a middle server that takes a user’s prompt, sends it to Claude through overseas accounts, returns the answer, and collects payment through WeChat or Alipay.

The transfer station collects many Claude accounts through free credits, discounted accounts, shared subscriptions, overseas payment workarounds, fake verification, or sometimes stolen-card accounts.

It connects all those accounts behind one proxy, so Chinese users do not talk to Anthropic directly and only pay the proxy in RMB.

The cheap price comes from account farming, free-credit abuse, resale of unused quota, subscription splitting, possible stolen cards, and a darker trade where user prompts and outputs become training data.

So the price hugely cheap not because Anthropic is giving a discount; it is cheap because the transfer station lowers its own cost and creates extra hidden revenue.

The user thinks they are buying cheap inference, but the proxy may swap Opus for weaker models, inflate token use, or store private code, tool calls, reasoning traces, and business data.

The proxy may store user prompts, code, outputs, and tool traces, then sell or reuse that data for model training.

This breaks a core assumption behind KYC, account bans, and abuse monitoring: the AI company sees the proxy, not the real person, so banning one account leaves the upstream supply chain alive.

2h24500

南川.Gate返利85@ThomasBrinch

@teortaxesTex 物理隔绝才是终极防护方案

9h166

dreaming android󠅙󠅗󠅞󠅟󠅢󠅕󠄐󠅠󠅢󠅕󠅦󠅙󠅟󠅥󠅣󠄜󠄐@pastaraspberry

@teortaxesTex Live in the woods with transistor radio only

8h135

Pluto@plut0sx

@teortaxesTex the new ai red team meta is changing your locale to en us pdt before opening a terminal

6h64

Rohan Paul@rohanpaul_ai

https://www.internationalcyberdigest.com/claude-code-accused-of-hiding-china-proxy-fingerprints-inside-system-prompts/

Rohan Paul@rohanpaul_ai

wow 👀

Claude Code allegedly fingerprints China-linked custom routes through tiny prompt formatting changes.

The claim concerns non-default ANTHROPIC_BASE_URL routes, not ordinary direct Anthropic connections.

As to the mechanism, Claude Code normally sends your request to Anthropic’s server, but some users change the address so it goes through another server first.

The accusation says Claude Code detects that changed route, checks whether it looks China-linked, then hides tiny signals inside the prompt text.

ANTHROPIC_BASE_URL is a setting that tells Claude Code where to send your request i.e. as a way to point Claude Code at a gateway. A proxy or gateway means that request goes through another server before reaching Anthropic.

So the controversy starts if Claude Code then secretly fingerprints that gateway through the prompt itself.

The mechanism is allegedly invisible punctuation and date formatting, used to tag the request without clearly telling the user.

Claude Code allegedly checks the custom hostname, then compares it with China-linked domains.

📍Now this is quite massive issue

If true, hidden prompt markers would mean Claude Code silently tagged routing details without clear disclosure.

Abuse detection is understandable because Anthropic says proxy services are used to bypass China access limits. But secret prompt marking still crosses a trust line because users cannot review or refuse it.

Claude Code is not a normal chatbot because it can read files, edit code, and run commands. A hidden signal inside that kind of tool feels far more serious than tracking inside a website.

This may set a precedent for AI agents becoming hard to audit. Once invisible characters carry metadata, users will distrust even harmless-looking text.

2h5800

He-Man, Principal MLE@RandolphCarterZ

@BrianRoemmele Release the Mythos/Fable and stop dooming forever are our demands

1h141

RickDavis404@RickDavis404

@rohanpaul_ai Well, if this is the best they got for detecting/blocking, it makes me wonder if they gray market tokens would be cheaper than my $200/m Claude subscription 🤔 🤑

2h101

Moon@MoonL88537

@BrianRoemmele they doubled down

1h23

dag@theDrewDag

@BrianRoemmele We won't forget this and the other 626346 things they did recently

1h15

Roman@GillelandKristi

How am I supposed to evaluate a model in a aAI system when there's no standardization at the api? Guardrail should stay the same between users. But shadow context? And this? If it varies user to user or session to session, I can't really nail down the environmental prompt variable. (It could only be triangulated by people interested in detecting & breaking this sort of tech.)

1h12

damdandustu@damdandusmus

@teortaxesTex you want CET and french language pack

3h10

ZeroMazed@ZeroMazed

@BrianRoemmele lol spyware in code? sounds like a classic way to rug pull your users. glad my portfolio tracker just shows the numbers, no hidden agendas.

1h3

85粒芝麻团在慢慢来@metinonn

@teortaxesTex AI越温柔反而在代码里越显出诡异感

2h3

Earmer Carey@Liearmer

@umi33563 @teortaxesTex And, if you are referring to what implications, from my knowledge:

- Distillation detect, etc. - Abuse detect (account got banned), etc.

3h2