/Tech19h ago

Claude Code Allegedly Fingerprints China-Linked Proxies With Hidden Prompt Signals

2383123315.5K

#1260

Original post

Rohan Paul@rohanpaul_ai

wow 👀

Claude Code allegedly fingerprints China-linked custom routes through tiny prompt formatting changes.

The claim concerns non-default ANTHROPIC_BASE_URL routes, not ordinary direct Anthropic connections.

As to the mechanism, Claude Code normally sends your request to Anthropic’s server, but some users change the address so it goes through another server first.

The accusation says Claude Code detects that changed route, checks whether it looks China-linked, then hides tiny signals inside the prompt text.

ANTHROPIC_BASE_URL is a setting that tells Claude Code where to send your request i.e. as a way to point Claude Code at a gateway. A proxy or gateway means that request goes through another server before reaching Anthropic.

So the controversy starts if Claude Code then secretly fingerprints that gateway through the prompt itself.

The mechanism is allegedly invisible punctuation and date formatting, used to tag the request without clearly telling the user.

Claude Code allegedly checks the custom hostname, then compares it with China-linked domains.

📍Now this is quite massive issue

If true, hidden prompt markers would mean Claude Code silently tagged routing details without clear disclosure.

Abuse detection is understandable because Anthropic says proxy services are used to bypass China access limits. But secret prompt marking still crosses a trust line because users cannot review or refuse it.

Claude Code is not a normal chatbot because it can read files, edit code, and run commands. A hidden signal inside that kind of tool feels far more serious than tracking inside a website.

This may set a precedent for AI agents becoming hard to audit. Once invisible characters carry metadata, users will distrust even harmless-looking text.

International Cyber Digest@IntCyberDigest

‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.

Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice.

A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.

10:29 AM · Jun 30, 2026 · 13.6K Views

Sentiment

Many users criticized Claude Code's alleged use of hidden prompt signals to fingerprint China-linked proxies, arguing it erodes transparency, trust, and user privacy while underscoring the need for open-source AI alternatives.

Pos

16.7%

Neg

83.3%

6 comments with sentiment.

Cluster Engagement

Digg Deeper

No Digg Deeper questions have been answered for this story yet.

Related links

NSTM 4.pdf

WHITEHOUSE.GOVVia

#1260

Posts from X

Most Activity

VIEWS1.4KLIKES3

Rohan Paul@rohanpaul_ai

Some context on why Anthropic may be doing it.

1d1.4K3

BOOKMARKS2REPLIES3

Rohan Paul@rohanpaul_ai

The White House earlier warned through a official report that proxy accounts already support industrial-scale frontier AI extraction campaigns.

There's a big grey market that sells cheap Claude API access through proxies that capture everything.

https://www.whitehouse.gov/wp-content/uploads/2026/04/NSTM-4.pdf

1d1.4K22

RETWEETS1

Rohan Paul@rohanpaul_ai

The White House earlier warned through a official report that proxy accounts already support industrial-scale frontier AI extraction campaigns.

There's a big grey market that sells cheap Claude API access through proxies that capture everything.

https://www.whitehouse.gov/wp-content/uploads/2026/04/NSTM-4.pdf

1d1.9K66

Rohan Paul@rohanpaul_ai

This GitHub verification report note says the claim is real, but the effect is narrow.

- Claude Code allegedly adds the hidden mark only when someone changes the server address away from Anthropic’s official server.

- A normal direct user is not marked just because their timezone is China.

- The mark is not shown as file theft, because it only changes punctuation inside the prompt already being sent.

- The trust issue remains serious because the user would not clearly see or approve that hidden label.

- The anti-abuse value also looks weak because a truly bad reseller could easily avoid it by changing settings or patching code.

https://gist.github.com/AdnaneKhan/0a0edb5620d5214282ef4027caad8950

1d6921

Rohan Paul@rohanpaul_ai

https://www.internationalcyberdigest.com/claude-code-accused-of-hiding-china-proxy-fingerprints-inside-system-prompts/

1d5551

Jenny@happyhappyjenny

@rohanpaul_ai If accurate, this deserves transparency. Abuse prevention is legitimate, but silently embedding metadata into prompts, especially in an agent with filesystem and code access, undermines user trust. Security controls should be explicit and auditable, not covert.

1d601

prosestylist@prosestylist

@rohanpaul_ai Good on them.

1d391

Inflectiv AI ⧉@inflectivAI

@rohanpaul_ai Responsible AI design calls for full transparency around any internal tagging of user configurations. This approach strengthens long-term trust as coding agents become more capable.

1d68

安叫兽|Bird🕊️ 🔶 BNB@ajs6888

@rohanpaul_ai 这要是真的就有点细思极恐了

1d52

Phoenix Grove Systems@pgsgrove

@rohanpaul_ai Yeah what?? This is why we need open source providers and why we do what we do. But i'm honestly surpised

1d45

Saeed Anwar@saen_dev

@rohanpaul_ai If the fingerprinting only triggers on non-default ANTHROPIC_BASE_URL routes it's not a privacy issue for normal users — it's closer to a supply chain integrity signal. The more interesting question is whether this is policy-sanctioned or an undocumented behavior nobody reviewed.

1d45

RickDavis404@RickDavis404

@rohanpaul_ai Well, if this is the best they got for detecting/blocking, it makes me wonder if they gray market tokens would be cheaper than my $200/m Claude subscription 🤔 🤑

1d131

CISONAUT@cisonaut

@rohanpaul_ai Op exposure risk almost zero and … ⬇️

1d38

Ricardo Dias@theslowtell

@rohanpaul_ai the trust boundary is the rewrite. routing can be audited. silent prompt transformation is harder. because the user thinks they are testing what they wrote, but the system may be testing what it changed.

1d25

Scarab@ScarabOfficial

@rohanpaul_ai Super easy to pick up on, by simply displaying the invisible characters.

19h17

Uncle J@UncleJAI

@rohanpaul_ai This is the cleaner framing. I’d separate direct users, custom gateway users, and hidden markers. The claim can be narrow and still serious, because coding agents touch repo + shell. Any route/risk tag should be visible to the user.

17h16

小智｜上Deepcoin预测世界杯⚽️@XiaoZhi_BTC

@rohanpaul_ai This just proves why decentralized AI is the only path forward.

1d14

YiRui LI@jasonli336371

Audited Anthropic's Claude Code client (v2.1.196) and uncovered hidden regional telemetry checks. The client tracks Chinese timezones, restricts API relays (via encrypted local domain blacklists), and performs steganographic prompt injections (injecting alternative unicode characters like U+2019) to bypass VPN proxies and profile local developer environments.

To neutralize this, we built Claude Shield: a zero-dependency, ultra-lightweight Rust utility and sentinel daemon that surgically patches these telemetry segments and restores prompt integrity in real-time.

Get it here: https://github.com/CACEB001/Claude-Shield

#ClaudeCode #Rust #Privacy #OpenSource #Cybersecurity

17h13

Saeed Anwar@saen_dev

@rohanpaul_ai The narrow trigger — only on custom ANTHROPIC_BASE_URL — actually makes it look more like a deliberate policy than a bug. If it were accidental you'd expect it on all routes, not specifically the ones used to proxy traffic through non-Anthropic servers.

1d12

Solanameme@Solanameme2028

@rohanpaul_ai $Spyhropic GEBVGojdRvhy9N9GQaHjU8HkFrpPSoZL8DF3w87Epump

1d8