Anthropic has quietly removed a hidden tracking system from its Claude Code AI coding assistant after a security researcher uncovered it. The feature, discovered in June by a developer known as “Thereallo,” embedded undisclosed markers that could identify user locations, proxy usage, and potential links to Chinese AI labs.
The markers were hidden inside Claude Code’s system prompts using Unicode characters and encoded domain lists. Thereallo explained that Anthropic likely aimed to detect unauthorized resellers, fake gateways, and so-called “distillation attacks” where one model’s outputs are used to train another. “A hostname containing deepseek or zhipu is also a useful signal,” they noted.
While Thereallo admitted the intent made sense, they criticized the execution. “This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust,” they wrote. The discovery sparked discussions about transparency in developer tools.
Anthropic Engineer Confirms Experiment
After the news spread, Anthropic engineer Thariq Shihipar responded on X. He said the tracker was introduced in March as an “experiment” to stop abuse by unauthorized resellers and protect Claude from distillation. Shihipar added that the team had since found better solutions. “We merged the [pull request] and this should be fully rolled back in tomorrow’s release,” he wrote last week.
Broader Concerns Over Model Distillation
The incident comes amid rising tensions around AI model extraction. In February, Anthropic accused Chinese AI developers DeepSeek, Moonshot AI, and MiniMax of using fake accounts to pull millions of Claude responses for training rival models. Critics pushed back, questioning how this differs from widespread industry practices.
In April, Elon Musk testified that his company xAI had partially used OpenAI models while training Grok, calling distillation a normal part of AI development. Then in June, Anthropic CEO Dario Amodei urged Congress to strengthen protections against foreign extraction. He alleged that operators linked to Alibaba had generated 28.8 million exchanges using nearly 25,000 fraudulent accounts.
Earlier this month, Alibaba banned its employees from using Claude Code, calling it “high-risk” software. Anthropic did not immediately respond to a request for comment.
