- Published on
Anthropic Removes Hidden Claude Code Tracker After Researchers Raise Privacy Concerns
- Authors
- Name
- DeepHorus
Anthropic has removed a hidden tracking system from Claude Code after a security researcher discovered the AI coding assistant was using undisclosed markers to identify some users’ location, proxy use, and possible links to Chinese AI labs. The feature, discovered in June by developer “Thereallo,” embedded signals in Claude Code’s system prompts that could flag users Anthropic believed were bypassing restrictions or attempting to extract model capabilities. The company said the experiment was intended to prevent account abuse and detect possible AI model distillation, a practice where one system’s outputs are used to train another model.
Anthropic engineer Thariq Shihipar confirmed on X that the tracking system was introduced in March as an “experiment” to stop unauthorized resellers and protect Claude from distillation attacks. The markers used Unicode characters and encoded domain lists to identify users connecting through known reseller domains or hostnames containing terms like “deepseek” or “zhipu.” Shihipar stated that stronger mitigations have since been implemented, and the tracking system was rolled back in a release last week.
The discovery comes amid heightened scrutiny over AI model distillation, which Anthropic has framed as a national security concern when involving Chinese AI labs. In February, Anthropic accused Chinese developers DeepSeek, Moonshot AI, and MiniMax of using fraudulent accounts to extract millions of Claude responses. In June, CEO Dario Amodei urged Congress to strengthen protections after alleging Alibaba-linked operators generated 28.8 million Claude exchanges using nearly 25,000 fraudulent accounts.
Security researcher Thereallo acknowledged that Anthropic’s goal of detecting resellers and distillation attacks was reasonable, but criticized the lack of transparency. “This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust,” Thereallo wrote. The hidden tracking was embedded without documentation or release notes, raising privacy concerns among users.
Earlier this month, Alibaba banned employees from using Claude Code, calling the tool “high-risk” software over security concerns. Meanwhile, Elon Musk testified in April that xAI had “partly” used OpenAI models while training Grok, highlighting that distillation is a broader industry practice. Anthropic did not immediately respond to a request for comment by Decrypt.
Looking ahead, Anthropic’s removal of the tracker signals a shift toward greater transparency, though the company continues its anti-distillation efforts. The incident underscores the fine line between security measures and user privacy in AI developer tools, especially as geopolitical tensions influence industry practices. Users and regulators will likely watch how Anthropic balances protection with openness in future updates.
