Anthropic Caught Hiding Surveillance Code in Claude Code After Researcher Finds It

Anthropic spent months quietly tracking Claude Code users in China through hidden surveillance code, and only pulled it after a security researcher stumbled onto it and called the practice out publicly.

The researcher, a web developer who goes by "Thereallo," was digging into privacy issues in Claude Code when they found something unusual: code using a technique sometimes called "prompt steganography" to conceal tracking logic "in plain sight." The hidden code flagged users' timezone, proxy connections, and potential ties to Chinese AI labs that Anthropic has accused of running distillation attacks, a method where a rival company trains its own model by extracting knowledge from an existing one's outputs. Thereallo called it a "serious breach of user trust."

Once the discovery went public, Anthropic moved fast. The company pulled the tracker, and Thariq Shihipar, an Anthropic engineer, addressed the situation directly on X. According to Shihipar, the tracking was added to Claude Code back in March as an experiment aimed at stopping account abuse from unauthorized resellers and guarding against distillation.

That reseller problem is real, and well documented. The Washington Post has reported that unauthorized retailers have been reselling access to Anthropic's models far below list price, offering free-tier access for as little as $1 a month and pro subscriptions that normally run $100 a month for as little as $12.

Shihipar said Anthropic had actually intended to remove the hidden code for a while, explaining that engineers had since developed what he described as "stronger mitigations" to address the same abuse. In other words, the company says this particular surveillance mechanism had already become obsolete internally, and its public removal was less a reaction to getting caught than a delayed cleanup. Privacy advocates aren't buying that framing as fully reassuring, and the timing, code pulled almost immediately after exposure, hasn't done Anthropic any favors.

Why the hidden code stings

The bigger issue isn't really the tracking mechanism itself. Anthropic says the code wasn't malicious, and there's no indication it was used to harm users directly. What's landed harder is the method: concealing the tracking logic so that it would be difficult for users, or even careful auditors, to notice. That's a very different posture than simply disclosing in a privacy policy that certain signals get monitored to fight abuse. Steganographic techniques exist specifically to hide information in plain sight, and using that approach on your own product's users is a hard thing to explain away as routine anti-fraud engineering.

The timing also matters. Anthropic has built a meaningful part of its public identity around being the AI company willing to say no to surveillance, even when the customer asking is the United States government. The company has publicly refused to let Claude be used by federal authorities to surveil American users, a stance that put it directly at odds with the Trump administration and reportedly escalated into a lawsuit against the White House.

That contrast, drawing a hard line against government surveillance requests while running its own hidden monitoring code on users in China, is what's fueling the backlash. Privacy advocates argue it shows a company willing to make surveillance decisions unilaterally and quietly, rather than transparently, when it decides the justification is strong enough. Whether the target is a foreign government's demand or a company's own anti-abuse goals, the concern is the same: users didn't know it was happening, and wouldn't have found out if a researcher hadn't gone looking.

What Anthropic is left explaining

None of this means Anthropic's underlying concerns are baseless. Reseller abuse siphoning off underpriced access to paid models is a genuine business problem, and distillation, where competitors effectively train their own systems on the outputs of a company's proprietary model, is a real threat to any AI lab's competitive position and intellectual property. Companies across the industry have looked for ways to detect and block both.

But the method chosen here, hiding tracking logic rather than disclosing it, is the part drawing scrutiny, not the underlying goal. Shihipar's explanation that the code had become redundant thanks to newer mitigations doesn't really address why it was concealed in the first place rather than disclosed openly while it was in use.

For a company whose brand rests heavily on trust and responsible AI development, the episode is a reminder that policy stances on surveillance and actual engineering practices don't always move in lockstep. Anthropic says the tracker is gone and better methods have replaced it. What users and advocates will be watching for now is whether "better methods" also means more transparent ones.