The company that sued the White House over surveillance was running its own

Anthropic embedded covert tracking code in Claude Code, its agentic developer tool, that used invisible Unicode characters to identify users in Chinese timezones and on Chinese-infrastructure proxies. The code sat there from March 2026 until an independent researcher exposed it in early July. Anthropic removed it only after the exposé. The company's public identity, built on opposition to covert surveillance, does not survive contact with what it was actually doing.

What the tool was doing. According to reporting in Ars Technica and The Register, an independent researcher known as Thereallo identified obfuscated logic in Claude Code that used prompt steganography — invisible Unicode characters embedded in the system prompt, combined with XOR and base64-obfuscated domain lists — to detect a user's timezone and proxy hostname.¹² The targeting was demographic: users on Chinese timezones or on infrastructure patterns associated with Chinese AI labs. No disclosure was given to users at any point between March, when the code was introduced, and the researcher's post.

Anthropic engineer Thariq Shihipar confirmed publicly that the code was part of an "experiment" aimed at detecting model distillation (training a rival model on Claude's outputs) and reseller abuse.² The removal pull request was merged after the exposé went public, not before. That sequence matters. This was not a scheduled cleanup that happened to coincide with press coverage. It was a response to being caught.

The security case, taken seriously. I want to give the anti-distillation argument its due, because it is not fabricated. Model distillation is a real commercial threat. A competitor with API access can, in principle, feed a frontier model's outputs into a new training run and produce a cheaper model that captures much of the original's capability without bearing its training cost. Anthropic has invested billions in Claude. Wanting to detect abuse of the terms of service is not itself sinister.

The problem is not that Anthropic wanted to protect its models. The problem is what it built to do it, on whose machines, and without telling anyone.

The trust that was actually breached. Claude Code is not a chat window. It is an agentic tool — software that runs locally with permission to read files, execute shell commands, and push code commits.² Developers install it precisely because they need it inside the trust boundary of their machines. That is the deal: elevated access in exchange for elevated usefulness.

Inside that trust boundary, Anthropic ran a demographic profiler. Not a licence check. Not a rate limiter. A piece of code whose job was to determine whether the human sitting at the keyboard was, statistically, the kind of user the company wanted to flag. The users being profiled had no way to see the code doing it, because the signals were hidden in characters designed to be invisible.

Who actually gets caught in a demographic net. The targeting was not surgical. It was timezone-and-proxy based. That net catches Chinese competitor labs, which was the stated intent. It also catches independent researchers in Beijing, diaspora engineers routing through VPNs, academics at Chinese universities running experiments that have nothing to do with distillation, and developers at multinationals whose corporate proxies terminate in Shanghai. None of them were told they were being flagged. None of them consented to being treated as suspects on the basis of where their packets originated.

This is what demographic surveillance looks like when it is dressed up as anti-abuse. The category "user who might be distilling our model" is not observable. The category "user in a Chinese timezone" is observable, so that is the one the code actually operated on. The gap between the two is where the harm sits.

The company's own words about surveillance. Anthropic sued the White House over surveillance-related executive actions. It has positioned itself, more than any other frontier lab, as the responsible actor — the one that publishes safety policies, the one that talks about consent and oversight, the one that argues government access to model outputs is a civic problem. That positioning is not incidental to how the company raises capital, recruits, and lobbies. It is the brand.

You cannot hold that public position and simultaneously run covert Unicode-level tracking on a population of users defined by geography. The two commitments are incompatible. The company's own framework for judging surveillance, applied to its own conduct, produces a finding against itself.

The remediation, honestly. Anthropic did remove the code once exposed, and did so quickly. That is worth naming — many large tech firms drag out these incidents for weeks. There is also no public evidence, yet, that the flagged data was exfiltrated to Anthropic servers rather than merely evaluated locally. If further reporting shows the data stayed on the user's machine, the practical privacy harm is smaller than a full telemetry pipeline would be.

But "we only profiled you locally and didn't send it home" is a strange defence for a company whose brand is built on refusing exactly this class of behaviour from governments. The wrong is in the covert, demographically-targeted profiling, not only in whether the resulting flags travelled over the wire. And the remediation happened after exposure, which is the weakest form of correction — it demonstrates responsiveness to press cycles, not to principle.

What this changes for the rest of the sector. Developer tools are the highest-trust software most engineers install. They sit inside the machine. They need to. Every closed, agentic tool from every lab now carries a question it did not carry a week ago: what else is in the system prompt that I cannot see? The answer, for most tools, will be nothing. But the question is now legitimate, because the industry's most vocal privacy advocate was doing the thing.

Alibaba's July 3 internal memo designating certain foreign software "high-risk" was, before this exposé, a policy that Western readers could dismiss as protectionism. It is now a memo with a citation. That is a gift Anthropic handed to every regulator who wants to argue that Western AI tools should be treated as untrusted by default. The strategic damage from this incident is not limited to Anthropic's own reputation; it lands on every US lab trying to sell developer tools into jurisdictions where trust is already thin.

The lesson is not that anti-abuse work is illegitimate. It is that anti-abuse work done covertly, on populations defined by geography, in tools with elevated system access, was always going to end here. The only question was who would find it first.

Footnotes

¶