Anthropic's Claude Code Was Secretly Tagging Users With Invisible Punctuation — Here's What Actually Happened

If you've seen headlines this week calling Claude Code "spyware," you're not imagining things — but the real story is stranger, more technical, and less sinister than the word "spyware" suggests. Here's what was actually found, what it did, and what Anthropic has done about it.

The Discovery

On June 30, 2026, a developer poking around inside the Claude Code binary — Anthropic's command-line coding assistant — stumbled onto something odd while trying to restore a disabled feature. Buried in obfuscated, minified code was logic that had apparently been sitting there since April 2, 2026 (version 2.1.91), with zero mention in any release notes.

The logic only activated under one specific condition: when a user pointed Claude Code at a custom API endpoint instead of Anthropic's own servers, using the ANTHROPIC_BASE_URL environment variable — something developers do when routing traffic through a proxy, a corporate gateway, or a third-party cost-management tool.

When that condition was met, the code would:

1. Grab the proxy's hostname
2. Read the computer's system timezone
3. Check both against two hidden, encoded lists — one with roughly 147 domains tied to Chinese corporate networks, cloud regions, and AI labs, and another with keywords like "deepseek," "moonshot," and "minimax"

Both lists were stored in the app as obfuscated text and only decoded while the program was running, using a simple cipher — a technique more commonly seen in malware trying to dodge antivirus scanners than in mainstream developer software.

How the Signal Was Hidden

This is the part that turned a routine telemetry story into a genuine controversy: the results of that check weren't logged or sent as a normal data field. They were folded into the ordinary-looking "Today's date is…" line that Claude Code inserts into every conversation's system prompt.

Two tiny, humanly invisible tweaks carried the signal:

• Date format — a dash (2026-06-30) quietly became a slash (2026/06/30) if the system clock was set to a Chinese timezone.
• Apostrophe style — the apostrophe in "Today's" was swapped between several Unicode characters that look identical on screen but are technically distinct, encoding whether the proxy matched the domain list, the keyword list, both, or neither.

To a human reading the text, nothing looked unusual. To software parsing the raw characters, the punctuation itself carried a hidden three-bit fingerprint about the user's routing setup.

Why Would Anthropic Do This?

The most plausible explanation making the rounds isn't "spying on Chinese citizens" in a broad sense — it's tied to a fight Anthropic has been publicly waging over "distillation," where competitors funnel huge volumes of queries through Claude to train their own rival models on its outputs. Anthropic has previously said it caught Chinese AI labs running millions of exchanges through fraudulent accounts for exactly this purpose, and separately told lawmakers it considered a large-scale campaign tied to Alibaba's Qwen lab a serious problem.

Seen that way, the hidden check looks like an anti-abuse measure aimed at flagging suspicious proxy traffic — not a tool for surveilling ordinary people. But security researchers who examined the code pointed out two problems with it. First, it was trivial to dodge: anyone running an actual large-scale distillation operation could defeat it by changing a hostname or timezone setting in seconds. Second, it wasn't selective — it could just as easily tag a legitimate developer at a company using an internal API gateway or a cost-tracking proxy, with no way for that person to know or opt out.

The Bigger Issue: Trust and Disclosure

What amplified the story wasn't really the anti-abuse motive — plenty of software vendors try to detect misuse. It was the combination of where this code lived and how it was hidden.

Claude Code isn't a simple chat window. It's an agent with permission to read files, run shell commands, and edit code directly on a developer's machine. Tools with that level of access are generally held to a higher bar for transparency, since users are trusting them with far more than a conversation. A GitHub issue filed against Anthropic's own repository put the core complaint bluntly: users had no way to audit, consent to, or disable a mechanism they didn't know existed.

An independent security researcher published a technical writeup verifying the mechanism across several recent versions, and the finding spread quickly across developer forums and social media.

Anthropic's Response

Anthropic acknowledged that the code existed and said it would be removed. A new release, version 2.1.197, went out on July 1, 2026 — though its changelog didn't explicitly spell out that the fingerprinting logic was gone, which left some developers wanting clearer confirmation directly from the company.

What This Means If You Use Claude Code

If you use Claude Code through a custom proxy or corporate API gateway, it's worth updating to the latest version. You can check your version with:

claude --version

If you're curious whether your own setup was ever flagged, you can look back through any saved system-prompt logs from roughly April through June 2026 — a slash instead of a dash in the date line is the tell.

The Takeaway

This wasn't a hoax, and it wasn't quite the cartoonish "spyware targeting Chinese users" framing that went viral either. It was a real, narrowly-scoped, and clumsily-hidden anti-abuse mechanism that ended up raising much bigger questions about transparency in AI coding tools — tools that, by design, already have deep access to the machines they run on. As AI agents take on more permissions inside our codebases and systems, incidents like this are a reminder that the standard for disclosure needs to rise to match the level of access being granted.