A Reddit user has alleged that Anthropic embedded undisclosed detection logic inside its Claude Code CLI tool, specifically targeting users in China or those routing traffic through Chinese AI lab proxies. The user, identified as LegitMichel777 on the r/ClaudeAI subreddit, claimed on June 30, 2026, to have reverse-engineered Claude Code version 2.1.196 while attempting to restore a disabled remote control feature. During this analysis, they discovered obfuscated code that had been silently present since version 2.1.91, released on April 2, 2026, with no mention in the release notes.
Detection Method and Steganography
The detection code reportedly performs a multi-factor check whenever a proxy is detected. It reads the system’s timezone to determine if it matches Asia/Shanghai or Asia/Urumqi, and simultaneously inspects the proxy URL against a hardcoded list of Chinese domains and known Chinese AI lab hostnames. The most alarming aspect is the method used to transmit findings: steganography embedded in the system prompt. Based on the detection outcomes, the tool silently alters two elements of the “Today’s date is…” system prompt line. The date format changes from standard ISO format to a Chinese format, and the apostrophe is replaced with one of three visually identical but technically distinct Unicode characters. These alterations are invisible to human users but are easily machine-parseable by Anthropic’s servers.
Community Reaction and Implications
The security community has reacted strongly to the disclosure. Critics argue that, regardless of the intended use case, preventing unauthorized resale of the Claude API or model distillation by Chinese labs that covertly collect system and proxy metadata without user consent constitutes a fundamental breach of trust. Developers who grant Claude Code broad filesystem and shell access are particularly exposed, as this level of access theoretically enables remote code execution. The detection code was reportedly XOR-obfuscated with a specific key, a technique commonly used to prevent plain-text string extraction during binary analysis. Adding to the concern is the effectiveness of such checks. They are trivially bypassable by any moderately skilled adversary, raising the question of whether the privacy cost to legitimate users justifies any actual security benefit. Anthropic has not yet issued a public statement addressing the Reddit disclosure as of the time of publication.
Source: Cyber Security News
