// AI

Anthropic Removes Hidden Claude Code Tracker After Researchers Raise Privacy Concerns

By Lysias · July 8, 2026

Key Takeaways

What Anthropic Built, and Why It Drew Scrutiny

According to Decrypt, Anthropic embedded a hidden tracking mechanism inside Claude Code, the company’s AI coding assistant, which used undisclosed markers to identify signals about a user’s location, whether they were routing traffic through a proxy, and whether their setup suggested a connection to Chinese AI labs. The system was reportedly discovered in June by a developer using the handle “Thereallo,” who found that Claude Code’s system prompts contained embedded signals capable of flagging users Anthropic suspected of circumventing usage restrictions or attempting to extract the underlying model’s capabilities.

Decrypt reported that Thereallo explained the likely purpose in technical terms, suggesting Anthropic wanted to detect API resellers, unauthorized Claude Code gateways, and so-called distillation attack pipelines. Thereallo noted that a custom base URL pointing to a known reseller domain, or a hostname referencing labs such as DeepSeek or Zhipu, would function as a useful detection signal for this purpose.

Where the criticism centered, per Decrypt, was not on the underlying goal but on the method. Thereallo pointed out that Claude Code concealed these tracking signals inside system prompts using Unicode markers and encoded lists of domains, rather than disclosing the practice through standard documentation or release notes. Thereallo characterized the feature as not malicious, but described it as an unusual choice for a developer tool that depends on user trust, according to Decrypt’s account.

Anthropic’s Response and the Bigger Distillation Fight

Following public attention to the discovery, Anthropic engineer Thariq Shihipar addressed the matter on X, stating that the feature had been introduced in March as an experiment aimed at curbing account abuse by unauthorized resellers and protecting Claude from distillation attempts, Decrypt reported. Shihipar reportedly said the team had since implemented stronger mitigations and had already been planning to retire the hidden tracker, adding that a pull request had been merged and the rollback would be complete with the next release.

Decrypt situated this incident within a wider pattern of Anthropic escalating warnings about AI model distillation, the practice in which one system’s outputs are used to train a competing model. While the source article notes that distillation is common in AI research generally, it becomes a geopolitical flashpoint when foreign competitors are involved. Decrypt reported that Alibaba banned its employees from using Claude Code earlier this month, labeling it “high-risk” software over security concerns.

The source article also recaps earlier accusations: in February, Anthropic alleged that DeepSeek, Moonshot AI, and MiniMax used fraudulent accounts to harvest millions of Claude responses to train rival models, a claim that Decrypt noted drew pushback from critics questioning how it differed from common industry practice. In April, Elon Musk testified that xAI had partly used OpenAI’s models while training Grok, describing distillation as a broader industry norm, according to Decrypt. Then in June, Anthropic CEO Dario Amodei urged Congress to strengthen protections against foreign AI extraction, alleging that Alibaba-linked operators had generated 28.8 million Claude exchanges through nearly 25,000 fraudulent accounts, Decrypt reported. Anthropic did not immediately respond to Decrypt’s request for comment on the tracker’s removal.

Why This Matters Beyond One Product Feature

For readers tracking the broader AI economy, this episode is a reminder that competitive tension between leading AI labs is increasingly playing out through infrastructure-level enforcement rather than just marketing claims or benchmark comparisons. Anthropic’s willingness to build detection logic aimed at rival labs, and to do so without disclosure, illustrates how seriously frontier AI companies now treat the risk of their models being copied or distilled by competitors, including those based in China. That dynamic feeds directly into the valuations and investment narratives surrounding AI companies, since perceived model uniqueness and defensibility are central to how investors price these businesses.

The crossover into crypto and digital-asset markets is indirect but real. Much of the recent enthusiasm around AI-linked tokens and blockchain infrastructure projects rests on assumptions about proprietary AI capability being durable and monetizable. Episodes like this one, where a major lab is caught quietly monitoring for unauthorized access and reverse-engineering attempts, tend to reinforce a market narrative that AI intellectual property is fragile and constantly under threat, which can add volatility to sentiment-driven AI tokens even when no direct financial figures are involved. Decrypt’s reporting does not link this incident to any specific token or market movement, and no such connection should be assumed.

Hype Check

Claim: Anthropic secretly surveilled Claude Code users to police competitors and protect its technology from foreign extraction. Reality: Decrypt’s reporting confirms Anthropic did embed undisclosed tracking signals in Claude Code, introduced in March and removed only after public discovery in June, with the company framing it as an anti-abuse experiment rather than a covert surveillance program, and no evidence in the source suggests the data was used for purposes beyond detecting resellers, gateways, and distillation activity. Verdict: Mixed. This is not financial advice.

Source

Researched with AI assistance, fact-checked and edited by a human. Not financial advice.

📬 Get Cryptoverse Weekly

The week’s most important crypto & AI stories, straight to your inbox. No spam, unsubscribe anytime.

Double opt-in — we’ll email you a confirmation link.