Anthropic Retracts Hidden Tracking System in Claude Code Amid Distillation Fears

Anthropic has dismantled a covert tracking mechanism within its Claude Code assistant following revelations that the software used undisclosed markers to monitor user locations and potential links to Chinese AI laboratories. The system, identified by security researcher “Thereallo,” utilized encoded Unicode markers and domain lists embedded in system prompts to flag users suspected of bypassing regional restrictions or facilitating model distillation.

Thariq Shihipar, an engineer at Anthropic, characterized the feature as a legacy experiment designed to combat account abuse and unauthorized resellers. While the company confirmed the system’s removal in a recent update, the discovery highlights the escalating tension between Western AI firms and foreign entities. The U.S. Department of Commerce has previously scrutinized the export of advanced computing technologies to prevent the unauthorized replication of frontier models.

The tracking effort specifically targeted hostnames associated with Chinese firms like DeepSeek and Zhipu. Anthropic has grown increasingly vocal regarding “distillation attacks,” a process where a competitor’s model is trained using the outputs of a more advanced system. This practice, while common in general research, has become a flashpoint for national security. Earlier this year, Anthropic alleged that operators linked to Alibaba utilized nearly 25,000 fraudulent accounts to generate millions of exchanges for training purposes.

This defensive posture has prompted reciprocal caution from Chinese tech giants. Alibaba recently designated Claude Code as “high-risk” software, prohibiting its use among employees due to security concerns. The incident underscores a deepening divide in the global AI ecosystem, where developer tools are increasingly weaponized as instruments of corporate and geopolitical surveillance.