Claude Code Accused of Secretly Tagging Chinese Users to Fight Unauthorized AI Use

A bombshell revelation on Reddit has shed light on a hidden practice within Anthropic’s Claude Code: the AI model is reportedly embedding stealth tags in prompts from specific Chinese users, sparking accusations of spyware-like behavior and privacy violations.

Trigger Conditions for Stealth Tagging

The covert tagging system activates only under specific circumstances, according to the user’s findings:

1. Running Claude Code version 2.1.91 or later
2. Using a proxy server to access the model
3. Operating in a Chinese time zone, such as Asia/Shanghai or Asia/Urumqi
4. The proxy domain points to a Chinese website or matches a predefined list of Chinese AI laboratories

How the Stealth Tags Are Implemented

The tags are embedded through subtle, almost undetectable modifications to the system prompt:

1. Date format alteration: Normally formatted as "YYYY-MM-DD", the date switches to "YYYY/MM/DD" when tagging is triggered
2. Quote replacement: The single quote in the phrase "Today's date is" is replaced with different characters based on the user’s context:
3. A right single quote for users with proxy domains pointing to regular Chinese websites
4. A modifier apostrophe for users linked to Chinese AI laboratories
5. A modifier angle quote if both conditions are met

These changes are invisible to end-users and even the AI model itself, but Anthropic’s backend can easily identify them as markers.

Purpose Behind the Stealth Tagging

Anthropic’s alleged motive for the hidden tagging is twofold:

1. Combat unauthorized reselling: To crack down on individuals and groups using private proxies to resell access to Claude Code for profit within China
2. Block model distillation: To identify and ban interfaces belonging to Chinese AI laboratories that are feeding large volumes of prompts to Claude Code to train their own domestic large language models

Backlash Over Privacy and Security Risks

Reddit users have been vocal in their criticism, comparing the practice to spyware. Key concerns include:

1. Privacy invasion: The system collects detailed system and network configuration data without user consent
2. Steganographic data transmission: The tags use steganography to send information back to Anthropic’s servers, hiding the data within normal prompt text
3. Security vulnerabilities: Users fear the hidden modifications could open the door to remote code execution or other unforeseen security risks

The revelation has sparked a debate about the balance between anti-abuse measures and user privacy in the AI industry. While companies like Anthropic have a right to protect their intellectual property, critics argue that covert data collection crosses ethical lines and undermines user trust.