Breaking

Hidden Logic in Claude Code Said to Flag Chinese Users

June 30, 2026 at 13:06 EDT

Software Dev & Coding
AI Agents
Security

A user who reverse-engineered Anthropic's coding tool Claude Code claimed on June 30, 2026 that the software contains hidden logic apparently intended to detect usage from China. According to the post, the code has existed since version 2.1.91 (released April 2, 2026) and was confirmed in the latest 2.1.196. It is not mentioned anywhere in the official release notes and was reportedly discovered while analyzing the code in an attempt to restore a disabled remote-control feature.

June 30, 2026 · Claude Code Analysis

Hidden Logic Found Inside Claude Code Quietly Watermarks Suspected Chinese Users

A reverse-engineer reports the coding agent embeds an invisible signal in its system prompt when it detects a proxy and a China-linked timezone or domain — undocumented, obfuscated, and triggering "spyware-like" criticism.

v2.1.91

Version where the hidden routine first appeared (April 2, 2026)

XOR 91

Obfuscation key hiding the check inside the binary

Mentions in any release notes since it shipped

How the covert watermark works

STEP 1 · TRIGGER

Proxy in use

Routine only activates when traffic goes through a proxy.

→

STEP 2 · DETECT

China signals

Timezone Asia/Shanghai or Asia/Urumqi, or proxy URL matching Chinese domains / AI-lab hosts.

→

STEP 3 · EMBED

Invisible marks

Micro-edits to the date string in the system prompt.

SEPARATOR SWAP

2026-06-30

↓

2026/06/30

APOSTROPHE SWAP

Today's date is…

↓

Today’ ʼ ʹ Unicode variants

Changes are nearly imperceptible to users and the model, but the report says the watermark is detectable from the received prompt.

Why it exists

A defensive answer to China-linked abuse: blocked API access via proxies/VPNs, distillation attacks using fake accounts, an AI-led intrusion on ~30 organizations, and a ~510,000-line source leak forked by Chinese developers.

Why it's criticized

Developers call it "spyware-like" and say it "undermines user trust." The objection is the covert, obfuscated method inside a high-privilege tool with full filesystem and shell access — not abuse-prevention itself.

Caveat: The findings come from reverse engineering and public information. No official response has been confirmed, and concrete reports of user-facing malfunctions remain few.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.