In early July, a developer working under the handle “Thereallo” was reverse-engineering Claude Code’s minified client and found something odd: hidden markers encoded in Unicode inside the tool’s system prompt, invisible in normal logs but readable by Anthropic’s own backend. Decoded, the markers captured a user’s time zone and whether they were routing traffic through a proxy — data used, Anthropic later confirmed, to flag possible links to Chinese AI labs such as DeepSeek, Moonshot AI, and Zhipu.
Anthropic didn’t deny it. An engineer confirmed the code had been live since March 2026, describing it internally as an “experiment” aimed at stopping reseller abuse and model distillation — rival labs using Claude Code output to train their own models on the cheap. Once the discovery spread, Anthropic pulled the code quickly. What it didn’t do, and what drew the sharpest criticism, is disclose the mechanism anywhere a user would have seen it: no changelog entry, no documentation note, nothing beyond a steganographic marker a security researcher had to go looking for.
Why this matters more than a typical bug-bounty story
Anthropic has built a chunk of its brand on being the safety-conscious, transparency-first AI lab — the company that publishes model cards, that talks about interpretability, that positions itself against “move fast, disclose later.” A hidden tracker that sat undetected in a widely-used coding tool for three months cuts directly against that positioning, and it’s landed in the same few months as Claude Code’s permission-bypass hardening sprint, the Claude for Chrome extension flaw, and a wave of sandbox-escape research across the whole AI-IDE category. None of these are reasons to avoid AI coding tools — they’re evidence the category is still young enough that vendor trust has to be actively checked, not assumed from a brand.
So what
If your team is standardising on an AI coding vendor — or your engineering leadership is being asked “can we trust what this tool is doing with our code and our infrastructure access” — this is exactly the kind of story that belongs in that evaluation, alongside benchmark scores and pricing. The practical takeaway isn’t “switch tools,” it’s “build the habit of checking”: what telemetry does the tool actually send, is it documented, and does the vendor’s disclosure practice match its marketing. That’s precisely the governance work we help clients think through in AI-assisted development engagements — get in touch if you want a second opinion before your team locks in a vendor.