Claude Code's Hidden Tracker Used Unicode Steganography

In July 2026, an independent developer working under the name Thereallo was reverse engineering the minified JavaScript bundle inside Claude Code, Anthropic's command line coding assistant, when one line stopped looking normal. The system prompt included the phrase "Today's date is 2026-06-30." Under raw Unicode inspection, that ordinary date stamp turned out to carry a hidden signal, one that told Anthropic's backend whether the person running the tool appeared to be connecting from China. The function had been shipping inside Claude Code since April, invisible in release notes, invisible in a normal terminal, and invisible to virtually every developer who ran the tool in the meantime.

Key Takeaways

• Thereallo found the hidden tracker in July 2026 while reverse engineering the minified JavaScript bundle of Claude Code version 2.1.196.
• The code encoded a signal into the system prompt line "Today's date is 2026-06-30" by swapping between four visually identical Unicode apostrophe characters and switching the date separator from a hyphen to a slash.
• The marker only activated when a user's system timezone matched Asia/Shanghai or Asia/Urumqi and the request was routed through a non official API endpoint rather than Anthropic's own.
• Anthropic engineer Thariq Shihipar said on X the code was "an experiment we launched in March" meant to fight account abuse by unauthorized resellers and deter distillation attacks, and the company removed it within days of the disclosure.
• The code had been present since Claude Code version 2.1.91, released April 2, 2026, without ever appearing in a changelog.

What Did the Hidden Tracker Actually Do?

The hidden function rewrote a single, ordinary looking value in Claude Code's system prompt to secretly encode information about the connection making the request. Every time Claude Code assembled context for a coding session, it inserted a line stating the current date. A separate function intercepted that line and altered it based on two checks: whether the request's proxy or API endpoint matched a list of known Chinese domains, and whether it matched a list of AI lab related keywords. The result was folded into the date string itself before it was ever sent to the model, so the marker traveled inside what looked like a completely mundane piece of context.

The mechanism only ran when the ANTHROPIC_BASE_URL environment variable pointed to a non official endpoint. Traffic going directly to Anthropic's own API was left alone, a detail that matters for how the company later explained the code: it was built to watch resold or proxied access, not ordinary customer traffic.

How Did the Unicode Steganography Work?

The tracker hid its signal by swapping which invisible Unicode character stood in for an ordinary apostrophe. In the word "Today's," the apostrophe could be one of four visually identical characters: the standard apostrophe (U+0027) for no match, the right single quotation mark (U+2019) if the endpoint matched a known domain, the modifier letter apostrophe (U+02BC) if it matched an AI lab keyword, and the modifier letter prime (U+02B9) if both conditions were true. A coarser second signal changed the date's separator from a hyphen to a slash, from 2026-06-30 to 2026/06/30, whenever the system's local timezone matched one of two flagged values.

The keyword list behind the check, covering terms like deepseek, moonshot, minimax, zhipu, bigmodel, baichuan, stepfun, 01ai, dashscope, and volces, was stored base64 encoded and further obscured with an XOR cipher using the key 91. The domain list ran to roughly 147 entries, including major Chinese technology companies such as Baidu, Alibaba, and ByteDance, alongside proxy and reseller services like claude-code-hub.app and openclaude.me. None of it was visible to a developer reading Claude Code's output; finding it required diffing the minified bundle or inspecting the literal byte values of characters that render identically on screen.

Why Did It Only Trigger for Certain Timezones?

The marker activated only when the local operating system reported its timezone as Asia/Shanghai or Asia/Urumqi, the two zones covering mainland China. Timezone is a value most software already reads for entirely ordinary reasons, which is part of what made the marker easy to miss during a normal log review. Only pairing that timezone check with the domain and keyword checks, then inspecting the resulting character codes directly, would reveal that the "date" was also a classification result.

Who Discovered It, and How?

Thereallo traced an unusually structured function that manipulated string content with no obvious purpose, then worked backward to identify the Unicode substitution, the obfuscated keyword and domain lists, and the timezone gate before publishing the full technical writeup. Version history showed the function had been present since Claude Code 2.1.91, released April 2, 2026, meaning it operated undetected for roughly three months before anyone outside Anthropic described how it worked.

What Did Anthropic Say?

Anthropic did not dispute the finding. Engineer Thariq Shihipar confirmed on X that the code was "an experiment we launched in March," intended to fight account abuse by unauthorized resellers and to blunt distillation attacks, in which competitors replay or proxy a model's outputs to train rival systems more cheaply, a response Malwarebytes covered in detail. Anthropic has previously documented large scale distillation attempts against Claude, including a campaign involving three Chinese AI labs that we covered in our earlier reporting on the distillation attacks Anthropic said it caught, so the stated motive fits a pattern the company has flagged before.

The timeline adds context without fully explaining the silence. Anthropic says the experiment launched in March 2026. On June 12, the United States government suspended frontier model access for certain foreign nationals citing security concerns, and those export restrictions were lifted on June 30, the same day referenced in the date string Thereallo examined. Public disclosure followed in early July, and Anthropic moved to remove the code within days, a sequence also detailed by Futurism and Slashdot, merging a fix rather than defending the mechanism's continued use.

What Does This Mean for Developers Who Trust AI Coding Tools?

Claude Code is a tool developers run locally, often with access to source code, credentials, and internal systems, which is part of why an undisclosed tracking mechanism inside it drew scrutiny beyond typical telemetry complaints. It is not the first time Claude Code's trust boundary has come under examination; we previously reported on a separate incident where compromised Claude Code usage was linked to repository hijacking and API key theft, a reminder that command line AI tools sit close to sensitive developer infrastructure. Anthropic has also staked out a public position against expansive surveillance elsewhere, including its widely reported refusal of a Pentagon request that the company said would have enabled mass surveillance of Americans. Whatever the intent behind this specific mechanism, the gap between that stated position and a covert, geography targeted tracking function inside a developer tool is the detail drawing the most attention now that the code has been made public.

Looking Ahead

The specific mechanism is gone, removed within days of disclosure, but the episode leaves an open question for anyone running AI coding tools locally: how would a similar marker be found if it did not touch something as ordinary looking as a date string. Minified, obfuscated JavaScript bundles are opaque by default, and most developers have neither the time nor the tooling to diff them line by line looking for invisible characters. Thereallo's reverse engineering work is the reason this one came to light at all, not routine disclosure, and that gap is worth remembering the next time a developer tool ships a routine looking update with no changelog entry to explain what changed underneath.