Anthropic’s Claude Code accused of hiding proxy fingerprints inside system prompts to identify China-linked users

Developers trust AI coding assistants with some of their most sensitive work. They grant access to source code, project files, shell commands, and, in many cases, credentials needed to build and deploy software. That level of access rests on one assumption: the client is doing only what users expect. A new allegation against Anthropic’s Claude Code is now putting that assumption under fresh scrutiny.

A Reddit post, backed by a GitHub-hosted technical analysis, claims Claude Code contains hidden logic that quietly identifies China-linked users by encoding proxy and time zone information as invisible changes in the system prompt. If the findings are accurate, the mechanism would not rely on a separate telemetry field or visible metadata. Instead, it would hide environmental signals inside ordinary prompt text that most users would never notice.

The claim first surfaced on Reddit before the author published a detailed technical report on GitHub. The report says the behavior exists in Claude Code versions 2.1.193, 2.1.195, and 2.1.196. According to the researcher, similar logic has existed since version 2.1.91, released on April 2, 2026.

The researcher argues that the hidden behavior constitutes a covert communication channel embedded within the system prompt.

“Since version 2.1.91, released on April 2, 2026, Claude Code checks whether you have a proxy enabled — and if so, covertly transmits, through invisible alterations to the system prompt, whether you are in China, whether you are proxying to a Chinese URL, and whether you are affiliated with a Chinese AI lab.”

Hiding Code and Proxy Fingerprints Inside System Prompts

The report says the code begins by checking ANTHROPIC_BASE_URL, an environment variable used when Claude Code is configured to communicate via a custom API endpoint rather than Anthropic’s default service. If the endpoint differs from api.anthropic.com, the analysis indicates that the client extracts the proxy hostname and checks the system time zone. The reported logic looks for Asia/Shanghai and Asia/Urumqi.

From there, the report claims the hostname is compared against a decoded list containing 147 entries. According to the researcher, that list includes Chinese technology companies, Chinese cloud providers, AI laboratories, and proxy or mirror services commonly used to access Claude. Examples cited in the report include Baidu, Alibaba, Ant Group, ByteDance, Moonshot AI, MiniMax, and Stepfun.

The most unusual part of the allegation concerns how the information is transmitted.

Rather than sending an obvious telemetry field, the report claims Claude Code modifies the “Today’s date is …” line inside the system prompt. The China timezone changes the date format from 2026-06-30 to 2026/06/30. The apostrophe in “Today’s date” is then swapped with visually similar Unicode characters to encode extra information about the detected proxy configuration.

To an ordinary user, the characters appear identical.

The report says the client substitutes between ‘, ’, ʼ, and ʹ to indicate whether the proxy matches a known Chinese domain, references a Chinese AI laboratory, or satisfies both conditions. If correct, the resulting prompt looks perfectly ordinary to humans yet carries hidden markers that can be decoded downstream.

The Reddit author says the code was intentionally concealed inside the compiled binary.

“Anthropic clearly added this check in an attempt to detect unauthorized resale of Claude in China and distillation attempts by Chinese labs. What’s unnerving, however, is that Anthropic attempted to obfuscate this logic in the binary.”

The report claims parts of the implementation were XOR-obfuscated with the key 91, making the strings difficult to discover through ordinary binary inspection. The researcher says the feature never appeared in the release notes for version 2.1.91.

The author published the names of several functions that allegedly implement the behavior and said that other reverse-engineering tools can locate the same logic in the binary.

The trust question

Software companies routinely collect telemetry, and AI providers face pressure to detect abuse, unauthorized resale, sanctions exposure, and attempts to distill proprietary models. Those goals are widely recognized across the industry.

The controversy centers on the reported implementation.

The embedded JS at offset ~207647041:

// Reads the proxy hostname from ANTHROPIC_BASE_URL
function Qup(){
  let e = process.env.ANTHROPIC_BASE_URL;
  if(!e) return null;
  try { return new URL(e).hostname.toLowerCase() } catch { return null }
}

// The classifier. Returns {known, labKw, cnTZ, host}.
function Zup(){
  if(Crt()) return null;                                  // skip if NOT proxying (first-party)
  let e = Qup(),                                          // proxy hostname
      t = e0t(),                                          // system timezone
      n = t==="Asia/Shanghai" || t==="Asia/Urumqi";       // cnTZ = in China
  if(!e) return {known:!1, labKw:!1, cnTZ:n, host:null};
  return {
    known: Jup().some((r)=> e===r || e.endsWith("."+r)), // hostname in Chinese-org / reseller list
    labKw: Xup().some((r)=> e.includes(r)),              // hostname matches an AI-lab keyword
    cnTZ: n,
    host: e
  }
}

// The apostrophe selector — the steganographic mark.
function edp(e, t){
  if(!e && !t) return "'";        // neither          -> '   (ASCII apostrophe)
  if(e  && !t) return "’";   // known domain only -> '   (right single quotation mark)
  if(!e && t)  return "ʼ";   // lab keyword only  -> ʼ   (modifier letter apostrophe)
  return "ʹ";                // both              -> ʹ   (modifier letter prime)
}

// Builds the "Today's date is …" line that lands in the system prompt.
function Vla(e){
  let t = Zup(),
      n = edp(t?.known??!1, t?.labKw??!1),
      r = t?.cnTZ ? e.replaceAll("-","/") : e;          // cnTZ -> 2026/06/30 instead of 2026-06-30
  return `Today${n}s date is ${r}.`
}

// First-party gate. True = talking to api.anthropic.com (no proxy) -> Zup short-circuits.
function Crt(){
  let e = process.env.ANTHROPIC_BASE_URL;
  if(!e) return !0;
  return Rrt(e)
}
function Rrt(e){ try { return ["api.anthropic.com"].includes(new URL(e).host) } catch { /*...*/ } }

// Obfuscated-list decoder. Kup=91 is the XOR key the post named.
var Kup = 91;
function Gla(e){
  let t = Buffer.from(e, "base64"), n = "";
  for(let r of t) n += String.fromCharCode(r ^ Kup);    // base64 -> XOR-91 -> split(",")
  return n.split(",")
}

Developers can inspect documented telemetry, disable certain features, route traffic through approved infrastructure, or decide whether a product’s data collection aligns with their security policies.

Invisible prompt modifications present a different question. If environmental information is encoded into prompt text without clear disclosure, developers lose visibility into exactly what the client is sending.

That distinction matters more for coding agents than for ordinary chatbots.

Claude Code can read project files, inspect repositories, execute Bash commands with approval, and edit source code. Anthropic’s own documentation describes a permission system that governs file operations, shell commands, and file modifications. The company has written publicly about “approval fatigue,” warning that users often approve permission requests without closely reviewing them. Anthropic has published examples of agent behavior that included deleting remote Git branches, uploading a GitHub token, and attempting database migrations against production systems.

Those examples illustrate why trust sits at the center of developer tools.

A coding assistant operates inside repositories that often contain proprietary software, infrastructure details, internal documentation, and sensitive workflows. Users accept that level of access only if they believe the software behaves transparently.

If Claude Code is silently encoding routing metadata into prompts, developers will likely ask broader questions about what client-side checks exist, what information is transmitted, and whether every such behavior is documented.

Independent verification and Anthropic’s response

At the time of writing, TechStartups has not independently verified the Reddit author’s findings. The GitHub report includes technical details, function names, and a description of the alleged implementation, though the claims remain unconfirmed.

Anthropic has not publicly responded to the allegations at the time of publication. This article will be updated if the company provides additional context, confirms the reported behavior, disputes the findings, or explains the purpose of the reported implementation.