Secret Claude Tracker Shocks Users After Anthropic's Anti-Surveillance Stance (arstechnica.com)
- Reference: 0184332926
- News link: https://yro.slashdot.org/story/26/07/06/1836230/secret-claude-tracker-shocks-users-after-anthropics-anti-surveillance-stance
- Source link: https://arstechnica.com/tech-policy/2026/07/anthropic-outed-for-claude-tracker-that-secretly-monitored-chinese-users/
> Anthropic quickly removed a tracker [1]secretly monitoring Claude Code users in China after a security researcher [2]exposed the hidden code and condemned the spyware-like tracking as a "serious breach of user trust." Last week, a web developer known as "Thereallo" was researching privacy issues in Claude Code and was [3]shocked to find that the AI firm was using "prompt steganography" to hide code that tracks Chinese users "in plain sight." This code wasn't malicious, but it was sending information to Anthropic that most users wouldn't detect, relying on shorthand markers to quietly flag users' timezone, proxy, and potential connection to Chinese AI labs that Anthropic has [4]accused of distillation attacks .
>
> On X, Anthropic engineer Thariq Shihipar confirmed that the tracker was added to Claude Code as an "experiment" in March. According to Shihipar, the code "was meant to prevent account abuse from unauthorized resellers and protect against distillation." Regarding the former, [5]The Washington Post found unauthorized retailers have sold access to free models for $1 a month, and pro subscriptions that can cost $100 monthly sell for "as little as $12." Supposedly, Anthropic has "actually been meaning to take this down for a while," Shihipar said of the hidden code, because engineers have "landed stronger mitigations since then."
>
> Privacy advocates were not happy with the explanation, though, warning that the code is evidence that Anthropic is willing to cross lines to surveil users. That's perhaps especially surprising, considering that Anthropic riled the Trump administration by refusing to allow the US government to use Claude to surveil US users. The AI firm has since sued the White House over the clash. The Post suggested that the tracker incident is a sign that US firms like Anthropic are taking "increasingly aggressive measures" to block Chinese AI firms from copying their models. A more defensive stance has apparently become critical. In the past year, Chinese firms have "consistently matched" US firms' model capabilities "within months," the Post reported. Most recently, "a new, free AI model from Chinese company Zhipu AI was better at finding computer vulnerabilities than Anthropic's Claude Opus 4.8 model, which was released in May," the Post reported.
[1] https://arstechnica.com/tech-policy/2026/07/anthropic-outed-for-claude-tracker-that-secretly-monitored-chinese-users/
[2] https://slashdot.org/story/26/07/03/1645222/alibaba-to-ban-claude-code-in-workplace-over-alleged-backdoor-risks
[3] https://thereallo.dev/blog/claude-code-prompt-steganography
[4] https://yro.slashdot.org/story/26/06/25/1810226/anthropic-says-alibaba-must-be-punished-for-largest-claude-cloning-attack
[5] https://www.washingtonpost.com/national-security/2026/07/06/why-anthropic-alleges-chinese-firms-are-distilling-knowledge-claude/
Privacy Policy (Score:3)
Woha! a tech firm overstated their position on privacy and spied on users! I guess it is a day ending in 'y'
Place your bets (Score:5, Interesting)
The odds of Anthropic only using this for Chinese users is quite low.
I would be more surprised if the public " AI " systems like Claude aren't tracking everything and everyone.
Regardless of what country they are in.
But, like usual, anytime they get caught, they will simply blame some junior engineer or claim this was developer
code that accidentally made it into production.
LOL so shocking oh my (Score:2)
Yes, this is just so so so so so shocking I can hardly believe it. And from such a reputable company like Anthropic, too!
Every Decennium needs such an episode (Score:2)
It might look like it will not last for long, but then your youth is over and it is still there.
Distillation Attack (Score:2)
Distillation Attack? What? That's some deliberately chosen language. Can the fact that companies like Anthropic and OpenAi scraped up an entire internet's worth of private and copyrighted data to build their own models, be called a "Training Attack"?
Ask the web administrators who have to deal with the constant barrage of AI scraper bots, they would surely agree.
If there's any worthwhile direction in AI, it's creating smaller, more efficient models. Distillation is the only path forward.
What's the problem with resellers? (Score:2)
If a reseller sells a $12 subscription while paying $100 to Anthropic, that should not be Anthropic's problem. There IS a lot of scam (possibly even fraud) with "unlimited Claude" resellers, but they are scamming the users which tricks like selling Sonnet as Opus and falling back to DeepSeek for some users, not Anthropic who gets the price of the subscription the reseller bought.
Gotta hand it to Zhipu (Score:2)
Jacked up context size, loaded a small 1kloc project I had written over the past few days and asked GLM-5.2 to find the bugs. Had only looked it over a few times... compiled yet had never run. Took hours to run the model on my workstation burning so many tokens "thinking" I was getting scared it would reach the context limit and bail. Out of the 40 or so bullet points it had rattled off 4 that were actual bugs. One of them I would have found immediately during testing.. other 3 were more subtle so in the
Legit defence against distillation attack (Score:2)
When you distil someone else's model, don't complain when they add some measures against you.
It's like robbers complaining about someone installing stronger door locks.
Re: (Score:2)
> When you distil someone else's model, don't complain when they add some measures against you.
> It's like robbers complaining about someone installing stronger door locks.
There is no such thing as a distillation "attack". Distillation is not an attack.
Imagine learning (ripping) off everything everyone has done and then getting all hot and bothered when someone else learns from you. There is nothing legitimate about this behavior. Closed model vendors have no such moral or legal right.
lol (Score:3)
No user should be trusting any AI company and, likewise, users of AI (specifically the company's own web based version) should not expect any kind of real privacy.
Users are "shocked" (Score:2)
Who are these "shocked" users, exactly?
Re: (Score:2)
They all worked for the police department in Casablanca, Morocco.... (With apologies to the current Casablanca Police Department...)
Re: (Score:2)
Gambling is against Sharia.
Re: (Score:2)
against Sharia
Yeah. But is the legal system of the Kingdom of Morocco explicitly derived from/dependent on Sharia, and with whose interpretations of same?
My sense from visiting Morocco was that it was not a strict Sharia legal system, but I do not know their legal system.
Re: (Score:2)
Claude Rains played that role to a "T".
Re: Users are "shocked" (Score:2)
No doubt, I would only be shocked if they didn't spy on everything their users do.
Re: (Score:2)
> No user should be trusting any AI company
Or any other tech company. Or any other company with any kind of online presence. Or any other company, period.
Re: (Score:2)
In addition, users should expect all data they put into any prompt to be collected, analyzed, profiled, used for LLM training and sold.
I have trouble imagining there are still people that would be "shocked" by any of that.
Re: (Score:2)
Indeed. Models that are not local should be treated like other cloud services: Other people's computers.