Thought Leadership
A security researcher discovered code inside Anthropic’s AI coding assistant Claude Code that secretly collected information about users’ time zones and proxy usage.
Security researcher using the pseudonym Thereallo documented a hidden tracking mechanism in Anthropic’s programming assistant Claude Code. The related code was embedded in the AI system prompt and collected users’ system time zones as well as information about whether proxy servers were being used.
The purpose of the query was to determine whether users were connecting to specific AI laboratories in China. IT publication Ars Technica was the first to report on the discovery.
Intended to Prevent Abuse and AI Model Distillation
Anthropic developer Thariq Shihipa confirmed the discovery on the platform X and described the functionality as an experiment conducted in March 2026. According to Shihipa, the data collection was designed to prevent account abuse by unauthorized resellers and protect intellectual property against so-called model distillation.
In model distillation, smaller AI models are trained using outputs generated by larger models. Anthropic had previously accused Chinese companies DeepSeek, Moonshot, and MiniMax of using this method to train their own models.
Reports from The Washington Post also revealed that Chinese intermediaries were allegedly reselling Claude Pro subscriptions, which officially cost $100 in the United States, for around $12 in China. According to Shihipa, the code had already been scheduled for removal.
Hidden Data Collection Raises Transparency Concerns
The undisclosed data collection mechanism triggered discussions across the security community, particularly because Anthropic publicly positions itself as a transparent and ethics-focused AI company.
The researcher who discovered the code highlighted that AI coding assistants often receive extensive access rights on local systems. These tools can access source code, execute commands, install software packages, and make changes to local machines.
The researcher criticized the way the monitoring mechanism was hidden within the system. According to Thereallo:
“Whenever a tool with filesystem and shell access starts hiding classification bits inside invisible prompt punctuation, the appropriate response is careful scrutiny.”
Thereallo
The incident has renewed broader discussions about transparency, security controls, and user trust in AI-powered developer tools.
(ll)
