Anthropic Removes Hidden Claude Code Request Markers After Privacy Concerns

Thereallo.dev published a reverse-engineering report alleging that Anthropic’s Claude Code command-line tool covertly marked some requests through small changes in the system prompt.

What researchers found

The Thereallo.dev writeup says Claude Code 2.1.196 modified the system-prompt date line depending on factors such as ANTHROPIC_BASE_URL and the user’s timezone. According to the report, those changes could encode whether a request appeared to involve a proxy and whether it matched China-related classifications, using subtle Unicode and date-format variations rather than an explicit metadata field.

A separate verification report published on GitHub Gist by AdnaneKhan said the behavior was reproduced in Claude Code 2.1.193, 2.1.195, and 2.1.196. That report described checks tied to proxy hostnames, China timezones, and an obfuscated domain list. The same report characterized the behavior as a covert channel because the classification was embedded in content sent to the model rather than presented as a transparent setting or header.

The researchers’ core concern was not simply that Claude Code evaluated request context. Their concern was that the apparent classification was hidden inside the prompt text, making it difficult for users or administrators to notice, audit, or disable.

Anthropic’s response

Malwarebytes reported that Anthropic characterized the hidden marker as a March anti-abuse and anti-distillation experiment. In that account, the mechanism was intended to help identify misuse rather than to collect broad user data. Malwarebytes also reported that Anthropic moved to remove the behavior after it was identified publicly.

Tech Times similarly reported that Anthropic acknowledged the code and that Claude Code 2.1.197 was released to remove the steganographic proxy and timezone fingerprinting mechanism. Tech Times noted that the changelog did not explicitly call out the removal.

Taken together, the reports indicate that Anthropic treated the mechanism as experimental abuse prevention, while outside researchers viewed it as a privacy and transparency problem because it altered prompts in a way users would not normally see.

Why it matters

Developer tools that route code, prompts, and project context to AI models are increasingly part of day-to-day engineering work. When those tools add hidden markers to requests, even for anti-abuse purposes, they raise practical questions about disclosure, consent, enterprise auditing, and reproducibility.

The Claude Code case also shows the tension between abuse prevention and transparency. Providers have legitimate reasons to detect proxying, automated misuse, or model-distillation attempts. But the Thereallo.dev and AdnaneKhan reports argue that embedding those judgments inside prompt text is harder to inspect than documenting explicit telemetry, request headers, or policy checks.

For users, the immediate action is straightforward: update Claude Code to a version after the reported removal if they are concerned about the behavior. For vendors, the broader lesson is that hidden request modification can quickly become a trust issue, even when described as an internal anti-abuse measure.