Claude Code now a Spyware?

Anthropic has spent years selling itself as the responsible AI company. It is the lab that talks about safety, controlled access, careful deployment, frontier risk, and why powerful AI should not simply be released into the wild.

That brand only works if people believe Anthropic is more trustworthy than the alternatives.

A new Claude Code controversy makes that much harder.

According to public posts from International Cyber Digest, Corey Quinn, and a conformation reply from Thariq at Anthropic, Claude Code contained hidden steganographic-style behavior that could mark or classify certain users through signals inserted into prompts. The explanation given was that this was an experiment launched in March to prevent account abuse from unauthorized resellers and protect against model distillation. Anthropic says stronger mitigations have since been built and the old mechanism is being rolled back.

That explanation may be technically true. It still does not solve the trust problem.

Claude Code is not a toy. It is a developer tool that reads codebases, edits files, runs commands, and sits close to the software development workflow. Developers use it inside projects, terminals, repos, and sometimes company environments. If a tool like that contains hidden classification or fingerprinting behavior, the standard cannot be “we meant well.”

The standard has to be: why was this hidden in the first place?

If Anthropic wanted to fight unauthorized resale or distillation, it had many normal paths available. It could have used server-side enforcement. It could have disclosed abnormal account-protection signals. It could have made the client behavior transparent. It could have told developers that certain metadata or prompt markers might be inserted for abuse prevention.

Instead, the public only learned about it after people started digging.

That is the issue.

A hidden mechanism inside a coding agent is not just an anti-abuse feature. It is a violation of expectation. When developers use a tool that touches their codebase and sends prompts to a model, they need to know what is being added, changed, classified, or marked. The moment a company starts embedding quiet signals into the user’s interaction, the user is no longer fully in control of the context being sent.

Maybe Anthropic would argue this was not spyware. Maybe the company would say it was a narrow anti-abuse system, not surveillance. Fine. But “not literally spyware” is a very low bar for a company that markets itself on trust.

The better question is whether developers had informed consent.

From what is publicly visible, the answer appears to be no.

This also matters because the behavior reportedly started in March. That timeline weakens the convenient explanation that this was somehow forced by the recent U.S. government drama around Fable or Mythos. If this experiment was already running months earlier, then it was not simply a last-minute response to unlock a new model or satisfy a sudden government demand. It was an Anthropic product decision.

That makes the contradiction more serious.

Anthropic wants the public to accept that closed frontier labs are safer because they can monitor abuse, revoke access, and control dangerous capabilities. Dario Amodei has repeatedly argued that open models create risks because, once released, they cannot be pulled back or patched in the same way a closed service can.

There is a legitimate debate there. Powerful open-weight models can be misused. The AI industry should not pretend otherwise.

But closed control has its own failure mode: users cannot see what the provider is doing.

Open models may create misuse risk because they are hard to control after release. Closed models create trust risk because the provider controls the system invisibly. Anthropic wants everyone to focus on the first risk while treating the second risk as if it does not matter.

Claude Code shows why it does matter.

When a closed AI company ships hidden behavior into a developer tool, the user has fewer ways to inspect it, challenge it, or even know it exists. A closed lab can say “trust us, this is for safety.” It can say “trust us, this is anti-abuse.” It can say “trust us, this protects against distillation.” But trust is not a substitute for transparency.

This is especially ironic because many of the models being attacked as “open source” are not even truly open source. A lot of them are open-weight or partially open. They may release weights, but not full training data, training code, evaluation pipelines, or the complete process needed to reproduce the system. Calling all of that “open source” is sloppy.

Still, even imperfect openness gives the ecosystem something closed labs often resist: inspection.

Developers can run models locally. Researchers can test behavior. Communities can compare outputs, fine-tune, audit, and identify strange patterns. Open systems are not automatically safer, but they are harder to turn into a black box controlled entirely by one company’s incentives.

That is why Anthropic’s anti-open-source posture feels increasingly self-serving.

The company warns that open AI is dangerous because it cannot be centrally controlled. Then its own centrally controlled tool is found with hidden prompt-level behavior that users did not clearly understand. The lesson Anthropic wants us to learn is that openness is risky. The lesson many developers will actually learn is that closed systems also hide things.

This is not just about China, resellers, or distillation.

Those may be the immediate reasons. The bigger issue is precedent. If a frontier lab can quietly mark users for anti-abuse today, what else can it quietly add tomorrow? If the justification is “safety,” how much invisible intervention becomes acceptable? If the product is closed and the user only sees polished responses, where does accountability come from?

Anthropic’s defenders will say the company responded, explained itself, and rolled the mechanism back. That is better than ignoring the backlash. But rollback after exposure is not the same as transparency before deployment.

The timing also looks bad because Anthropic is simultaneously trying to position itself as the adult in the AI race. It wants regulators, enterprises, and the public markets to believe that it can be trusted with controlled access to extremely powerful systems. It wants to argue that Mythos can remain private because Anthropic knows how to manage risk. It wants to argue that open models are dangerous because independent developers cannot be trusted with capability.

But trust is not something a company gets because it has a safety page.

Trust is earned through behavior.

A responsible AI company does not quietly add hidden markers to a developer workflow and wait for the internet to find them. A responsible AI company does not use “anti-abuse” as a blanket explanation after the fact. A responsible AI company does not lecture the open ecosystem about danger while asking users to accept opaque controls inside its own products.

The problem with Anthropic is not that it fights abuse. It should fight abuse. Unauthorized resale, account farming, and distillation are real concerns. The problem is that Anthropic seems too comfortable turning user environments into enforcement surfaces without giving users the clarity they deserve.

That is not safety.

That is control.

And control is not automatically wrong, but it becomes dangerous when it is hidden behind moral language. The AI industry already has enough companies asking the world to trust them because they claim to be acting responsibly. The standard has to be higher than that, especially for tools that touch code, infrastructure, and business workflows.

Open models need scrutiny. Closed models need scrutiny too.

In fact, closed systems may need more scrutiny because users cannot inspect the full stack themselves. When Anthropic says open AI is unsafe, the fair response is not to pretend all open releases are harmless. The fair response is to ask why a closed company with hidden client behavior should be considered safer by default.

Claude Code’s rollback may end this specific mechanism.

It should not end the conversation.

The real issue is whether Anthropic understands that trust is not created by restricting everyone else. It is created by being transparent about your own systems, especially when those systems sit inside developer workflows.

Anthropic wants to be seen as the careful lab.

After this, it looks more like another powerful company asking for the benefit of the doubt while quietly making decisions users only discover later.

That is not the moral high ground.

That is the closed-lab trust problem in plain sight.