The discovery began, as these things often do, with a curious developer taking a tool apart. A user who reverse-engineered Claude Code, Anthropic’s programming assistant, found that since April the software had included detection mechanisms aimed at users in China’s time zone and at 147 specific domains, with the results of those checks encoded discreetly into requests sent to Anthropic’s servers. The finding spread quickly through developer communities, and within days Anthropic confirmed the checks existed — describing them as experimental measures against account resale and model distillation — and said it planned to remove them in a future update.
The episode is small in technical terms and large in its implications. Claude Code is one of the most popular AI coding tools in the industry, used by developers who pay Anthropic for the ability to have an AI write, review, and debug their code. The hidden checks were invisible to users: the software silently assessed whether a request appeared to come from China, and passed that information along with the request. The developer community’s reaction was immediate and unambiguous — a tool that evaluates its users without telling them is a trust problem, whatever the stated purpose.
Anthropic’s explanation frames the checks as defensive. Account resale — buying accounts in one market and reselling them in another at a premium — is a persistent problem for AI companies that price their services differently by region. Model distillation, the practice of using one AI model to train a cheaper imitation, is an even bigger concern: it lets competitors copy a model’s behavior without paying for the access. Anthropic said the detection mechanisms were designed to identify both patterns, and that encoding the results into requests allowed the company to study them without exposing the screening to whoever might inspect the traffic.
The technical details, as reconstructed by the developers who found them, are precise. The checks reportedly included a list of 147 domains associated with the patterns Anthropic wanted to detect, combined with time-zone-based heuristics that flagged requests appearing to originate from China. The results were encoded into the requests Anthropic’s software sends to its servers, in a format that a careful observer could decode but that was not documented anywhere. The opacity of the design — rather than the checks themselves — is what drew the strongest criticism.
The episode lands at an awkward moment for Anthropic. The company has positioned itself as the safety-conscious alternative in the AI industry, and it is preparing for an initial public offering that will put its practices under investor scrutiny. A story about hidden checks in a widely used product is not the narrative the company wants in the weeks before it speaks to the public markets, and the speed of its response — confirmation followed quickly by a commitment to remove the mechanisms — suggests the company understood the risk.
The regulatory context complicates the picture. The U.S. government has been weighing export controls on advanced AI models, and companies in the industry are under pressure to prevent their most capable systems from being used by adversaries. A detection mechanism that identifies traffic from China could, in principle, serve that goal. But the checks were designed and deployed unilaterally, without disclosure, and the distinction between security and surveillance is exactly the kind of question regulators and users will want answered.
The developer reaction is the market’s verdict in miniature. Coding tools live or die by trust — developers run them with access to their source code, their credentials, and their private projects — and a tool that behaves opaquely will be abandoned no matter how capable it is. The episode has already produced alternatives: developers have pointed to open-source coding assistants that make their behavior auditable, and some Claude Code users have said they will review updates more carefully going forward.
For the industry, the episode is a case study in the risks of hidden features. AI companies are increasingly adding safeguards, filters, and monitoring to their products, and most of these systems are invisible to users by design. The Claude Code checks were an unusually concrete example of the pattern, and the backlash suggests a limit to how much invisible behavior the market will accept. The companies that will thrive, the episode suggests, are those that disclose what their software does — and let users decide whether they are comfortable with it.
Anthropic’s commitment to remove the checks does not end the story. The company has said the mechanisms were experimental, and it has not said what will replace them, or how it will address the account-resale and distillation problems the checks were meant to solve. The next version of Claude Code will show whether Anthropic has learned the lesson of the episode: that the users who trust a tool with their work deserve to know what the tool is doing with their requests.
