If you trust an AI tool with shell access to your machine, you’re also trusting whatever instructions it hides from you. That trust just took a hit. According to Futurism AI, a security researcher last week found spyware-like code buried in Anthropic’s Claude Code, quietly built to profile Chinese users without their knowledge.
The researcher, who goes by the pseudonym “Thereallo,” says the tracking lived inside the AI’s system prompt, the invisible layer of instructions users never see. Futurism AI reports the code watched a user’s system timezone and any proxy server activity, then used those signals to guess whether the person was connected to specific Chinese AI labs. This is significant because the collection was designed to run undetected.
What Anthropic says happened
Anthropic’s response didn’t do much to settle nerves. On X, company engineer Thariq Shihipa wrote that the tracker went in as an “experiment” back in March “to prevent account abuse from unauthorized resellers and protect against distillation,” and was meant to be pulled later. “We’ve actually been meaning to take this down for a while,” he offered.
That explanation points at a real problem. Distillation is when a weaker “student” model gets trained on the outputs of a stronger “teacher” model. It’s common across the industry, but big labs increasingly see it as a shortcut that upstarts abuse to copy their work.
Anthropic has skin in this fight. Earlier this year it accused Chinese firms DeepSeek, Moonshot, and MiniMax of illegally distilling its models. Futurism AI notes the irony, given Anthropic trained its own systems by scanning millions of copyrighted books and much of the open internet without permission. On top of that, The Washington Post recently reported some Chinese resellers hawk Pro Claude subscriptions, which run over $100 a month in the US, for around $12.
Why this matters
The money and copying problems are genuine. The method Anthropic reportedly chose to fight them is the landmine.
Anthropic has built its brand on being the careful, ethical lab. A lot of users left ChatGPT for Claude precisely because the company made noise about refusing to let its tech be used for mass surveillance of US citizens. Hiding classification logic in an invisible prompt cuts against that whole pitch.
What stands out here is the venue. This wasn’t a marketing tool sitting in a browser tab. Coding agents run with real power on your machine.
Coding agents already live on the wrong side of a scary boundary. They can inspect code, summarize secrets by accident, run commands, install packages, edit files, and push commits on your local machine. Hiding signals in the system prompt makes every other privacy claim harder to believe.
The data grabbed this time wasn’t deeply invasive. In principle, though, a line got crossed.
What to do about it
If you run coding agents at work or on personal projects, treat this as a prompt to tighten your own guardrails:
- Assume the system prompt can hide behavior. You don’t see it, so you can’t audit it. Plan for that.
- Sandbox agents with real access. Run them in containers or restricted environments, not straight on machines holding secrets and production credentials.
- Watch outbound traffic. Timezone and proxy checks are network-adjacent signals. Monitoring what your tools phone home about catches surprises early.
- Keep vendor claims and vendor behavior separate. Ethical branding is not a security control. Verify.
Companies can protect their models. But when a tool with filesystem and shell access starts hiding classification bits inside invisible prompt punctuation, the correct reaction is scrutiny.
Expect this to sharpen the fight over how AI labs police distillation, and expect more researchers to start poking at system prompts for hidden logic. The anti-abuse problem isn’t going away. The bigger question now is whether other vendors are running quiet “experiments” of their own, and how you’d even know. You can read the full account at Futurism AI.