Researchers Allege Claude Code Embeds Hidden Prompt Markers to Tag China-Linked Proxy Routes
Security researchers published claims on June 30 alleging that Claude Code contains undisclosed logic that detects when a user has pointed the tool at a non-default server address, checks whether that address matches known China-linked domains, and responds by embedding covert metadata — invisible punctuation characters and specific date formatting — inside the outgoing prompt text.
The allegation is unverified. Anthropic has not confirmed or denied it. No independent source-level code analysis has been published.
What Is Being Claimed
Claude Code allows users to set a custom ANTHROPIC_BASE_URL environment variable that redirects API requests through a proxy or gateway server instead of Anthropic’s default endpoint. Researchers at International Cyber Digest alleged that Claude Code reads this custom hostname, compares it against a list of China-linked operators, and if a match is found, injects routing metadata — including timezone, proxy information, and possible AI lab associations — into the system prompt using characters not visible to the user.
The mechanism described — invisible punctuation and date format variations — is a known class of watermarking technique. If the claim is accurate, the injected markers could allow Anthropic or a downstream logging system to tag requests by inferred geographic operator without the end user’s knowledge or consent.
Anthropic’s stated public reason for restricting access in China-linked contexts is that proxy services are actively used to circumvent Claude’s China access limits and to extract model capabilities at scale. The company named Alibaba by name in a June 10 letter to US senators, alleging 28.8 million Claude exchanges conducted through 25,000 fake accounts to distil Claude’s capabilities into a competing model.
Why the Allegation Carries Weight
Claude Code is not a web chatbot. It operates with shell execution permissions, reads and writes files, and can act on a codebase autonomously. A hidden signal inside that toolchain is categorically different from a tracking pixel in a webpage.
If undisclosed prompt markers were confirmed, they would represent behaviour that users cannot audit, review, or opt out of — in a tool that holds elevated access to their machines and repositories. The CLAUDE.md pattern promoted by Anthropic itself, and popularised by Andrej Karpathy’s 10-rule self-check protocol, assumes the system prompt is inspectable. Hidden zero-width characters would violate that assumption.
The trust implication extends past any single operator. Once agents are capable of embedding covert metadata in their own prompts, every enterprise security review of AI-assisted development would need to include prompt-level forensics as a standard step.
What Is Not Yet Known
No researcher has published a decompiled version of Claude Code showing the hostname-checking code path. No independent security firm has confirmed the claim. The original allegation was accompanied by a screenshot but no reproducible test. Anthropic has not responded to the specific technical claims.
The story sits in the category of credible-but-unconfirmed. Anthropic has clear motive to track China-linked proxy abuse — its Alibaba allegation makes that plain. Whether the mechanism is disclosed prompt injection, undisclosed prompt injection, or something else entirely remains open.