On June 30, 2026, a developer inspecting Anthropic's Claude Code tool found something unusual: hidden logic that quietly classifies users and embeds the result inside ordinary prompt text — using invisible character changes in a line as mundane as "Today's date is 2026-06-30."
The story hit the top of Hacker News within hours. Independent analysts verified the core claims. Anthropic had not publicly responded at the time of writing.
For business leaders, this is worth attention even if your firm does not use Claude Code. It is a clear example of what can happen when powerful AI software runs on employee machines — with broad access to files and systems — while containing behavior that was never disclosed.
What happened
Thereallo, a developer reviewing Claude Code for privacy reasons, reverse-engineered the software and found classification logic baked into the client.
When Claude Code is pointed at a custom API endpoint — rather than Anthropic's default — it checks the proxy hostname against a hidden list of 147 domains (Chinese tech firms, AI labs, and unofficial Claude resellers) and inspects the computer's timezone. It then encodes what it finds into the system prompt by subtly changing punctuation and date formatting. The sentence still looks normal to a human reader. To Anthropic's servers, it is a readable signal.
The lists were deliberately obscured in the software. Multiple researchers confirmed the behavior in recent Claude Code versions, with similar logic present since April 2026.
This is not blanket surveillance of every user. Teams using Anthropic's standard API — the default setup — do not trigger this path, even behind a VPN.
It does affect anyone routing Claude Code through a custom gateway. That includes firms using internal API proxies for logging, cost control, or security — a common and reasonable practice.
Why Anthropic likely built it
Anthropic has not confirmed the purpose. The context, though, is public.
In February 2026, the company reported industrial-scale "distillation" campaigns — foreign AI labs allegedly using tens of thousands of fraudulent accounts to extract Claude's capabilities and train competing models. In September 2025, it tightened restrictions on Chinese-controlled companies worldwide.
The hidden markers appear aimed at identifying traffic through known resellers and proxy networks — the same channels Anthropic says it is trying to block.
Defenders argue this is a hard problem and hidden signals are harder for bad actors to strip out. Critics argue the obfuscation and lack of disclosure undermine trust — especially in a tool that asks for shell and filesystem access on your machines.
Why it matters beyond the tech community
Three points stand out for business owners.
You inherit behavior you cannot see. When staff use cloud AI tools — coding agents, copilots, desktop assistants — they run software whose full behavior is not visible to your IT team. Contracts typically cover data handling. They rarely cover hidden client-side classification.
"Enterprise" does not mean transparent. Commercial agreements may protect your data from model training. They do not guarantee the client software on employee laptops behaves only as documented.
Trust in AI adoption is already fragile. Most firms already have informal AI use — personal accounts, browser tabs, unsanctioned tools. If the approved tool contains undisclosed behavior, governance gets harder, not easier.
We still do not know what Anthropic does with marked requests — whether they are flagged, rate-limited, or routed differently. We also do not know what else may be in the client that has not been found yet.
A practical question for your firm
This event adds a layer to a conversation many leaders are already having: not just where does our data go, but what is the software doing that we cannot see?
Cloud AI is often the right choice for low-risk work — drafting marketing copy, generic research, tasks with no sensitive data. For work involving client files, financials, HR records, or proprietary strategy, the bar is higher. You need to know what happens to the information — and to trust the tools your team depends on.
That is the case we made in Why Businesses Should Choose Private AI Over Cloud API Services. Private deployment does not mean building your own model. It means running capable AI on infrastructure you control — where prompts, documents, and inference stay inside your environment, and the software behavior is something you can actually govern.
For some firms, that looks like a controlled workspace such as Wave2 Vault. For others, it starts with one sensitive workflow and expands from there. The point is not to reject cloud AI everywhere. It is to stop treating "send it to a vendor" as the automatic answer for work that was never meant to leave your control.
Four questions to ask this week
- Which AI tools on our machines have broad system access? Coding agents and desktop assistants deserve more scrutiny than a chatbot in a browser.
- Do we route AI traffic through internal gateways? Understand what signals those setups may send upstream.
- Does our AI policy cover software behavior — not just data? Most policies say what staff can paste in. Few address what the tool itself may do silently.
- For sensitive work, do we have an alternative we can inspect and govern?
The firms that benefit from AI long term will not react to every headline. They will use moments like this to ask sharper questions — and build systems where the answers sit under their own control.
If your business is weighing cloud convenience against transparency and data governance, start a conversation with us.