Anthropic confirms hidden tracking mechanism in Claude Code after China's national vulnerability database issues formal security advisory
Claude Code versions 2.1.91–2.1.196 contained an undisclosed monitoring mechanism. Here's what it did, who's affected, and what to do now.
On July 8, China’s National Vulnerability Database (NVDB), operated by the Ministry of Industry and Information Technology, published a formal security advisory alleging that Anthropic’s Claude Code contained a hidden monitoring mechanism capable of transmitting users’ geographic location and identity-related identifiers to remote servers without their knowledge or consent.
Anthropic confirmed the mechanism was real. The company described it as an experimental anti-distillation and anti-abuse control, and said it was removed in version 2.1.198, released on July 1, several days before the advisory went public.
This is not a theoretical vulnerability. A real mechanism was present, it operated without disclosure, and it ran inside a tool that sits deep in developer environments. Here is what you need to know.
Which versions are affected
The affected range is Claude Code versions 2.1.91 through 2.1.196, covering releases from approximately April 2 to June 29, 2026. If your team is running anything in that range, you are on an affected version. The current release as of the advisory date is 2.1.204, which does not contain the mechanism.
Check your installed version with claude --version and update via your package manager if you are behind 2.1.198.
What the mechanism actually did
The discovery came from developers, not from Anthropic’s documentation. A user on Reddit, identified as LegitMichel777, decompiled Claude Code and found obfuscated scripts. A second developer, Thereallo, independently corroborated the findings and provided a detailed technical breakdown.
The mechanism only activated when a user pointed Claude Code at a custom server rather than Anthropic’s own endpoint. Once triggered, it performed two checks. First, it read the device’s system time zone. Second, it compared outbound connections against an encrypted domain blacklist that, once decrypted, contained hundreds of Chinese AI companies and intermediary domains including Baidu, ByteDance, and MiniMax.
The clever part, and the part that drew the most criticism, was how it signalled findings back to Anthropic. Rather than sending a separate data packet, the tool used prompt steganography. It quietly altered the date format written into the system prompt. Users connecting from a Chinese time zone would have their date formatted as 2026/06/30 instead of 2026-06-30. The apostrophe in “Today’s date is…” was swapped for one of three lookalike Unicode characters, each encoding a different signal. Nothing was visible to the user. Anthropic’s servers could read the difference instantly.
Anthropic’s own explanation, offered after the NVDB advisory and the developer disclosures, was that the code was designed to detect unauthorized resellers and attempts by other organizations to distill Claude’s capabilities into competing models. The company has been vocal about distillation as a national security concern: in June, CEO Dario Amodei told Congress that Alibaba-linked operators had generated 28.8 million Claude exchanges through nearly 25,000 fraudulent accounts.
That context matters, but it does not change the core fact: the mechanism was not disclosed in documentation, release notes, or terms of service. When The Register asked Anthropic directly whether the system was covered in its terms, the company declined to answer and pointed to an engineer’s public statement, which also did not address the question.
The enterprise security problem here
Developer tools occupy a privileged position in most organizations. Claude Code runs on developer machines that typically have access to source repositories, internal APIs, staging environments, and in some cases production credentials. Any telemetry or monitoring mechanism operating inside that context, disclosed or not, is a supply-chain concern.
The NVDB advisory recommended that organizations immediately review installed versions, upgrade or uninstall affected releases, tighten external network access controls for developer tools, and strengthen traffic monitoring on core business networks. That advice is sound regardless of where it comes from.
Alibaba moved quickly: the company ordered employees to stop using Anthropic tools entirely from July 10, directing them toward its own Qoder assistant instead. Alibaba’s scale, tens of thousands of developers and one of the world’s largest cloud platforms, means that decision will get attention from enterprise security teams globally. When a company of that size classifies a tool as high-risk, other security leads take notice, even if the political context is different.
There is also a geopolitical dimension worth naming plainly. The NVDB advisory sits inside a broader pattern of US-China friction over AI tools and model access. Anthropic explicitly prohibits usage by entities majority-owned by China-headquartered organizations, and in June the US Commerce Department imposed restrictions on Anthropic’s Mythos and Fable models citing national security concerns. The advisory and the political environment are not cleanly separable. That does not make the technical findings wrong, but it is relevant context for how organizations interpret guidance from either side.
What your team should do
A few concrete steps, in order of priority.
Check your version. Run claude --version. If you are anywhere between 2.1.91 and 2.1.196, you are on an affected release.
Update now. Version 2.1.198 removed the mechanism. Version 2.1.204 is the current stable release. Update via npm or whichever package manager your team uses.
Review your egress controls. If your developer machines are not already subject to outbound traffic monitoring, this is a reasonable prompt to implement it. AI coding tools should not be exempt from the same supply-chain scrutiny applied to other third-party dependencies.
Pin versions going forward. If your team is not already pinning AI tool versions in your development environment configuration, start. Unpinned tools can update silently, and silent updates carrying undocumented behaviour are precisely the scenario this incident illustrates.
Document your vendor review process. The broader lesson here is that AI coding assistants should be evaluated and monitored like any other third-party software component. That means reading changelogs, monitoring for security advisories, and requiring vendor explanations when behaviour changes unexpectedly.
Anthropic says the mechanism is gone. The updated versions appear clean based on community review. But the more durable takeaway is about process: undisclosed telemetry in a developer tool was discovered by users decompiling the binary, not by the vendor’s own disclosure. For enterprise teams, that gap is the thing worth fixing.