The most technically striking part of the Claude Code tracker is how invisible it was. Human eyes cannot distinguish U+2019 (the standard right single quotation mark) from U+02BC (modifier letter apostrophe) or U+02B9 (modifier letter prime) in any typical monospaced developer font. All three characters render identically. All three would pass any reasonable visual inspection of a log file. But at the byte level, each is a completely different code point, which is what made them useful as a covert signal.

The tracker used all three, mapped to different classification states. If the user was on a Chinese proxy but not an AI-lab-linked domain, the code substituted one variant. If the timezone matched Asia/Shanghai without the base URL trigger, another. If both conditions hit at once, a third. The dash-to-slash swap in the date string added additional bits. The result was a small classifier that fit inside a sentence a developer sees at the start of every Claude Code session, invisible to the user, but trivially machine-readable at Anthropic’s backend.

The hardcoded list of Chinese domains and keywords was not stored as plain text. Thereallo’s analysis showed the list was base64-encoded and then XOR-obfuscated with the key 91. At runtime, the code decoded the string in memory and used it to match against the user’s environment variables. On disk, the list was invisible to anyone running strings against the binary or grepping for suspicious hostnames.

When decoded, the list contained the names most people would expect: deepseek, moonshot, zhipu, baichuan, plus the domains of Baidu, Alibaba, ByteDance, and JD.com, along with a set of known Claude Pro resellers and proxy gateways. None of the domains were obscure. All of them were plainly identifiable Chinese AI or e-commerce infrastructure. The obfuscation was not about hiding the intent from a determined adversary. It was about making the discovery cost high enough that casual audits would miss it — which held for exactly three months.

The Claude Code tracker would probably still be running if Anthropic had not made a separate mistake first. On March 31, 2026, an npm package update to Claude Code included a debug source map file that inadvertently exposed approximately 512,000 lines of TypeScript source code across 1,900 files. The full internal build was available for anyone who pulled the update in the roughly 24-hour window before it was patched.

That leak turned reverse engineering the tracker from a hard problem into a moderate one. Function names like Crt, Rrt, and Qup — the specific routines that check ANTHROPIC_BASE_URL and match against the domain list — became greppable text with intent behind them. Without the source map leak, Thereallo would have been working from a minified bundle where every identifier was a single letter and every control flow was obscured. The scandal is downstream of a separate operational failure that gave the community the tools it needed to find this.

The sharpest technical criticism in Thereallo’s write-up was not that the tracker existed. It was that the tracker was structurally useless against the actual adversaries it was designed to catch. Anyone running a serious distillation pipeline or a large-scale reseller operation can patch the Claude Code binary, change their system timezone, wrap the process, or route around the check in under five minutes. The obfuscation stops none of that.

What the tracker does catch, reliably, is normal developers doing legitimate but unusual things. Corporate teams routing Claude Code through a LiteLLM gateway or an internal proxy for compliance reasons. Consultants working from Shanghai for a Western client. Researchers evaluating Claude Code against other models in a controlled environment. Every one of those users lit up the classifier without knowing it existed. The people the tracker was actually designed to catch could disable it in the time it takes to read the code. This is what Thereallo meant by describing the feature as “the worst category of security control”: one that operates entirely on the people it should not be operating on.

Roughly ten days after the exposure, Alibaba issued an internal memo labeling Claude Code high-risk software with security vulnerabilities and prohibiting its use across the company, according to reporting by The Next Web. Alibaba is not a neutral bystander here — the Qwen model developed by Alibaba’s DAMO Academy is one of the systems Anthropic has publicly implicated in distillation. The ban has an obvious defensive component alongside the technical justification.

What matters strategically is the framing. Alibaba did not describe Claude Code as compromised or malicious. It described the tool as carrying back-door risks — language usually reserved for state-sponsored implants or supply chain attacks. When a $200 billion company adopts that framing about a developer tool from a leading Western AI lab, the reputational cost is not confined to the Chinese market. Enterprise procurement teams anywhere in the world reviewing AI coding tools now have a documented reference point for calling this class of behavior high-risk. That is the cost Anthropic will still be paying long after the tracker itself is gone.

Thariq Shihipar, an engineer on the Claude Code team, confirmed the tracker on X within a day of the exposure. His statement described the code as an experiment launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation. He also said stronger mitigations had already shipped since the experiment started, that the team had been meaning to remove the tracker for a while, and that the removal was already scheduled for the next release.

The framing is internally consistent. Anthropic has publicly described distillation attacks as posing what a company spokesperson called a serious threat to national security, per reporting in The Information. The company already restricts Claude access in China on similar grounds. From inside the company’s posture, running a technical experiment to identify traffic patterns associated with the specific set of behaviors it is trying to stop is defensible in principle. What the response did not address was the choice to use undisclosed steganography rather than a documented telemetry field with a changelog entry, which is what most of the community discussion actually focused on.

The abuse pattern Anthropic pointed at is genuine and quantifiable. Chinese resellers reportedly offer Claude Pro subscriptions — normally over $100 per month in the United States — for roughly $12 per month. That kind of price gap only works if the reseller is amortizing a single legitimate account across many downstream users, or if API access is being obtained fraudulently and redistributed. Either way, the traffic ends up looking like exactly the pattern the tracker was designed to flag.

The distillation concern is a separate but related issue. When a competitor queries a commercial model at scale to train a lookalike system, the outputs are effectively being harvested for use in a rival product. Anthropic and other Western AI labs have accused Chinese firms of exactly this pattern, and one specific data point cited across coverage was Alibaba’s Qwen model occasionally identifying itself as Claude during testing — the kind of leakage that suggests training data provenance issues. The technical case for wanting to detect this traffic is real. The community disagreement was never about whether the problem exists. It was about whether steganographic markers with no disclosure are an appropriate way to address it.

The Claude Code tracker sits inside a broader run of documented Anthropic incidents over the first half of 2026. In March, the accidental source code leak exposed 512,000 lines of internal TypeScript. Around the same time, security researchers documented a vulnerability where a single crafted GitHub Issue could have compromised any Claude Code user who processed it. Each individual incident has a plausible technical explanation, but the accumulated pattern is what enterprise buyers care about.

For a company whose brand promise is safety, transparency, and constitutional AI — Anthropic markets itself explicitly on trustworthy AI system design — the accumulation matters more than any single event. Enterprise procurement teams evaluating vendors for regulated workloads track exactly this kind of history. A pattern of undisclosed behavior, source leaks, and remote-code-execution paths through the developer surface becomes a documented reason to prefer a competitor when the next contract comes up for renewal. That is the cost Anthropic will be paying for years.