Secret Claude tracker shocks users after Anthropic’s anti-surveillance stance

Anthropic 秘密追踪器引发用户震惊，与其反监控立场背道而驰

Anthropic quickly removed a tracker secretly monitoring Claude Code users in China after a security researcher exposed the hidden code and condemned the spyware-like tracking as a “serious breach of user trust.” 在一位安全研究人员曝光了这段隐藏代码，并谴责这种类似间谍软件的追踪行为是“对用户信任的严重背叛”后，Anthropic 迅速移除了一个秘密监控中国 Claude Code 用户的追踪器。

Last week, a web developer known as “Thereallo” was researching privacy issues in Claude Code and was shocked to find that the AI firm was using “prompt steganography” to hide code that tracks Chinese users “in plain sight.” This code wasn’t malicious, but it was sending information to Anthropic that most users wouldn’t detect, relying on shorthand markers to quietly flag users’ timezone, proxy, and potential connection to Chinese AI labs that Anthropic has accused of distillation attacks. 上周，一位名为“Thereallo”的网页开发者在研究 Claude Code 的隐私问题时震惊地发现，这家 AI 公司正在利用“提示词隐写术”（prompt steganography）将追踪中国用户的代码“隐藏在眼皮底下”。这段代码本身并无恶意，但它会在用户毫无察觉的情况下向 Anthropic 发送信息，通过简写标记悄悄记录用户的时区、代理服务器，以及与 Anthropic 所指控的进行“模型蒸馏攻击”的中国 AI 实验室之间的潜在联系。

On X, Anthropic engineer Thariq Shihipar confirmed that the tracker was added to Claude Code as an “experiment” in March. According to Shihipar, the code “was meant to prevent account abuse from unauthorized resellers and protect against distillation.” Regarding the former, The Washington Post found unauthorized retailers have sold access to free models for $1 a month, and pro subscriptions that can cost $100 monthly sell for “as little as $12.” Supposedly, Anthropic has “actually been meaning to take this down for a while,” Shihipar said of the hidden code, because engineers have “landed stronger mitigations since then.” Anthropic 工程师 Thariq Shihipar 在 X 上证实，该追踪器是 3 月份作为一项“实验”被加入 Claude Code 的。据 Shihipar 称，这段代码“旨在防止未经授权的经销商滥用账户，并防范模型蒸馏”。关于前者，《华盛顿邮报》发现，未经授权的零售商以每月 1 美元的价格出售免费模型的使用权，而每月成本高达 100 美元的专业订阅服务甚至能以“低至 12 美元”的价格买到。Shihipar 表示，Anthropic 其实“早就打算将其移除”，因为工程师们“此后已经部署了更强有力的缓解措施”。

Privacy advocates were not happy with the explanation, though, warning that the code is evidence that Anthropic is willing to cross lines to surveil users. That’s perhaps especially surprising, considering that Anthropic riled the Trump administration by refusing to allow the US government to use Claude to surveil US users. The AI firm has since sued the White House over the clash. 然而，隐私倡导者对这一解释并不买账，他们警告称，这段代码证明了 Anthropic 为了监控用户愿意越界。考虑到 Anthropic 此前曾因拒绝允许美国政府利用 Claude 监控美国用户而激怒了特朗普政府，并因此起诉了白宫，这一行为显得尤为令人震惊。

Anthropic wants distillation deemed illegal

Anthropic 希望将“模型蒸馏”定为非法

The Post suggested that the tracker incident is a sign that US firms like Anthropic are taking “increasingly aggressive measures” to block Chinese AI firms from copying their models. A more defensive stance has apparently become critical. In the past year, Chinese firms have “consistently matched” US firms’ model capabilities “within months,” the Post reported. Most recently, “a new, free AI model from Chinese company Zhipu AI was better at finding computer vulnerabilities than Anthropic’s Claude Opus 4.8 model, which was released in May,” the Post reported. 《华盛顿邮报》指出，此次追踪器事件表明，像 Anthropic 这样的美国公司正在采取“日益激进的措施”，以阻止中国 AI 公司复制其模型。显然，采取更具防御性的立场已变得至关重要。据报道，在过去一年中，中国公司“在几个月内”就持续追平了美国公司的模型能力。最近，《华盛顿邮报》报道称，“中国公司智谱 AI 的一款免费新模型在发现计算机漏洞方面的表现，优于 Anthropic 5 月发布的 Claude Opus 4.8 模型。”

To lock in a 12- or possibly even 24-month lead for the US, Anthropic has said the US must ramp up interventions, using a range of possible penalties to combat distillation attacks, including blocking access to advanced models, chips, and data centers in the US. Although distillation isn’t illegal (leading US firms do it, too), prompting models like Claude millions of times in order to quickly advance Chinese models violates Anthropic’s user terms. To end the endless copying, Anthropic has joined OpenAI in urging the US to view distillation attacks as a form of intellectual property theft. 为了确保美国拥有 12 个月甚至 24 个月的领先优势，Anthropic 表示美国必须加大干预力度，利用一系列可能的惩罚措施来打击蒸馏攻击，包括限制对美国先进模型、芯片和数据中心的访问。虽然蒸馏本身并不违法（美国领先公司也在做），但为了快速提升中国模型而对 Claude 等模型进行数百万次的提示词调用，违反了 Anthropic 的用户协议。为了终结这种无休止的复制，Anthropic 已联合 OpenAI 敦促美国将蒸馏攻击视为一种知识产权盗窃行为。

At a recent Senate hearing, Sen. Tim Scott (R-S.C.) agreed legal intervention is needed, arguing that the US needs “to carefully craft export control policy that is clear and concise” to stop China from using such attacks to “gain a technological edge,” the Post reported. 据《华盛顿邮报》报道，在最近的一次参议院听证会上，参议员蒂姆·斯科特（Tim Scott，共和党，南卡罗来纳州）同意需要进行法律干预，他认为美国需要“精心制定清晰简洁的出口管制政策”，以阻止中国利用此类攻击“获得技术优势”。

Secret code triggers Alibaba Claude ban

秘密代码引发阿里巴巴封禁 Claude

It’s clear that Chinese firms are distilling US models, the Post reported. In February, Chinese researchers at Peking University and the state-funded Chinese Academy of Sciences “developed methods to detect signs of distillation in leading large language models” and found that most Chinese models “showed substantial evidence of distillation,” primarily of US models. One of Alibaba’s Qwen AI models—which Anthropic has since claimed was advanced after the largest distillation attack ever on Claude in June—“repeatedly appeared to mimic” Claude in February. In some intensive tests, the model would even sometimes slip up and identify itself as Claude, researchers found. 《华盛顿邮报》报道称，中国公司正在蒸馏美国模型已是事实。今年 2 月，北京大学和中国科学院的研究人员“开发了检测领先大语言模型中蒸馏迹象的方法”，并发现大多数中国模型“显示出明显的蒸馏证据”，且主要针对美国模型。阿里巴巴的一款 Qwen 模型在 2 月份“反复出现模仿”Claude 的情况，Anthropic 此后声称该模型是在 6 月份对 Claude 发动了史上最大规模的蒸馏攻击后才得以进化的。研究人员发现，在一些高强度测试中，该模型甚至有时会“说漏嘴”，自称为 Claude。

Alibaba has not commented on Anthropic’s accusations, but the company has moved to distance itself from Anthropic’s models amid ongoing scrutiny. Last Friday, Alibaba banned its employees from using Claude Code for work, the South China Morning Post reported. According to a memo SCMP reviewed, Alibaba told employees the ban came in direct response to concerning news about a tracker Anthropic is using to monitor Chinese users. “As Claude Code was recently discovered to carry back-door risks, after comprehensive evaluation, Claude Code has now been added to a list of high-risk software with security vulnerabilities,” the memo said. 阿里巴巴尚未对 Anthropic 的指控发表评论，但在持续的审查压力下，该公司已采取行动与 Anthropic 的模型保持距离。据《南华早报》报道，上周五，阿里巴巴禁止员工在工作中使用 Claude Code。根据《南华早报》查阅的一份备忘录，阿里巴巴告知员工，此禁令是针对 Anthropic 用于监控中国用户的追踪器相关新闻所做出的直接回应。备忘录称：“鉴于 Claude Code 最近被发现存在后门风险，经综合评估，Claude Code 已被列入高风险安全漏洞软件名单。”

For Alibaba, ignoring Anthropic’s determination to detect users connected to leading Chinese AI labs is risky. Unlike individual users who can easily pay for cheap circumvention tech to evade Anthropic’s location blockers without fears of major repercussions, Alibaba could be exposed to legal and compliance risks if caught violating Anthropic’s terms, a source granted anonymity to discuss Alibaba’s Claude ban told Reuters. 对于阿里巴巴而言，忽视 Anthropic 对连接中国领先 AI 实验室用户的检测决心是存在风险的。一位因讨论阿里巴巴封禁 Claude 而要求匿名的消息人士告诉路透社，与那些可以轻松购买廉价翻墙技术以规避 Anthropic 地理封锁且无需担心严重后果的个人用户不同，如果阿里巴巴被发现违反 Anthropic 的条款，可能会面临法律和合规风险。

For Anthropic, allowing the attacks to continue could hurt the company’s business. Some open source Chinese models are more popular than free and open American counterparts, the Post reported, and Fortune 500 CEOs have made it clear that they’re searching for cheaper AI solutions. For the US, not only would moving to block Chinese distillation of American models be challenging, but it could also be unpopular—blocking Americans from benefiting from cheaper AI alternatives from China, the Post suggested. 对于 Anthropic 来说，任由这些攻击持续下去可能会损害其业务。据《华盛顿邮报》报道，一些开源的中国模型比免费开放的美国同类产品更受欢迎，且《财富》500 强企业的 CEO 们已明确表示，他们正在寻找更便宜的 AI 解决方案。《华盛顿邮报》指出，对于美国而言，采取行动阻止中国对美国模型的蒸馏不仅具有挑战性，而且可能不得人心——因为这会阻碍美国人从中国更便宜的 AI 替代品中获益。

Anthropic tracking crossed “scary boundary”

Anthropic 的追踪行为越过了“可怕的界限”

In this climate, where a chatbot user’s loyalty depends on a cost-benefit analysis weighing the cost of accessing models against their capabilities, Anthropic likely can’t afford to lose user trust as it fights to keep frontier models ahead of China’s. As the web developer who flagged the hidden tracker noted, it’s “weird” th 在当前环境下，聊天机器人用户的忠诚度取决于对模型访问成本与能力之间的性价比分析。在努力保持前沿模型领先于中国的同时，Anthropic 可能无法承受失去用户信任的代价。正如那位发现隐藏追踪器的网页开发者所指出的，这很“奇怪”……