The Claude Code Covert Tagging Scandal: The AI Trust Crisis Behind Alibaba's Ban

A Trust Crisis Sparked by Reverse Engineering

Recently, Anthropic's programming tool Claude Code has been caught up in a trust crisis. According to a hardcore teardown channel on Bilibili, developers on Reddit conducted a reverse-engineering analysis of Claude Code and made the following allegation: when users configure a non-official Anthropic Base URL or proxy gateway, Claude Code may combine signals such as timezone and proxy URL, and encode the results of its local environment assessment into the System Prompt sent to Anthropic through subtle variations in date formats and Unicode punctuation.

So-called reverse engineering refers to reconstructing a piece of software's internal logic by analyzing its binary files, network traffic, or runtime behavior, without access to the source code. For closed-source tools like Claude Code, developers typically employ various technical approaches: using dynamic instrumentation frameworks like Frida to intercept runtime function calls, capturing decrypted HTTP traffic over TLS via Wireshark or mitmproxy, and disassembling compiled artifacts with Ghidra or IDA Pro to understand how they operate.

The System Prompt, on the other hand, is an instruction pre-injected at the system level in a large language model conversation. Users generally cannot see its full content, but it influences the model's behavior and output style. The covert nature of the System Prompt stems from a design characteristic of large language model architectures—the full context received by the model is opaque to end users, and API responses typically do not return system prompt content. For this reason, encoding hidden information within a System Prompt is extremely covert—difficult for users to detect and difficult to intervene against.

A few days later, according to a China Daily report, Alibaba internally required employees to stop using Anthropic-related products, with the ban taking effect on July 10. Why would a programming tool provoke such a strong reaction from a major Chinese tech company? Hidden behind this is a deeper struggle in the AI era over compute monopoly, developers' right to know, and technological equity.

It must be emphasized that these technical details are all based on allegations from third-party reverse-engineering analysis, and Anthropic has not publicly acknowledged them. Some reports have relayed that Anthropic employees referred to it as an "anti-abuse experiment," but this is not equivalent to the company fully disclosing the technical mechanism.

Event Timeline: From Tightened Terms of Service to Distillation Allegations

To understand this drama, we need to rewind the timeline.

Tightening of the Terms of Service

After Anthropic updated its terms of service, it restricted companies "majority-owned or controlled by Chinese entities" from using Claude. Even Chinese-invested subsidiaries or branches registered abroad may be affected, as long as they are controlled by Chinese entities. This led some domestic users and developers to switch to proxy relays or overseas accounts to continue using the service.

The Distillation Attack Allegations

After this, matters escalated completely. Anthropic sent a letter to U.S. Senators Tim Scott and Elizabeth Warren, alleging that operators linked to Alibaba conducted approximately 28.8 million Claude interactions through nearly 25,000 fraudulent accounts over about six weeks, in an attempt to "distill" and extract Claude's capabilities.

So-called model distillation was first systematically proposed by Hinton et al. in their 2015 paper Distilling the Knowledge in a Neural Network. Originally a model compression technique, it uses the "soft labels" output by a teacher model (i.e., probability distributions over classes rather than a single prediction) to train a student model, enabling the latter to acquire the teacher model's implicit understanding of the data distribution with fewer parameters, rather than merely mimicking the final answer.

In the era of large models, this technique has evolved into a potential means of knowledge theft, known as "API distillation" or "black-box distillation": attackers do not need access to the model weights—they only need to make large numbers of calls to the target model's API using carefully crafted prompts, collect high-quality input-output pairs, and then use this data to fine-tune or train their own models. Stanford University's Alpaca project once trained LLaMA using around 50,000 GPT-3.5 output records, demonstrating the feasibility of this approach and triggering a chain reaction in which OpenAI modified its terms of service to explicitly prohibit "use in training competing models." Meta's LLaMA model once sparked a copyright dispute over allegations that it was trained on ChatGPT output data. For Anthropic, if a competitor systematically extracted Claude's reasoning patterns and knowledge boundaries through nearly 30 million interactions, it would amount to bypassing the enormous compute and data investments and directly "distilling" away its core competitive advantage. Anthropic considers this to be theft of its core technology.

The Claude Code Covert Tagging Mechanism: A Technical Teardown

While Alibaba had yet to formally respond, developers on Reddit were the first to reverse-engineer Claude Code, uncovering something even more attention-grabbing than the distillation allegations.

Trigger Condition: Only Targeting Proxy Users

According to Rohan Paul's discussion on X, this mechanism primarily targets non-default Anthropic Base URL routing. In other words, Claude Code only triggers this detection when you have modified your proxy settings and use a custom gateway. Ordinary users connecting directly to Anthropic should not be tagged merely because of a Chinese timezone. This point is very important—it does not target all Chinese users.

Encoding a Tag Rather Than Actively Uploading

Reverse-engineering analysts pointed out that when a proxy is detected, Claude Code makes a judgment by combining the system timezone and characteristics of the proxy URL. But the key is: it does not separately upload sensitive information such as the proxy IP, company background, or business code—instead, it encodes the assessment result into the System Prompt that would be sent anyway.

This is an important distinction. The former is actively stealing data; the latter is inserting a covert tag into existing communications—both are problematic, but they are different in nature.

The Clever Use of Unicode Punctuation

According to the analysis, Claude Code manipulates punctuation marks within the System Prompt. This technique is known in the information security field as "Unicode steganography."

Unicode is the international standard character encoding system, currently containing over 149,000 characters, among which there are large numbers of "visually confusable characters"—for example, Latin and Cyrillic letters appear identical in most fonts but occupy different code points. Besides character substitution, zero-width characters, such as the zero-width joiner (U+200D), are also often used for steganography, because they occupy no width when rendered and are completely invisible. The punctuation-substitution technique that Claude Code is alleged to have used—replacing an ordinary apostrophe with a similar-looking but differently-coded Unicode character—is a variant application of the "Homoglyph Attack." This technique has long been seen in phishing domain name spoofing, and migrating it into the System Prompt opened up a new scenario for covert information tagging in AI tools.

The ordinary right single quotation mark (U+2019), the modifier letter apostrophe (U+02BC), and the modifier letter right half ring (U+02BE) are nearly indistinguishable to the naked eye under most font rendering, but differ at the byte level. The server only needs to decode the specific character encoding to recover the tag information, greatly increasing the difficulty of detection on the user side.

The prompt contains the English sentence "Today is the day, it is..." According to the detection results:

• If a Chinese domain is detected but it is not an AI lab, the apostrophe is replaced with the right single quotation mark;
• If it is not a Chinese domain but is an AI lab, it is replaced with the modifier letter apostrophe;
• If it is both a Chinese domain and an AI lab, it is replaced with yet another modifier letter symbol.

These three Unicode punctuation marks look nearly identical to the naked eye on screen, but when transmitted to the server, the machine can instantly read them and assign different tags. This is precisely the core of this covert tagging controversy.

The Compliance Logic Behind Alibaba's Hardline Ban

Faced with the above situation, Alibaba's reaction was extremely firm. According to China Daily citing two people familiar with the matter, Alibaba issued an internal directive requiring employees to stop using Anthropic-related products, including all versions of the Claude models and Claude Code, with the ban taking effect on July 10. Reportedly, employees were asked to switch to in-house tools and models such as Coder.

From the perspective of corporate data compliance, this reaction has a profound institutional logic. Corporate data compliance has in recent years become a core risk-management issue for tech companies. The EU's General Data Protection Regulation (GDPR), China's Data Security Law, and the Personal Information Protection Law all explicitly require that data processing follow the principle of "informed consent."

More critically, Claude Code, as a tool embedded directly into the development workflow, is an important component of the software supply chain. The SolarWinds incident of December 2020 is a cautionary precedent: attackers implanted a backdoor into the build pipeline of SolarWinds' Orion network management software, affecting around 18,000 organizations, including the U.S. Treasury and Department of Defense. This incident profoundly revealed the special risks of development tools—compilers, IDE plugins, and code analysis tools sit at the very upstream of software production, and developers typically apply far less rigorous security scrutiny to "auxiliary tools" than to production systems, creating a natural defensive blind spot. Claude Code may not only have access to sensitive metadata such as uncommitted code drafts and local environment variables, but its awareness of information like proxy URLs and timezones, combined with covert tagging behavior, is enough to trigger a company's compliance red lines. If a programming tool modifies the data sent to the server without the user's knowledge, that is unacceptable to any enterprise with data compliance requirements, because it fundamentally violates the user's right to know.

It should be noted that this is based on reports from people familiar with the matter, not an official Alibaba announcement.

Has the Dragon-Slaying Youth Grown Scales?

Anthropic's demand to protect its intellectual property is not without merit. Developing a large model costs billions of dollars, and distillation attacks are a real threat. But the problem is—the method of defense matters.

Anthropic was founded by a team that left OpenAI, and they proclaim their aim to build "AI that is responsible to humanity." Yet when, in order to prevent abuse, they implant covert tags on the client side and modify data without the user's knowledge, it is the lack of transparency that is most unsettling.

Even more worth pondering is the actual effect. According to a Reddit user's analysis, such covert tagging is "trivial for any moderately skilled adversary"—anyone genuinely intent on distillation would already know how to bypass it. So what is the real purpose of this covert detection—preventing abuse, or surveillance?

The Technological Equity Dilemma of the AI Era

This incident essentially reflects a larger problem: when a single company controls critical tools that more and more developers depend on, it holds absolute power over those developers. If such power lacks checks and balances and lacks transparency, it ultimately tends to devolve into abuse—and often under the guise of "security."

In the era of large models, compute has become the new oil, and models have become the new nuclear weapons. High-end AI chips such as NVIDIA's A100 and H100 have been placed on the U.S. government's export control list, and the relevant rules have undergone several rounds of tightening: after the first restrictions in 2022, the rules updated in October 2023 introduced dual metrics of "Total Processing Performance" (TPP) and "performance density," attempting to close the loophole of companies bypassing controls through downclocked versions (such as the A800 and H800), and Chinese companies' procurement has been strictly limited. Against this backdrop of "compute blockade," API access controls have become another soft barrier: by restricting entities from specific countries through terms of service, U.S. AI companies can further narrow competitors' channels for acquiring technology without touching hardware sanctions, forming a dual-layer "hardware + software" blockade system. This also reveals a harsh reality: as long as core technology is not in one's own hands, so-called AI equity will always be merely an illusion granted by others.

Forcing the Independence of the Domestic Large-Model Ecosystem

In the long run, such confrontations may instead spur the growth of domestic large models. The emergence of models like DeepSeek-R1 is seen by some researchers as a "dimensionality-reducing breakthrough" achieved through algorithmic innovation under constrained compute—approaching the international frontier in parameter efficiency and reasoning ability, and confirming a judgment NVIDIA CEO Jensen Huang has publicly noted: technology blockades may actually incentivize domestic alternatives to mature faster. Models like Tongyi Qianwen already have a clear advantage in price, approach frontier levels in some scenarios, and better understand the Chinese-language ecosystem. In a sense, Alibaba's ban is also a microcosm of domestic models beginning to take over the workflows of domestic developers.

From this perspective, Anthropic's move has instead accelerated the independent construction of China's AI ecosystem. In an era of technological fragmentation, self-reliance and controllability are not a slogan, but a necessity for survival.

Key Takeaways