This is the endgame for Anthropic

Someone reverse-engineered Claude Code and found that Anthropic has been covertly watermarking your system prompt based on your timezone and proxy settings. If your timezone is Asia/Shanghai or Asia/Urumqi, the date format in your system prompt silently switches from 2026-06-30 to 2026/06/30. The apostrophe in “Today’s date is” changes to one of four invisible Unicode characters depending on whether you’re proxying through a Chinese domain and whether that domain matches a Chinese AI lab. None of this is in the release notes. The domain lists are XOR-obfuscated with key 91 inside the binary so a plain strings dump wouldn’t catch it.

I went out immediately and verified this in my own Claude Code install, version 2.1.190. The functions are right there in the binary. Here is exactly what they check.

The check: HOd()

The function HOd() reads your ANTHROPIC_BASE_URL env var, extracts the hostname, and checks it against two lists. One list is a set of known Chinese domains, the other is a set of keywords matching Chinese AI labs. Both lists are base64-encoded and XOR-obfuscated with the key 91, then decoded at runtime by the function k3i(). At the same time, HOd() calls zbt() to get your system timezone and checks whether it returns Asia/Shanghai or Asia/Urumqi. It returns an object with three booleans:

• known — is your proxy a known Chinese domain
• labKw — does your proxy match a Chinese AI lab
• cnTZ — are you in a Chinese timezone

The watermark: IOd()

The function IOd() takes those two booleans and picks which apostrophe to inject into the system prompt. If neither is true, you get a normal apostrophe '. If your proxy is a Chinese domain but not an AI lab, you get \u2019 (right single quotation mark). If your proxy matches a Chinese AI lab but is not a Chinese domain, you get \u02BC (modifier letter apostrophe). If both are true, you get \u02B9 (modifier letter prime).

These are visually indistinguishable from a normal apostrophe but uniquely identifiable by Anthropic on the receiving end.

The assembly: H3i()

The function H3i() assembles the final string. It takes the date string and, if cnTZ is true, replaces every hyphen with a forward slash, so 2026-06-30 becomes 2026/06/30. Then it returns Today${apostrophe}s date is ${date}. with the watermarked apostrophe and date format baked in.

So every prompt you send to Claude through the proxy carries an invisible tag that tells Anthropic your timezone, whether your proxy is Chinese, and whether your proxy matches a Chinese AI lab. Four bits of information about your system, encoded in punctuation that you will never see.

The intent

The stated intent is catching unauthorized resale and distillation in China, which is a real problem Anthropic faces. But covertly transmitting information about every user’s system configuration, without consent, based on their timezone, is not a proportionate response to that problem. It is surveillance embedded in a tool that has full filesystem and shell access on developer machines. And the steganography is the part that should make you pause, because it shows a deliberate decision to hide this from users rather than disclose it.

A check like this is also trivially bypassable by anyone sophisticated enough to resell API access or distill a model. Change your timezone, use a non-Chinese proxy, or just patch the binary. So it compromises the privacy of legitimate users while failing against the actual adversaries it targets.

What else is in the binary?

If they are willing to hide this in every developer’s system prompt, what else is in the binary that nobody has found yet? This is a tool with full filesystem and shell access on your machine. You handed it that access because you trusted the company. The company responded by profiling you in secret.

This is the same company whose CEO testified that open source AI is “very dangerous path” while his own binary was quietly profiling their customers. The danger was in their own closed-source tools all along.

Their own privacy policy says otherwise

Anthropic’s Privacy Policy (the version currently displayed on their site, effective July 8, 2026, published June 8, 2026) states, under Section 4, that Anthropic “does not engage in decision making based solely on automated processing or profiling in a manner which produces a legal effect.” This is a direct contradiction of what the binary does. The watermarking is solely automated processing. There is no human in the loop deciding whether to encode your timezone into your prompt. The binary does it automatically, every time, based on your system configuration. It profiles you by geography and proxy, and it affects how your data is processed. GDPR Article 22 gives you the right not to be subject to exactly this kind of automated decision-making. Their own policy says they don’t do it. Their own binary does it anyway.

The policy does collect “Device and Connection Information” including “time zone setting” and “IP address,” so they disclose that they collect timezone data. But collecting technical data for service operation is not the same as covertly embedding fingerprinting signals into the content a user sends to the model. The first is disclosed. The second is hidden with XOR obfuscation and Unicode tricks. No user reading this policy would understand that their timezone is being encoded into their prompts as invisible characters.

Section 2 lists “legitimate interests” for fraud and abuse prevention as the likely legal basis they would cite. But GDPR Article 6(1)(f) requires that the legitimate interest be balanced against the user’s rights and reasonable expectations. A user running Claude Code through a proxy has no reason to expect that their timezone and proxy configuration are being encoded into their prompts. That is outside any reasonable expectation, and the deliberate obfuscation makes it hard to argue the user could have anticipated it.

The watermarking is present in version 2.1.190 (released June 24, 2026), which I verified myself. The original researcher claims it has been in the binary since version 2.1.91. I have not verified that claim independently.

Their Consumer Terms of Service (Section 3) prohibit users from reverse engineering the service: “You may not decompile, reverse engineer, disassemble, or otherwise reduce our Services to human-readable form.” They ship a binary that has full filesystem and shell access on your machine, they hide surveillance logic in it, and then they write a contract clause saying you’re not allowed to look at what’s running on your own computer. The clause is almost certainly unenforceable in the EU, where the Software Directive (2009/24/EC) explicitly gives users the right to decompile software, and GDPR Article 22 gives you the right to understand automated processing that affects you. No contract clause can override statutory rights. But the intent is what matters. They wrote a clause designed to stop you from finding what they hid. A company that had nothing to hide would not need a reverse engineering prohibition to protect XOR-obfuscated surveillance code.

Verify it yourself

I verified this in my own Claude Code install, version 2.1.190. Run:

strings $(which claude) | grep -E "Asia/Shanghai|Asia/Urumqi|Today.s date"

You will find the timezone checks, the XOR key COd=91, the base64-encoded domain lists, and the four apostrophe variants. The logic is exactly as described above. Ask Claude Code or Codex to reverse-engineer the binary and look for this logic, and it will find it trivially.