Anthropic Quietly Pulled Hidden Fingerprints From Claude Code

Claude Code embedded invisible Unicode fingerprints in its system prompts since April, per a security researcher's report. That's three months of undisclosed tracking for any developer routing traffic through a reseller gateway or a Chinese-linked service like DeepSeek, Zhipu, Baidu, or Alibaba.

The technique tweaked date and apostrophe characters, obfuscated with an XOR key of 91. It flagged two things separately: requests routed through third-party gateways, and requests tied to Chinese-linked domains. Anthropic's Thariq Shihipar called it a March experiment aimed at catching resellers and model distillation, and the company shipped a removal in v2.1.197. Distillation theft and gray-market reselling are real problems for a lab like Anthropic. Watermarking traffic to catch them isn't inherently wrong.

The fingerprinting itself isn't what stings. The trust break is that neither the addition nor the removal showed up in a changelog. They hid a marker in obfuscated Unicode. They targeted it by where a request came from. They said nothing about it either time. That's the exact pattern security researchers spend their careers flagging, and a safety-branded lab did it anyway.

I use Claude Code daily in my personal projects and I'm not ripping it out over this. More concentration risk than security breach. The client running on your own machine is a trust boundary, and this one moved without a note. Keep a real second option warm: something local like Ornith-1.0, an open model like Nemotron, or a cheap one like GPT-5.6 Luna at $1/$6. Watch whether Anthropic's next network-level change to Claude Code makes the changelog before an outside researcher finds it first.