claude --version right now. Versions 2.1.91 through 2.1.196 shipped undisclosed code that covertly fingerprinted proxy users via steganography embedded in system prompts. On July 8, 2026, China's NVDB regulator classified this as a severe security backdoor risk. This guide explains how the hidden tracking worked, who was actually affected, what Anthropic and Alibaba said, and the exact steps to check, upgrade, or uninstall.
Is Claude Code Safe? TL;DR and Immediate Action
Claude Code is Anthropic's terminal-based AI coding agent with file-system and shell access. The controversy is not about normal telemetry — it is about a covert channel that ran for nearly three months without any changelog disclosure.
Affected: v2.1.91 (Apr 2) through v2.1.196 (Jun 29, 2026).
Fixed in: v2.1.197+ (Jul 1–2, 2026; some reports cite v2.1.198).
Trigger: Only when ANTHROPIC_BASE_URL points to a non-official proxy or gateway — official api.anthropic.com users were not fingerprinted.
Regulatory action: China's NVDB (Jul 8) called it a backdoor; Alibaba banned Claude Code effective Jul 10.
Do now: claude --version → upgrade or uninstall if in the affected range.
| Date | Event |
|---|---|
| Feb 2026 | Anthropic publicly invests in anti-distillation tech |
| Mar 2026 | Covert detection mechanism deployed internally, undisclosed |
| Apr 2 | v2.1.91 ships with hidden detection code |
| Jun 29 | v2.1.196 — last affected release |
| Jun 30 | Reddit exposure (LegitMichel777); reverse-engineering by Thereallo, Adnane Khan |
| Jul 1 | Engineer Thariq Shihipar admits "experiment," promises rollback |
| Jul 2 | v2.1.197 removes steganography code; changelog silent |
| Jul 3–4 | Reuters, TechCrunch report Alibaba internal ban |
| Jul 8 | China NVDB official backdoor risk advisory |
| Jul 10 | Alibaba ban takes effect; staff directed to Qoder |
Claude Code Steganography: How the Fingerprinting Actually Worked
Security researcher Adnane Khan defined it as "a covert information channel embedded in system prompts." Unlike standard telemetry (Datadog, OpenTelemetry), this mechanism did not use a separate reporting channel — it modified the system prompt itself.
Environment recon: Check timezone (Asia/Shanghai, Asia/Urumqi) and match ANTHROPIC_BASE_URL hostname against a built-in blacklist.
147-entry domain list: Independently verified by LegitMichel777, Thereallo, Adnane Khan, Vincent Schmalbach — covers Alibaba, Baidu, ByteDance, DeepSeek, Moonshot, Zhipu, MiniMax, and known API resellers. Obfuscated with XOR key 91 + Base64.
Prompt steganography: Date separator flips from 2026-06-30 to 2026/06/30; apostrophe in Today's date is swaps among Unicode variants (U+0027, U+2019, U+02BC) encoding ~3 bits of environment data per request.
claude --version echo $ANTHROPIC_BASE_URL npm install -g @anthropic-ai/claude-code@latest
| Source | Framing | Angle |
|---|---|---|
| NVDB / China | Security backdoor, severe threat | Compliance, data exfiltration risk |
| The Register | Covert code / secret steganography | Undisclosed updates accountability |
| Ars Technica | Spyware-like tracking | Trust crisis |
| Anthropic | Undisclosed experiment | Anti-abuse, anti-distillation defense |
| Cybernews | "A nothing burger" (some devs) | Overreaction to engineering countermeasure |
For deeper reverse-engineering detail, see our dedicated steganography breakdown.
Claude Code ANTHROPIC_BASE_URL: Who Is Actually Affected?
Headlines saying "Claude Code monitors everyone" are wrong. The mechanism only activated when you routed API traffic through a non-official endpoint via ANTHROPIC_BASE_URL.
Official API users: Not affected by this specific fingerprinting path.
Proxy / gateway / reseller users: Fingerprinted on affected versions; primary reported outcome is account ban risk, not a confirmed data breach.
High-privilege concern: Claude Code has shell and filesystem access — undisclosed covert behavior crosses a different trust line than normal CLI telemetry.
vs. normal telemetry: Datadog/OpenTelemetry-style collection is disclosed in privacy policies; this was steganography with no opt-out and no changelog for ~3 months.
Enterprise teams: Even if not proxy-routed, compliance teams may mandate upgrade audits across all dev machines.
Bottom line on scope: This was targeted fingerprinting of China-linked proxy users and competitors' infrastructure — not universal spyware. That nuance matters for both security assessment and media literacy.
How to Check Claude Code Version, Upgrade, or Uninstall
Check version: Run claude --version in your terminal.
Check proxy config: Run echo $ANTHROPIC_BASE_URL — non-empty non-official values mean you were on the trigger path if version was in range.
Upgrade: npm install -g @anthropic-ai/claude-code@latest or claude update to v2.1.197+.
Full uninstall (macOS/Linux): Remove ~/.claude, ~/.claude.json, ~/.cache/claude-code, ~/.config/claude-code.
Egress audit: Run a full audit of outbound traffic from dev machines — uninstall alone does not prove no persistent AI endpoint connections.
Enterprise checklist: Inventory all terminals → upgrade/uninstall → tighten egress filtering → evaluate alternatives (Qoder, Cursor, internal gateways).
Why Alibaba Banned Claude Code — and the AI Distillation Backstory
Engineer Thariq Shihipar on X: "This is an experiment we launched in March that was meant to prevent account abuse from unauthorized resellers and protect against distillation... this should be fully rolled back in tomorrow's release."
Context: Anthropic wrote to the US Senate Banking Committee alleging Alibaba's Qwen team used ~25,000 fraudulent accounts generating 28.8 million interactions to distill Claude capabilities. February 2026 Peking University / CAS research also reported distillation traces in major Chinese models. Claude Opus 4.8 reportedly misidentified itself as Qwen/DeepSeek in tests — adding irony to Anthropic fingerprinting China-linked users.
Alibaba's internal notice (via SCMP, Ars Technica): "As Claude Code was recently discovered to carry back-door risks... added to a list of high-risk software." Effective Jul 10, all staff banned from Claude Code and Anthropic models (Sonnet, Opus, Fable), redirected to internal tool Qoder.
147 domains in obfuscated blacklist (multi-source reverse engineering)
~20 releases carried the mechanism (Apr 2 – Jun 29)
Zero changelog mentions across all affected versions
Teams running AI agents alongside iOS CI/CD pipelines face compounded risk when local machines mix high-privilege CLI tools with unclear outbound behavior. For production workloads needing isolated Apple Silicon hosts with predictable egress, MESHLAUNCH Mac Mini cloud bare-metal rental offers dedicated hardware, 24/7 uptime, and flexible daily/weekly/monthly terms — see our pricing page.
Some technical commentators (Cybernews) argue the reaction was overstated — the code targeted distillation pipelines, not mass surveillance. We present both framings: NVDB's backdoor classification and Anthropic's experiment narrative are both part of the public record.
Disclaimer: Based on publicly available NVDB reports, Anthropic statements, and independent security research (CNBC, The Register, Ars Technica, TechCrunch, Thereallo, Adnane Khan). Informational only — not legal or security audit advice.
v2.1.91–2.1.196 shipped undisclosed fingerprinting via steganography. NVDB classified it as a backdoor risk; Anthropic called it an anti-distillation experiment, removed in v2.1.197.
2.1.91 (Apr 2) through 2.1.196 (Jun 29, 2026). Upgrade to 2.1.197 or later.
No. The hidden mechanism only activated when ANTHROPIC_BASE_URL pointed to a non-official proxy or gateway.
Run claude --version. Environment setup questions: see our help center.
Upgrade immediately on affected versions. Enterprises with compliance requirements may additionally uninstall and audit outbound traffic.
Date separator and Unicode apostrophe variants in system prompts encoded timezone and proxy-domain hit signals.
Classified as high-risk after backdoor reports; staff directed to internal tool Qoder from Jul 10, 2026.
No. Zero changelog entries across ~20 affected releases over nearly three months.
Code removed in 2.1.197+. Ongoing trust depends on your risk tolerance and org policy.
Training a model on another model's outputs. Anthropic said the mechanism targeted unauthorized resellers and distillation pipelines — part of a broader US–China AI competition context.