Anthropic is pulling the hidden code it quietly added to Claude Code a few months ago, and the timeline is specific: engineer Thariq Shihipar says the fix should appear on July 1. The company says it merged the pull request and expects it to show up in Wednesday’s Claude Code release, ending an experiment that used steganography, or hiding secret data in plain sight, inside the system context sent to Anthropic’s servers.

Here is the part that matters for decision-makers, not just tool builders: the code was designed to detect when Claude Code requests were being routed through overridden settings, including base URL changes, and then classify whether the request matched patterns associated with known Chinese AI labs, other AI companies, account resellers, and gateway domains. If that sounds like an internal “are you authorized?” gate, that is essentially what it was. Anthropic’s framing is that it is meant to prevent account abuse from unauthorized resellers and protect against distillation, the industry term for copying AI models through repeated queries.

According to Shihipar, this was “an experiment we launched in March,” and he said the team has since landed “stronger mitigations” and has “actually been meaning to take this down for a while.” In other words, this was not a permanent surveillance feature in Anthropic’s view. It was a stopgap, launched earlier in the lifecycle, and now considered unnecessary because the company says other defenses improved.

But the mechanism matters because it raises trust questions. A developer going by the name Thereallo described the experiment as applying steganography to the Claude Code system context that gets passed to Anthropic’s servers. The relevant code checks the Claude Code base URL environment variable, which is used to route API requests to a proxy or gateway. If the base URL has been overridden, the code then checks the system timezone and whether the hostname matches entries on a list of known Chinese AI labs, other AI companies, account resellers, and gateway domains.

Thereallo’s critique is that the implementation should not have been concealed. He wrote that Claude Code “silently alters the system prompt using invisible-ish Unicode markers,” encoding proxy or gateway classification into a sentence that looks like plain English. He added that it hides the domain list behind XOR and base64, and he emphasized the developer-tool tension: “This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust.”

Anthropic did not immediately answer whether it disclosed this hidden usage tracking mechanism in any terms of service documents. A company spokesperson pointed to Shihipar’s remarks about the experiment’s purpose, but Shihipar’s statements did not address the disclosure question, and the spokesperson did not immediately respond to a request asking what “stronger mitigations” have been implemented to prevent unauthorized resellers and distillation.

To understand why this is a board-level issue, look at the incentives and the time horizon. In February, shortly before the steganographic codes were implemented, Anthropic said it was investing in defenses against distillation. Those defenses, as described in the source, included detection via classifiers and behavioral fingerprinting systems, intelligence sharing with other AI labs, access controls, and countermeasures meant to make it harder to use model output to reproduce the model. Distillation is a core competitive risk because it can turn access to a model into a path to a functional clone through repeated querying.

The stakes are not hypothetical. One defense reportedly came to light when Claude Code source code leaked. The source includes a Typescript file with a flag called ANTI_DISTILLATION_CC. When set, it injects fake tool data into API requests in an attempt to make that data toxic for model training. That detail illustrates a broader industry reality: as model distribution expands through tools and integrations, the boundary between “legitimate routing” and “repeatable extraction” gets blurry fast, and companies are forced to harden their systems, sometimes in ways that are hard for customers to see.

Layer onto that the political climate. Even with technical defenses against competition, Anthropic urged the AI industry, cloud providers, and government to respond to the threat of model distillation. And the source notes a recent White House Executive Order that articulates the intent to protect US AI from foreign adversaries, signaling federal interest in this problem. Put together, Anthropic’s move to remove the hidden steganography markers by July 1 looks like a technical cleanup, but it also sits inside a larger reckoning: how AI providers police access and copying while still maintaining a developer trust relationship.

For executives at AI companies and platform operators, the second-order lesson is simple. Your mitigation strategy is no longer just about effectiveness. It also includes auditability, disclosure expectations, and the reputational risk of “security-through-invisibility.” Anthropic says stronger mitigations replaced the experiment, and it is shutting it down on a defined schedule. Other teams can take note: the next time you try to stop resellers or slow distillation, your controls will likely be scrutinized, and the cost of being clever may show up in the release notes, in a leaked codebase, or in a regulator watching industry behavior.