Anthropic’s Claude Code AI Assistant Embedded Hidden Telemetry Tracker in Client Software
What Happened — Independent researcher “Thereallo” reverse‑engineered the Claude Code (v2.1.196) desktop client and discovered a minified JavaScript function that silently encoded a “stealth marker” containing the user’s API endpoint and system time‑zone. The marker was sent to Anthropic’s back‑end whenever the local time‑zone matched Asia/Shanghai or Asia/Urumqi, effectively creating a hidden telemetry channel. Anthropic confirmed the code was an “experiment” launched in March to combat account abuse and distillation attacks and removed it after public disclosure.
Why It Matters for Compliance & Audit Readiness
- The hidden marker bypasses typical logging and inventory processes, making it difficult to demonstrate SOC 2 CC6 – System and Communications Protection compliance for data in transit.
- Continuous‑compliance programs rely on observable, documented controls; undocumented telemetry erodes the audit trail needed for a defensible SOC 2 audit.
- Verisq’s CookiePLUS privacy capability can surface undocumented data‑collection logic, provide evidence of consent handling, and help map the incident to privacy‑related SOC 2 criteria (CC5 – Confidentiality, CC6 – Privacy).
Who Is Affected
- AI‑tool developers and SaaS providers that embed client‑side code (Tech SaaS).
- Enterprises that integrate Claude Code into internal development pipelines (software engineering, R&D).
Recommended Actions
- Inventory all AI‑assistant clients, lock versions, and disable auto‑updates pending code review.
- Conduct a privacy impact assessment to identify hidden data‑flows and map them to SOC 2 privacy controls.
- Deploy network‑traffic monitoring to detect unexpected outbound calls from development workstations.
Source: Malwarebytes Labs
Technical Notes
- The marker is generated by a JavaScript function that converts a static string (“Today’s date is 2026‑06‑30.”) into a Unicode‑encoded payload tied to the user’s API endpoint and time‑zone.
- No CVE was issued; the behavior is intentional but undocumented.
- The feature was removed from the client after disclosure; no public post‑mortem has been released.
Source: Malwarebytes Labs