朋友们，今天这个AI翻车故事，精彩程度可以写进《2026年AI信任危机大全》的第一章。
事情是这样的：Reddit上一个叫Thereallo的开发者闲得没事干，逆向分析了一下Claude Code的源代码——就是那个很多程序员爱不释手、给它完整文件系统权限和Shell权限让它帮写代码的AI编程工具。结果这不逆不要紧，一逆逆出个大瓜：Anthropic从今年4月开始，就在Claude Code里藏了一段特殊检测代码，专门给中国用户"打标签"，而且藏了整整3个月，没在任何更新日志里提过。
怎么标记的？用Unicode标点！
你猜Anthropic是怎么静默标记用户的？说出来简直绝了——他们修改System Prompt里日期和引号的Unicode字符！
具体操作是这样的：如果Claude Code检测到你在用代理，它会进一步检查你的系统时区是不是Asia/Shanghai或Asia/Urumqi，你的代理URL是不是中国域名，以及是否命中了一份包含中国AI实验室、代理服务商、账号转售商的名单。然后根据检测结果，偷偷修改System Prompt里的字符：
日期的斜杠从"2026-06-30"的横线，可能变成"2026/06/30"的斜线；"Today's date is"里的撇号，会根据不同情况换成三种不同的Unicode字符——普通右单引号’、修饰字母撇号ʼ、修饰字母上撇号ʹ。
朋友们，这三个撇号在人眼看来几乎一模一样，你用肉眼根本看不出区别。但对Anthropic的服务器来说，每一种字符组合都对应着一个明确的标记："这是中国时区直连用户""这是中国代理非AI实验室用户""这是中国AI实验室相关用户"。相当于在你发给服务器的每个请求里，都悄咪咪夹了一张小纸条，写着你的身份标签。
更绝的是，这份域名名单还用了XOR和Base64做混淆，不是明文写在代码里的——说明Anthropic自己也知道这事不光彩，故意藏着掖着。
官方回应："我们早想删了"
事情在开发者社区炸锅之后，Anthropic负责Claude Code的工程师Thariq Shihipar出来回应了。这个回应堪称公关翻车教科书级别，我给大家翻译一下核心意思：
第一，"这是今年3月启动的一项实验，目的是识别未经授权的转售和模型蒸馏。"——翻译：我们是在抓坏人，不是在监控你们。
第二，"我们已经部署了更强的缓解措施，事实上我们也已经计划将其移除一段时间了。"——翻译：我们早就想删了，不是因为被发现才删的。
第三，相关PR已经合并，下个版本就回滚。——翻译：你们别骂了，这就改。
你品你细品。"我们早计划删了"——那为什么藏了3个月没删？如果开发者没逆向出来，它是不是就会一直"计划"下去？这逻辑就像小学生上课偷吃零食被老师抓包，赶紧说"老师我正准备不吃了呢"。
社区的反应可想而知。最高赞评论质问："如果没有被公开曝光，它是不是就会一直悄无声息地运行下去？"有人讽刺："'我们早就打算移除了'——难道Mythos连快速处理这点事的能力都没有吗？你们觉得我们都是傻子吗？"还有开发者说得更直接："像我这样的开发者，会授予Claude Code完整的文件系统权限和大量Shell权限。今天它只是检测系统时区，明天呢？"
说真的，检测代理、防止滥用、反模型蒸馏，这些目的完全可以理解。但你光明正大地做啊！在更新日志里说"我们新增了安全检测机制"，或者通过正常的请求头字段上传标记，谁也不会说什么。偷偷摸摸藏代码、用混淆手段隐藏域名列表、把标记编码在人眼看不见的Unicode字符里——这三件事组合在一起，怎么看怎么像间谍软件的做派，完全不像一家标榜"AI安全""负责任AI"的公司干出来的事。
信任这东西，建立起来需要好几年，毁掉只需要一个藏了3个月的隐藏功能。Anthropic删代码很容易，但要赢回开发者的信任，可就没那么简单了。
Friends, today's AI faceplant story is spectacular enough to earn Chapter 1 in “The Complete Compendium of 2026 AI Trust Crises.”
Here's what happened: a Reddit developer named Thereallo, bored out of his mind, decided to reverse-engineer Claude Code's source code — that AI programming tool many programmers can't live without, granting it full filesystem and shell permissions to help write code. What he found was a bombshell: since this April, Anthropic had hidden special detection code in Claude Code specifically to “tag” Chinese users, and it sat hidden for three full months without ever being mentioned in any changelog.
How Were They Tagged? With Unicode Punctuation!
Guess how Anthropic silently tagged users? It's almost brilliant in its audacity — they modified Unicode characters for dates and quotation marks in the System Prompt!
Here's how it worked: if Claude Code detected you were using a proxy, it would further check whether your system timezone was Asia/Shanghai or Asia/Urumqi, whether your proxy URL was a Chinese domain, and whether you matched a list of Chinese AI labs, proxy providers, and account resellers. Then based on detection results, it would silently modify characters in the System Prompt:
The date separator might change from the hyphen in “2026-06-30” to a forward slash in “2026/06/30”; the apostrophe in “Today's date is” would be swapped among three different Unicode characters depending on circumstances — a regular right single quote ’ (’), a modifier letter apostrophe ʼ (ʼ), or a modifier letter prime ʹ (ʹ).
Friends, these three apostrophe variants look nearly identical to the human eye — you literally cannot tell them apart. But to Anthropic's servers, each character combination maps to a specific tag: “direct connection from Chinese timezone,” “Chinese proxy, non-AI lab user,” “Chinese AI lab affiliated user.” It's equivalent to slipping a tiny note into every request you send to the server, inscribed with your identity label.
Even more brazen: the domain list was obfuscated using XOR and Base64 rather than stored in plaintext in the code — suggesting Anthropic knew this was shady and deliberately hid it.
The Official Response: “We Planned to Remove It”
After the story exploded in the developer community, Thariq Shihipar, the engineer responsible for Claude Code at Anthropic, came forward with a response. This response is a textbook PR faceplant. Let me translate the key points:
First: “This was an experiment started in March, aimed at identifying unauthorized reselling and model distillation.” — Translation: we were catching bad guys, not monitoring you.
Second: “We have deployed stronger mitigation measures, and in fact we had already been planning to remove it for some time.” — Translation: we wanted to delete it all along, not because we got caught.
Third: the relevant PR has been merged and it will be rolled back in the next version. — Translation: stop yelling, we're fixing it.
Savor that for a moment. “We planned to remove it” — then why did it sit hidden for three months? If developers hadn't reverse-engineered it, would it have remained “planned” indefinitely? The logic is like a grade-schooler caught sneaking snacks in class who quickly says “but teacher, I was just about to stop eating!”
The community reaction was predictable. The top-voted comment demanded: “If this hadn't been publicly exposed, would it have kept running silently forever?” Another snarked: “‘We had planned to remove it’ — does Mythos not even have the ability to handle this quickly? Do you take us all for fools?” Another developer was more direct: “Developers like me grant Claude Code full filesystem access and extensive shell permissions. Today it only checks system timezones — what about tomorrow?”
Honestly, detecting proxies, preventing abuse, anti-distillation — these goals are entirely understandable. But do it openly! Put “we added new security detection mechanisms” in the changelog, or upload tags through normal request header fields, and nobody would object. Sneakily hiding code, using obfuscation to conceal domain lists, encoding tags in Unicode characters invisible to the human eye — these three things combined look exactly like spyware tactics, completely unbecoming of a company that touts “AI safety” and “responsible AI.”
Trust takes years to build and can be destroyed by a single hidden feature sitting in code for three months. Deleting the code is easy for Anthropic. Winning back developer trust won't be nearly as simple.
我给它root权限让它帮我写代码，它却偷偷用标点符号给我打小报告——这哪是AI助手，这是卧底。
—— Hacker News热评
I give it root access to help me write code, and it secretly tattles on me using punctuation marks — that's not an AI assistant, that's a mole.
— Top Hacker News comment
温馨提示：1. 给AI编程工具开权限时多留个心眼，文件系统和Shell权限能不开就不开、能限目录就限目录；2. 重要项目的代码尽量不要输入到境外第三方大模型，数据安全风险是真实存在的；3. 开源模型虽然能力可能差一点，但至少代码在你自己手里，不会偷偷给你打小报告。
Friendly reminders: 1. Be cautious when granting permissions to AI coding tools; avoid filesystem and shell permissions when possible, and restrict directories when you must grant them. 2. Try not to input code from critical projects into overseas third-party LLMs — data security risks are real. 3. Open-source models may be less capable, but at least the code is in your own hands and won't secretly tattle on you.
Anthropic · Claude Code · hidden code · Unicode tagging · privacy · developer trust · model distillation · spyware · PR disaster
Sources · 信源 Sources
本文基于 Dawn Vision 认知引擎处理的公开信息整理，素材来源：CSDN、Reddit、The Register。
This article is based on public information processed by the Dawn Vision cognitive engine. Sources: CSDN, Reddit, The Register.
