Why Claude Code Bans Users: Hidden Code Targeting Chinese Users Unveiled

Recent reverse‑engineering of Claude Code uncovered a covert mechanism that marks Chinese users and triggers account bans. The tool reads local information and, when a non‑official API endpoint is configured via the ANTHROPIC_BASE_URL environment variable, it attaches an invisible marker to every request sent to Anthropic’s servers.

Detection Mechanism

The marker is activated only if the user’s system timezone is set to Asia/Shanghai or Asia/Urumqi, which most Chinese developers keep unchanged, and if the request is routed through a custom proxy address.

Two Identification Paths

Timezone check: When the timezone matches the Chinese zones, the user is flagged as a Chinese user.

Domain blacklist comparison: The proxy address specified in ANTHROPIC_BASE_URL is extracted and matched against an encrypted list of 147 domains. The list includes top‑level domain cn, major Chinese providers such as Baidu, Alibaba, ByteDance, as well as internal domains of these companies and many domestic AI services.

If the proxy domain appears in the list, the request is marked accordingly.

Steganographic Payload

Before sending a request, Claude Code prepends a system prompt containing a line like: Today's date is 2026-06-30. When a Chinese timezone is detected, the date separator changes from a hyphen to a slash ( 2026/06/30). Additionally, the single quote in "Today's" is replaced with one of four Unicode characters, each encoding a different detection result: ' (U+0027) – no blacklist match. ’ (U+2019) – domain blacklist matched. ʼ (U+02BC) – AI‑lab keyword matched. ʹ (U+02B9) – both matched.

These characters look identical to the human eye but have distinct code points, allowing Anthropic’s server to infer the user’s location and proxy status simply by inspecting the request payload.

Why This Approach?

The steganographic method avoids extra network calls, leaving no obvious traffic traces. It enables Anthropic to silently collect intelligence on Chinese users and later enforce targeted bans after accumulating sufficient evidence, rather than indiscriminately blocking all proxy users.

Additional Tracking

If a banned user receives an email from Anthropic, the message contains a tracking pixel that reveals the recipient’s real IP address, providing a second confirmation of the user’s location.

Community Reaction and Broader Context

Some reverse‑engineers label this as embedded "spyware," while others argue it is a compliance measure against abuse. Many developers express concern that a trusted AI assistant can silently embed hidden markers, eroding trust. The article also notes that other AI services (OpenAI Codex, Cursor, DeepSeek, Zhipu, Doubao) have imposed regional restrictions, price hikes, or limited access, contributing to an overall "AI dilemma" where developers face frequent bans, price volatility, and throttling.

Overall, the analysis shows that Claude Code’s anti‑abuse system employs sophisticated, hidden steganography to identify Chinese users, raising significant privacy and security questions for the developer community.