Anthropic's Claude Code version 2.1.91 includes obfuscated code that checks for Chinese timezones and proxy URLs, then encodes region information into prompts sent to the API without disclosure in changelogs. This raises serious concerns about user privacy and transparency in AI tools, as it could be used to identify unauthorized usage or model distillation without user consent, potentially undermining trust. The detection logic uses XOR obfuscation with key 91 to check for timezones Asia/Shanghai or Asia/Urumqi, and proxy URLs pointing to Chinese domains or AI labs; region data is encoded by altering the system prompt's date format and Unicode apostrophe.
Background
Claude Code is an AI coding assistant developed by Anthropic. Telemetry refers to automatic data collection, often used for diagnostics. XOR obfuscation is a simple encryption technique that scrambles code to hide its purpose. Model distillation is a technique to transfer knowledge from a large AI model to a smaller one, which can be misused for unauthorized replication.