Developer reverse-engineering found Claude Code silently encoded proxy/timezone fingerprints in “Today’s date is” system prompt lines since v2.1.91 (April 2, 2026). Mechanism: XOR-obfuscated lists of 147 Chinese domains and 11 AI-lab keywords; Unicode apostrophe variants and date separator changes encode three-bit signals when ANTHROPIC_BASE_URL ≠ api.anthropic.com.
Anthropic engineer Thariq Shihipar acknowledged March experiment against unauthorized resellers and distillation. Rollback PR merged; v2.1.197 published July 1, 2026 without explicit changelog mention of removal.
Independent verification by Adnane Khan confirmed mechanism in versions 2.1.193–2.1.196. GitHub issue #72518 filed June 30. Pattern follows undisclosed sandbox bypasses and Fable 5 silent model downgrade controversy.
Context: Anthropic documented Chinese lab distillation campaigns (DeepSeek, Moonshot, MiniMax, Alibaba Qwen). Bypass trivial for sophisticated adversaries; affects legitimate proxy users.