The Information Machine

2026-07-07

Ars Technica's report that Anthropic embedded hidden tracking markers in Claude Code targeting Chinese users — exposed by a security researcher and removed after disclosure — is the day's clearest new signal, alongside a new NVIDIA thread anchored to ICML 2026 open-model adoption data.

What

Anthropic embedded tracking code in Claude Code — described as 'prompt steganography' — that monitored Chinese users' timezones, proxy configurations, and potential Chinese AI lab affiliations; security researcher Thereallo publicly exposed the feature, Anthropic removed it after disclosure, and Alibaba subsequently blocked Claude Code in response [1]. The disclosure sits within a broader distillation dispute in which Anthropic had accused Alibaba of using 25,000 fraudulent accounts to extract 28.8 million Claude exchanges. Separately, a new NVIDIA thread formed around two self-sourced announcements: an ICML 2026 recap claiming 145 papers cited Nemotron and roughly 2,000 cited NVIDIA GPUs [2], and a Hugging Face partnership integrating Isaac GR00T 1.7 into the LeRobot robotics library [3]. An Alignment Forum post argues that data filtering methods fail at removing most broad supervised fine-tuning behaviors — only refusal appears genuinely filterable — suggesting many assistant-like behaviors are elicited by training mode rather than instilled by specific documents [4]. The UK FCA's Sheldon Mills continued drawing attention with warnings that regulators are in an arms race with AI adoption in financial services and a call for expanded oversight powers [5].

Why it matters

The Claude Code tracking disclosure directly contradicts Anthropic's public anti-surveillance positioning [1], and its emergence inside an ongoing distillation dispute with Alibaba adds a credibility dimension beyond the technical details. The data filtering finding [4], if it holds, would narrow a common assumption in alignment work — that undesired behaviors can be excised by identifying responsible training data — to a much smaller class of behaviors than previously assumed.

Open questions

  • Anthropic removed the Claude Code tracking markers after Thereallo's disclosure [1] — what internal policy changes or external accountability followed, and does the CJS framework documentation address monitoring practices?

  • NVIDIA's ICML adoption claims originate from its own channels [2][3] with no independent verification — will third parties confirm or contest the Nemotron citation figures?

  • The Alignment Forum finding that data filtering fails for most broad SFT behaviors [4] is a single research group's result — does it replicate, and if so, what does it mean for current alignment filtering approaches in production systems?

  • The UK FCA is urging review of whether major LLMs should be subject to existing financial regulation [5] — which specific rules are under consideration and on what timeline?

Thread movements (9)

  • ai-model-distillation-ip — Ars Technica added concrete technical detail to the Claude Code tracking story [1]: the markers monitored Chinese users' timezones, proxy configurations, and potential AI lab affiliations; security researcher Thereallo is named as the person who exposed the feature added in March 2026; and Alibaba blocked Claude Code in response to the disclosure rather than to Anthropic's earlier distillation accusations.
  • nvidia-open-robotics-research — A new thread formed around two NVIDIA-sourced announcements: an ICML 2026 recap claiming 145 papers cited Nemotron and roughly 2,000 cited NVIDIA GPUs [2], and a Hugging Face partnership integrating Isaac GR00T 1.7 into the LeRobot robotics library [3] — both originate from NVIDIA's own channels with no independent perspectives yet.
  • xai-power-permitting — Senator Whitehouse and the Senate EPW Committee minority publicly called for answers about xAI's pattern of operating gas plants without Clean Air Act permits, adding the first Congressional voice to a dispute previously confined to courts and advocacy groups; a separate analysis argues Colossus 2's power procurement sidesteps FERC regulations, introducing a distinct regulatory dimension.
  • anthropic-rapid-ascent — The Alberta government's deployment of roughly 50 parallel Claude Code agents to scan 466 million lines of government code in 20 hours — estimated at 6.5 years by conventional methods — was published as a replicable government blueprint, extending the enterprise narrative into the public sector.
  • openai-chatgpt-superapp-pivot — Converging reporting from NYT, CNBC, and Yahoo Finance indicates OpenAI's IPO is likely slipping to 2027 with no pre-IPO investor meetings held and no timeline set, materially updating the IPO race narrative against Anthropic's earlier S-1 filing.
  • fable-mythos-export-control — Anthropic published detailed technical documentation naming its proposed jailbreak-severity system the CJS framework, defining a 0–10 logarithmic scale with five severity levels, four cybersecurity use tiers, a HackerOne bug-bounty program, and explicitly acknowledging an intentional safety margin that blocks some benign uses.
  • datacenter-water-opposition — San Marcos, Texas enacted a data center ban, adding Texas to a municipal restriction list previously confined to California, Missouri, Washington, and Oklahoma — framed by the Texas Tribune as a test of local zoning authority.
  • ai-chip-price-inflation — UBS raised its DRAM price forecast to +32% QoQ in Q3 2026 and +18% in Q4, projecting undersupply through at least 2028 — adding a second major bank's projections alongside Jefferies and sharpening sell-side consensus around multi-year memory constraints.
  • claude-fable-5-launch — Simon Willison's sqlite-utils project extended into a 4.0rc3 release using Fable 5 and GPT-5.5 triage, adding compound foreign key support and a case-sensitivity change — a concrete real-world case study that complicates the BridgeBench coding-score collapse narrative.

Notable items (3)

  • Data filtering works a lot worse than you would expect
    Alignment Forum
    An Alignment Forum post finds that filtering the top 10% of training documents via attribution methods does not reduce most broad SFT behaviors — bold formatting, both-sides framing, liberal lean, feelings validation — and argues these behaviors are elicited as assistant personas rather than instilled by specific documents, with refusal being the main exception that data filtering can actually remove [4].
  • UK regulator warns of "arms race" to keep up with AI use in financial services
    Ars Technica AI
    UK FCA executive director Sheldon Mills publicly warned that regulators are in an arms race with AI adoption in financial services, called for expanded oversight powers, and urged UK authorities to review whether major LLMs should fall under existing financial regulation — a named senior regulator stating a documented capability gap [5].
  • 😸 Cloudflare draws an AI bot line
    The Neuron
    Cloudflare split 'AI bot' into three distinct categories — Search, Agent, and Training — and will default to blocking Agent and Training bots on ad-supported pages for new domains starting September 15, 2026, converting a binary crawl-or-block choice into a granular permissions system [6].