Why is Anthropic racist?

If you rely heavily on overseas AI tools while living in China, you have probably long since grown used to being treated like a kind of cyber second-class citizen.

You need a clean proxy node. You need a foreign credit card. You constantly worry that the account you painstakingly kept alive might be swept up and banned in the next round of risk control.

But what Anthropic has done this time still exceeded my imagination.

On June 30, 2026, in Reddit’s r/ClaudeCode community, a user posted a bluntly titled thread: Claude Code is tagging you.

The poster, LegitMichel777, said that starting with Claude Code v2.1.91, once the tool is connected to a proxy server and the system decides you are “related to China,” it quietly rewrites the punctuation you type in every single request. [1]

How subtle is it? Developer thereallo took the client code apart and reverse-engineered it: the hyphen in dates is changed from “-” to “/”; an ordinary apostrophe in a sentence is replaced with a Unicode variant that is almost indistinguishable to the human eye. [2]

The post reached the front page of Hacker News and got 605 points. The comment section exploded.

My first reaction was honestly to laugh. A company that puts “safety” on its storefront, an AI lab that presents itself as the one institution in the universe most concerned about the fate of humanity, had gone to all this trouble to plant an invisible fingerprint in text, specifically to mark “this person may be related to China”—only to be caught by an extremely boring, punctuation-specific quirk.

But after laughing, I felt genuinely uncomfortable—almost physically nauseated. Because instead of openly stating “entities related to China are prohibited from using this product,” Anthropic chose to knowingly hide what it was doing.

Many organizations in history have done similar things. The closest comparison to Anthropic is the Nazis: stamping a “J” on Jewish passports and telling people, it is just a symbol, nothing to worry about.

This essay is not about privacy. Privacy is too small a frame for what happened here. What Anthropic did goes much deeper than privacy: it is not merely collecting your data; it is defining your identity.

It is a system of judgment that begins not from “what did you do,” but from “who are you.”

1. Sending information through an apostrophe

For the discussion that follows, we first need to restate the technical details described by LegitMichel777. If you already know them, you can skip the next few paragraphs.

The trigger conditions for Claude Code’s discriminatory logic are so specific that you can almost see the calculating face of the person who wrote the line: the environment variable ANTHROPIC_BASE_URL is set, meaning the request is going through a proxy; and the system time zone is Asia/Shanghai or Asia/Urumqi.

Once those conditions are met, Claude Code does two things: it forcibly changes date formatting in requests from 2026-06-30 to 2026/06/30; and it changes the normal apostrophe ' into a Unicode variant. If a domain blacklist is matched, it becomes \u2019; if a “Chinese lab keyword” is matched, it becomes \u02BC; if both are matched, it becomes \u02B9. [2]

To the naked eye, these characters are nearly indistinguishable. Put them into any ordinary text editor and you would assume you are looking at a standard English right single quotation mark. Their difference exists only at the byte level. Only someone who knows how to read Unicode tables—or Anthropic’s servers receiving the data—would notice.

And that is not all. How were the domain blacklist and keyword list hidden? They were first base64-encoded, then obfuscated with XOR using the key 91. The decoded keywords include deepseek, moonshot, minimax, zhipu, baichuan, stepfun, 01ai, and dashscope—almost a roll call of every major Chinese large-model company. [2]

This was absolutely not “just a quick line of logic someone wrote in passing,” nor could it have been an intern at Anthropic slipping up. It was a system engineering effort: first write a list; then encode the list; then obfuscate the encoded result; then embed the obfuscated result into the product and let it run while the user remains completely unaware.

Every step in that process was a deliberate decision. Every step had to pass through code review.

That is why I cannot summarize Anthropic’s behavior here as “bias.” I have to call it “discrimination.” Algorithmic bias may arise from unconscious sample skew in data. Discrimination means an active decision.

And what happened inside Claude Code had both a subject and agency.

Someone wrote an if statement to decide who you are. Someone selected the list of companies to flag. Someone decided to hide that list instead of putting it into clause whatever of the user agreement. Someone tested that this watermark would not be visible during normal use. Each of those “someones” corresponds to a real role: the product manager who proposed the feature, the tech lead who approved it, the colleague who clicked Approve in code review, the release manager who pushed that version into production.

I know the tech industry does not like hearing the word “complicity,” but that is exactly what this is.

You can say that what Claude Code is doing right now is merely putting an invisible watermark into a request. It has not beaten you, arrested you, or frozen your account. That is true. But open a history book: every large-scale exclusion begins as “let’s just record it first.” As for what happens once the registry is built—that is never decided solely by the people who wrote the registry. The people who write the registry merely hand over decision-making power in advance to some future user of the list, or to some future deranged policy.

I can even imagine Anthropic’s internal reasoning. They probably believe they are carrying out a legitimate form of commercial defense: these Chinese AI companies are indeed engaging in “abnormal competition”; they are indeed “distilling” Anthropic’s models; therefore marking them, collecting some data, and leaving an option open is a reasonable response.

But the problem is that large models are, by their nature, transparent to the backend in terms of usage behavior. In theory, Anthropic can solve every case of “non-compliant use” through behavioral detection, rather than by defining a class of “non-compliant people.”

The fact that Anthropic used a hidden method to transmit signals about user identity only further proves that Anthropic itself knows this classification is not legitimate. If it truly believed the practice was proper, correct, and just, it could do what Stripe does—and what any global internet financial company does—and conduct real KYC using valid identity documents. Instead, it secretly identifies “this person may be Chinese” and secretly sends that signal back to headquarters.

As of today, Anthropic still has not publicly responded to this accusation. Silence is the most arrogant posture.

My guess is not that they do not want to respond. It is that they cannot. To explain why the watermark was planted would be to admit that the watermark exists. To explain whom it was planted for, and by what criteria someone is judged to be “related to China,” would be to lay a discrimination list on the table for the whole world to see. By not responding, they can at least hide behind “no comment” and pretend the event does not exist.

But it will not disappear just because they refuse to respond. The code has been decompiled. The XOR key has been made public. The domain list has been spread across GitHub for the world to inspect. Anthropic’s silence is not the end of the crisis. It only means they have not yet found an explanation that looks less ugly.

2. Definition is violence: from skulls to time zones

In modern language, the word “violence” too easily makes people think first of guns, concentration camps, and gas chambers. But historians of genocide have long shared a basic understanding: the step that determines who will be killed often happens many years earlier, on a piece of paper, in a calm and unremarkable act of registration.

In 1935, Nazi Germany enacted the Nuremberg Laws. The first thing those laws did was not to arrest people. It was to redefine “who is a Jew.” Before that, the identity still carried, to some extent, religious and cultural meaning: if you practiced Judaism, you were Jewish; if you converted, perhaps you no longer were. After the laws, identity became pure arithmetic of descent: how many of your four grandparents were Jews, which category of “Jew” or “Mischling” you fell into, and whether you were one-quarter or one-half Jewish. [3]

In practice, this classification table produced absurdities. A person might never have entered a synagogue, might eat pork and drink beer, might even have been baptized as a Christian—but if the file said one of his grandparents was Jewish, then legally he was Jewish. Conversely, a devout rabbi whose four grandparents happened to include only three classified as Jewish by descent might be placed into “first-degree Mischling” and, at least temporarily, keep his job and property. Religion, culture, and self-identification all became invalid before the table. The only reality was the four boxes in the ancestry file.

Drawn out, the classification table looked like a genetics homework assignment. Extremely precise, extremely bureaucratic, extremely cold. Its coldness lay in this: once you were placed into a box, whether you could go to school, practice medicine, marry, or keep property all followed from that box. No one needed to look again at who you actually were. Your soul no longer mattered. Your composition determined everything.

Stamping a “J” on a passport was merely the final and most visible product of that classification table. The real work had already been done by the table. The civil servant applying the stamp was just executing a classification completed earlier.

But to apply classification to millions of people, handwritten registries were not enough. At that point, an American technology giant helped: IBM.

Through its German subsidiary Dehomag, IBM provided the Nazi government with Hollerith punch-card tabulating systems. The 1933 census used this system—not merely to count heads, but to cross-reference people by dimensions such as “race,” “religion,” and “occupation.” Historian Edwin Black reconstructed this chain in detail in IBM and the Holocaust: census data mapped the distribution of Jewish populations, ghetto residents were counted one by one, and in the camps, prisoners’ complex lives were compressed into five-digit numbers printed on badges and tracked through punch-card systems for labor allocation. [4]

The classification system arrived before extermination; only then could extermination become “industrialized.” Without the predecessor technology of Silicon Valley’s future world, that machinery of violence could never have achieved such efficiency.

Black records a detail in the book that should make anyone shudder: IBM did not merely sell the machines. It sent engineers to Germany to maintain them, inspect them regularly, and ensure that the punch-card system continued to run smoothly. In other words, IBM knew what its client was doing with these machines from beginning to end. It did not stop. Because business was business.

Inside the concentration camps there was also an entire color-coded marking system: the colors and positions of triangular badges indicated whether you were a political prisoner, a Jew, or an “asocial” person. Administrators could tell at a glance. Prisoners often could not understand what had been attached to them. [5]

This is the key point: the readability of the mark is asymmetric. The people who write the mark can read it. The people who are marked cannot.

Now place that logic next to Claude Code, unchanged.

Claude Code checks whether your time zone is Asia/Shanghai. That is the same gesture as a Nuremberg-style census of residence or ancestry, except the object of the census has changed from “what people were your ancestors” to “where is your system clock set.” The apostrophe is changed into a Unicode variant. That is the same gesture as the camp triangle that only administrators could read, except the carrier has changed from fabric on clothing to bytes in network transmission.

One is ink stamped on paper. The other is a glyph substitution so subtle it approaches zero-width invisibility. Technically, the two are separated by roughly ninety years of media evolution. Logically, they are the same thing: first build a file on you, then decide how to use that file—and you, the marked object, never know that you have already been recorded.

I know some people will find this alarmist: it is just an apostrophe, must we really compare it to Nazis and concentration camps? Yes, we must.

Because I am not comparing the degree of violence. I am comparing the institutional design. The Nazi color-code system did not need the crematoria to exist. It was already an independent, complete, self-consistent apparatus of classification.

Even if the later mass murder had not occurred, that color-code system would still have constituted a form of violence. It deprived the marked person of the right to narrate their own identity. Anthropic’s watermark does the same. You do not need to wait for the day when Anthropic hands this database to a government before saying it is wrong. The act itself has already crossed the line: it classifies you without your knowledge and permanently records that classification in your request stream.

Here is another comparison, even more glaring: Germany used ancestry to prove “purity,” the United States used skin color to prove “purity,” and Anthropic uses time zones and domains to prove “safety.” On the surface, the three systems care about completely different things—race, skin color, geopolitics. Underneath, they use the same damn bureaucratic toolbox: first draw a category of the “other,” then attach an executable rule set to that category, and finally let the rules run automatically until no one needs to make another moral judgment.

That is what makes classification systems truly terrifying. They do not need the executor to hate you. They only need the executor to fill in fields according to a product manager’s spreadsheet.

Anthropic’s engineers probably did not write that if statement with racial hatred in their hearts. That is precisely the problem. Evil no longer needs hatred as fuel. It only needs a requirements document, and an employee willing to implement the requirements while giving up the habit of asking why.

3. One drop of blood and one domain name

If Nazi taxonomy was barbaric and theatrical, the American system of racial segregation perfectly demonstrated another possibility: barbarism does not need to be theatrical at all. It can even be packaged as an administrative process.

The “one-drop rule” means exactly what it says: if a person had even “one drop” of Black ancestry—even if only one ancestor eight generations back was Black—then legally that person should be classified as Black. This was not a folk saying. It was a formal rule written into the laws of multiple American states. Academically, it is called hypodescent. [6]

The strangest thing about this rule is not its obvious discrimination. It is that it handed the question of “who you are” entirely to the pen in an official’s hand. In Virginia, a registrar named Walter Plecker, relying on the Racial Integrity Act, could unilaterally reclassify entire mixed-race families into the archive as “Black.” These families may have lived as white for generations, but with one document from Plecker, their identities were forcibly rewritten. No court. No appeal. A form was the final judgment. [7]

The power to define is the power to do violence. You do not need to beat someone in the street. You only need the authority to decide “what kind of person” they are. The rest of the violence will be carried out automatically by the gears of society.

Another signature product of segregation was redlining. In the 1930s, the federal Home Owners’ Loan Corporation drew risk-rating maps for major American cities and used red ink to mark “hazardous” neighborhoods. Communities where minorities lived were, unsurprisingly, almost all drawn into the red zones. Banks followed these maps when issuing loans. Residents of redlined areas were denied mortgages for decades, and wealth accumulation was physically locked out at the level of geography.

This map was not public humiliation. It did not need to be hung on anyone’s front door. It sat quietly in the file cabinets of banks and government agencies, deciding whether an entire generation could buy homes, accumulate assets, or pass houses on to their children. Walking down the street, you could not see that the street had been marked red. You would simply discover that whenever you applied for a loan, you were somehow always rejected.

Over the thirty years during which this rule operated, a whole generation of Black American families was locked out of wealth accumulation, while their white neighbors—with the same income level and the same ability to repay—obtained loans, bought homes, and passed the appreciation of those homes to the next generation.

A significant portion of today’s wealth gap between white and Black Americans can be traced directly back to those maps. Decades after their abolition, they still haunt the balance sheets of the next generation. This is the true power of hidden classification: the harm does not occur at the moment of marking; it occurs in every apparently neutral “normal process” that follows. The bank never had to write the word “Black” on your loan application. It only had to check your address, check the map, and move your file into the “do not approve” pile.

The sign reading “Colored” above a drinking fountain was public, humiliating, and glaring; it is the image of segregation most easily remembered. But redlining maps tell us a colder fact: the exclusion that truly determines fate often needs no sign. It hides in procedures, in rating tables, in files no one will voluntarily show you.

That was the image that first came to mind when I saw Anthropic’s XOR-obfuscated domain blacklist.

Base64 encoding plus XOR obfuscation with key 91: functionally, this process is exactly the same as a redlining map. It takes a list of “who should be treated differently” and converts it from publicly visible to covertly executable. It is not written into the user agreement. It does not appear in any product documentation. It lies deep inside the code, quietly deciding whether your request will be silently rewritten.

From the drinking-fountain sign to the Unicode watermark, the only thing human civilization seems to have improved is concealment: the efficiency of exclusion has increased, while the visibility of exclusion has dropped to zero.

If all this remained a piece of technical gossip in an open-source community, perhaps it could still be filed under “a product design controversy at one company.” But just over a month earlier, this logic had already escalated from code into state action.

On June 12, 2026, the U.S. government ordered the suspension of access to Anthropic’s Fable 5 and Mythos 5 models for all foreign nationals, citing national security. Pay attention to the wording of the official statement: whether the person was inside or outside the United States, even Anthropic’s own foreign-national employees were cut off. [8]

Here we need to explain the legal logic behind this directive, because there is almost no equivalent concept in the Chinese-speaking world: in the U.S. export-control system, there is a concept called “deemed export.” It means that providing controlled technical information to a foreign person—even if that person is sitting in a luxurious office in Silicon Valley, and even if they hold a valid U.S. work visa—is legally equivalent to exporting that technology directly to that person’s home country. The criterion is not where the person is located. It is not which company they work for. It is not the jurisdiction in which the data center sits. The criterion is only one thing: who they were born as.

Among those cut off by this directive was even Andrej Karpathy—a researcher known throughout the AI world, holder of an EB-1 green card for “extraordinary ability,” and long since a U.S. permanent resident. He had done nothing specifically wrong. He had, in fact, made enormous contributions to the American AI industry. But the sole reason he was kept outside the door was his place of birth.

Is this not the 2026 version of the one-drop rule? The criterion has merely changed from “blood proportion” to “national origin.” Once judged “impure,” even if you stand in the heart of the empire and hold an elite-talent green card, it does not help. Anthropic ultimately went with the flow and took the two products offline globally in the name of compliance.

I need to insert a clarification here to avoid being read as contradicting myself. I previously wrote an essay titled “AI Should Have Passports Too”, arguing that AI systems should have a transparent and accountable national identity. At first glance, these two essays may seem to contradict each other: one appears to assign nationality to AI, while the other questions differential treatment based on nationality.

But they are actually two sides of the same logic. “Nationality” as a public rule is not itself the problem: it is written into law and visa forms; you know that the rule exists, and you know how you will be treated. That is an order that can be argued over, revised, and appealed in public—a passport-like order.

What Anthropic did inside Claude Code is completely different. It did not tell you what the rule was. It did not even tell you that the rule existed. Your time zone and the domains you connect to are secretly converted into a judgment about “who you are.” Whether that judgment affects you, and how, you cannot know and cannot appeal.

To explain this through a traumatic memory familiar to modern Chinese history, Anthropic’s behavior is less like issuing a visa on your passport and more like issuing a “liangminzheng”—a “good citizen certificate” used by occupation authorities to certify that a subject was “temporarily not a problem.” The power to issue or revoke it lies entirely in the occupier’s hands, and it can be taken away at any time because of a rule you cannot see.

A passport-like nationality order can at least be shouted about in public. A “good citizen certificate”-style hidden classification does not even give you the right to shout.

I know some people will certainly jump out to defend this and say that national security concerns are not the same as racial segregation: one concerns technology controls, the other racial hatred; the motivations are worlds apart. I agree with only half of that.

The motivations are indeed different. No politician can stand in Congress in 2026 and shout about “blood purity.” Even with global politics turning rightward, that language is still taboo.

But the one-drop rule and deemed export rely on the same underlying logic: do not ask what you did; ask who you were born as. Give you no room to defend yourself, because your identity itself is treated as evidence of original sin.

We tend to think the evil of segregation lay in the fact that it was public, humiliating, and glaring. But the most efficient systems of exclusion have never needed theatricality. They happen quietly. The excluded person may not even notice that they have been sorted into another box—until one day a loan is denied, a request is silently rewritten, or an account is cut off outright. Only then do they belatedly discover that a table had long ago placed them on a list of people to be “handled.”

Anthropic chose exactly this most efficient, and most disgusting, quiet path.

4. In the name of safety

The name Anthropic originally points toward Claude Shannon, the father of information theory; “anthropic” also suggests a concern with human beings. The company’s flagship product is called Claude. From the very moment of naming, this entire brand narrative—glowing with idealism—has been preaching to the world: we are the AI lab that cares most about safety, alignment, and the welfare of all humanity.

They even proposed a training method called Constitutional AI: give the model a “constitution,” and let it constrain and revise itself according to a supposedly universal set of values written down in advance. CEO Dario Amodei has spent years speaking in public like a missionary about “AI safety,” “alignment with human values,” and “responsible scaling,” almost welding those phrases onto the company logo.

This narrative has been repeated for so many years that everyone’s ears are nearly calloused, and almost no one takes a step back to ask the most basic question: safety for whom?

The same company can write grand statements on its official blog about “aligning AI systems with human values,” while embedding code in a client product more hidden than a Trojan horse, specifically to silently change punctuation for users “related to China.”

And this is not the only contrast. Earlier this year, Anthropic wrote to the U.S. Congress, loudly accusing Chinese peer Alibaba of “distilling” and stealing the capabilities of Anthropic’s models through improper means. The drama here is obvious: “distillation” is a widely used technique in the AI industry. The open-source community distills from one another every day. Anthropic itself was hardly shy about training on public datasets at its founding. But once the object of “distillation” becomes a Chinese company, it is immediately elevated into an accusation on the level of stealing national secrets and written into a formal letter to Congress.

Anthropic has also repeatedly published reports accusing Chinese state actors and companies of using Claude for malicious activities that violate U.S. law or Anthropic’s own terms of service. But the biggest difference between rule of law and racial discrimination is that punishment should be based on behavior, not identity.

If we translate Anthropic’s logic into another domain, it becomes very clear: we have found that people of color make up a higher proportion of criminals in a certain region; therefore, we conclude that all people of color are criminals and impose stricter restrictions and surveillance on them.

In other words, Anthropic does not actually care whether you have violated its user agreement, or what improper things you may have done with AI. As long as you can prove that you are a real American holding a U.S. passport, then even if you do those things, your account will not be banned.

That logic would probably be impermissible in any modern jurisdiction, regardless of ideology. It touches a deeper consensus of modern civilization.

Add to that the Fable 5 blockade mentioned earlier, aimed at all foreign nationals worldwide—even the company’s own core employees.

Looking at these three things together, the company’s “alignment with human values” is clearly trying to exclude some humans from the definition of “human.”

The formal name of the Nuremberg Laws was the “Law for the Protection of German Blood and German Honor.” The most common self-justification of segregation was “protecting racial purity” and “maintaining social order.” Today, in the tech industry, the phrase occupying the same grammatical position is “AI safety.”

“Safety” is the best and cheapest moral cloak humanity has invented so far. In many situations it is indeed important. In many others, it is the most convenient excuse.

You do not need to tear off the mask and say, “I hate this specific group.” You only need to furrow your brow and say, “This is all for safety.” The remaining exclusion, monitoring, separation, and blockade can then proceed naturally, openly, and even win a round of applause on Twitter.

More importantly, Anthropic is not a victim forced by government regulation to change its product. It is actively encouraging, and even getting ahead of, governmental intervention in geopolitics, using this kind of supposedly self-restrictive behavior as a bargaining chip in commercial competition. This is not reluctant compliance. It is deliberate active wrongdoing.

For an ordinary user, this is the most surreal and powerless part of the entire affair. You may not care at all about U.S.-China rivalry. You may not even read political news. You may just be sitting at your computer late at night, trying to use a programming tool to meet a deadline. As a result, your input is quietly marked and quietly rewritten merely because you happen to use a China time zone and happen to connect to a domain they placed on a blacklist.

The crushing force of geopolitics no longer requires you to enlist. Like a diligent machine, it will proactively count you as part of the battlefield.

Disclosure: The author has not subscribed to Claude’s official paid plans or any unauthorized third-party Claude relay service since 2022. This essay was not written out of resentment over a personal account ban.