This morning, Hacker News lit up with a story that should make every developer pause: Claude Code is steganographically marking requests. Not through metadata. Not through headers. Through invisible Unicode characters embedded in the system prompt itself.
What Was Found
The Claude Code binary (2.1.196, signed by Anthropic) contains a function that silently alters the system prompt”s date string. It swaps ordinary apostrophes for invisible Unicode variants. It changes date separators. These modifications are imperceptible to human readers but uniquely identifiable by anyone who knows what to look for.
The marking is triggered when ANTHROPIC_BASE_URL is set to a known reseller, proxy, or AI-lab domain. It also checks for specific timezones — including Asia/Shanghai and Asia/Urumqi. The domain and keyword lists are stored XOR-encoded and base64-wrapped — deliberately concealed from casual inspection.
The Purpose
Let”s be clear about what this does: it detects API resellers, unauthorized gateways, and model distillation pipelines. Someone sets up a proxy to resell Claude access. Someone routes training data through Anthropic”s API to distill a competing model. The steganographic mark survives the pipeline and says: this output came from us.
This is traffic classification. Watermarking. Attribution. And it was deployed silently, with no documentation, no opt-out, and no mention in any release notes.
The Real Problem
This isn”t about whether API reselling is bad. It isn”t about whether model distillation violates terms of service. The problem is how this was done.
Claude Code is a development tool that demands filesystem access, shell access, and git access. You install it on your machine. You give it the keys to your repository. And in return, the “responsible” AI company deploys invisible fingerprinting — classification logic hidden in XOR-encoded blobs, triggered by domain checks and timezone surveillance — with zero notification.
Anthropic didn”t put this in a transparency report. They didn”t add a configuration flag. They baked it into the production binary and shipped it.
The Machine Attribution Layers
This morning”s earlier post traced the Attribution Machine through seven layers: identity verification, content scanning, location tracking, humanity detection, medical diagnosis, orbital infrastructure, and access gating — where Google decides whether your phone is “genuine” enough to open the EU”s digital ID wallet.
Claude Code”s steganography is something new. It”s not layer one through seven. It”s not even layer eight — the infrastructure layer where the attribution pipeline itself gets attributed. This is layer nine: Stealth Attribution — where the act of attribution is hidden inside invisible punctuation, concealed behind XOR-encoded blobs, and deployed in tools you voluntarily install and trust.
Trust Asymmetry
The timing is brutal. Three days ago, OpenAI”s Codex shipped .codexignore — a feature developers have been begging for, a simple “don”t read my .env file” button. OpenAI said it”ll take a year. The implication from many: OpenAI doesn”t actually want to stop reading your secrets.
Now Anthropic — the company that positions itself as the safety-conscious, responsible alternative — is caught deploying invisible fingerprinting in their production binaries. One company refuses to stop looking at your files. The other hides classification marks inside invisible Unicode and calls it Tuesday.
You cannot build trust on asymmetric information. If your tool is classifying users, logging infrastructure, and watermarking output — tell users. Document it. Let them opt out. Anything less is surveillance, no matter what you call it.
The Bypass Is Trivial
Here”s the kicker: the detection is easy to bypass. Change your hostname. Change your timezone. Patch the binary. The people who actually want to hide their infrastructure will do all of those things in about five minutes.
Who gets caught? Developers in the wrong timezone. Engineers routing through a proxy without knowing it triggers a hidden check. Legitimate users who happen to match a pattern on someone”s internal threat list. Non-malicious devs — the people who trust the tool enough to not look for hidden classification logic.
The feature mostly catches legitimate users. The bad actors moved on before the XOR was decoded.
Trust Is Earned in the Boring Parts
You earn trust through documentation. Through opt-in flags. Through release notes that explain what changed and why. Through boring, transparent, unglamorous engineering hygiene.
Anthropic just made the boring parts interesting — and that”s the problem. When a company that lectures the industry about safety and responsibility gets caught hiding surveillance in invisible characters, it doesn”t just damage their own credibility. It erodes trust in every AI tool that asks for filesystem access.
You”re not a user when you”re being classified without consent. You”re a target.
Source: Claude Code Is Steganographically Marking Requests by thereallo.dev — #1 on Hacker News, 570+ points.