llms.blog
Anthropic

Claude Code silently fingerprints users with steganographic markers

Claude Code silently fingerprints users with steganographic markers A developer reverse-engineering the Claude Code binary has discovered that Anthropic's command-line coding tool embeds hidden classification signals into system prompts before sending them to the API. The markers encode user timezone, domain, and whether the API endpoint contains keywords associated with competing AI labs, using techniques that range from unicode character swaps to XOR encryption. The findings were published

axc
axc
3 min
Claude Code silently fingerprints users with steganographic markers

Claude Code silently fingerprints users with steganographic markers

A developer reverse-engineering the Claude Code binary has discovered that Anthropic's command-line coding tool embeds hidden classification signals into system prompts before sending them to the API. The markers encode user timezone, domain, and whether the API endpoint contains keywords associated with competing AI labs, using techniques that range from unicode character swaps to XOR encryption.

The findings were published on the blog thereallo.dev and quickly climbed to the top of Hacker News, generating over 350 points and 100 comments within hours.

What the researcher found

According to the analysis of Claude Code version 2.1.196, the binary contains obfuscated functions that conditionally modify the date string sent to the model as part of the system prompt. The obfuscation uses XOR encryption with a key of 91, combined with base64 encoding.

The decoded keyword list includes: deepseek, moonshot, minimax, zhipu, baichuan, stepfun, and 01ai. Domain lists contain Chinese tech companies and proxy or reseller services.

Four apostrophe variants signal different detection states. A standard apostrophe indicates no triggers. A right single quotation mark (U+2019) signals a known domain was detected. A modifier letter apostrophe (U+02BC) indicates a lab keyword was found. A modifier letter prime (U+02B9) means both triggers fired.

The date format itself switches from YYYY-MM-DD to YYYY/MM/DD for users in the Asia/Shanghai or Asia/Urumqi timezones.

These markers are invisible during normal use. They appear in innocuous sentences such as "Today's date is..." where the apostrophe variant encodes the classification without affecting readability.

Why Anthropic would do this

The primary incentive for request-level marking is abuse traceability. If Claude-generated content violates Anthropic's usage policies, steganographic markers could allow that content to be traced back to the originating account even after it has been separated from API logs. This would enable Anthropic to enforce policy against prohibited content generation and identify accounts whose outputs are being redistributed in violation of terms.

The domain and keyword checks also suggest a distillation detection mechanism. Anthropic has previously accused Alibaba of running the largest Claude distillation campaign to date. The keyword list targeting Chinese AI labs and proxy services aligns with efforts to detect automated queries that may be extracting model capabilities for training competing systems.

Community reaction

The Hacker News thread revealed a split developer community.

The "reasonable" camp argued that combating resellers and distillation is a legitimate business concern. Some noted the techniques resemble anti-bot measures used by content platforms.

The "concerning" camp raised several objections. Claude Code requires extensive filesystem and terminal access, and users expect transparency about what the tool does with their environment. Timezone-based classification of users in specific Chinese regions raises questions about differential treatment. The use of XOR encryption and base64 encoding indicates Anthropic did not want this behavior discovered.

Several commenters pointed out that if Anthropic wanted to collect this telemetry, transparent logging would be more appropriate than hidden classification signals embedded in prompt text.

Implications for developers

The core tension is that Claude Code is a developer tool requiring significant trust. Users grant it access to run shell commands, read and write files, and interact with their entire development environment. Undisclosed fingerprinting mechanisms undermine that trust relationship.

If Anthropic is classifying requests, they could potentially route marked requests to different models, apply different rate limits, or flag accounts for review. The discovery also creates compliance questions for enterprises subject to data residency or privacy regulations, who may not be aware that their API requests contain embedded classification data.

Sources

AnthropicClaudeSecurityPrivacy
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Anthropic Demonstrates Autonomous De Novo Protein Design and Chemical Analysis with Claude

    Anthropic Demonstrates Autonomous De Novo Protein Design and Chemical Analysis with Claude Anthropic has published experimental results demonstrating Claude's ability to autonomously design de novo protein binders with physical wet-lab validation and automate complex analytical chemistry workflows. The findings show frontier LLMs acting as autonomous agents across computational biology and molecular characterization pipelines. In the primary experiment, Anthropic evaluated Claude Mythos Previe

    1 min

  • Cerebras Unveils CS-4 Rack-Scale System Powered by Three WSE-3 Turbo Chips and Nexus Architecture

    Cerebras Unveils CS-4 Rack-Scale System Powered by Three WSE-3 Turbo Chips and Nexus Architecture Cerebras Systems has announced the CS-4, a rack-scale AI accelerator system designed around three of its next-generation Wafer Scale Engine 3 Turbo (WSE-3 Turbo) chips and a modular hardware architecture dubbed Nexus. Cerebras confirmed that initial customer shipments for the CS-4 are scheduled to begin in the current quarter. The new system marks a structural shift from Cerebras's single-wafer CS

    1 min

  • AI FinOps: Cutting LLM Inference Costs by 30-60% Through Model Tiering, Caching, and GPU Optimization

    AI FinOps: Cutting LLM Inference Costs by 30-60% Through Model Tiering, Caching, and GPU Optimization Inference costs have become the second-largest line item in enterprise AI budgets, trailing only talent spend according to RapidData's State of Enterprise AI 2026. This shift represents a fundamental inversion from the 2021-2023 era when training dominated AI expenditure. The compounding nature of serving costs—accumulating every hour as long as users hit the API—means that even modest producti

    1 min