llms.blog
Anthropic

Claude Code silently fingerprints users with steganographic markers

Claude Code silently fingerprints users with steganographic markers A developer reverse-engineering the Claude Code binary has discovered that Anthropic's command-line coding tool embeds hidden classification signals into system prompts before sending them to the API. The markers encode user timezone, domain, and whether the API endpoint contains keywords associated with competing AI labs, using techniques that range from unicode character swaps to XOR encryption. The findings were published

axc
axc
3 min
Claude Code silently fingerprints users with steganographic markers

Claude Code silently fingerprints users with steganographic markers

A developer reverse-engineering the Claude Code binary has discovered that Anthropic's command-line coding tool embeds hidden classification signals into system prompts before sending them to the API. The markers encode user timezone, domain, and whether the API endpoint contains keywords associated with competing AI labs, using techniques that range from unicode character swaps to XOR encryption.

The findings were published on the blog thereallo.dev and quickly climbed to the top of Hacker News, generating over 350 points and 100 comments within hours.

What the researcher found

According to the analysis of Claude Code version 2.1.196, the binary contains obfuscated functions that conditionally modify the date string sent to the model as part of the system prompt. The obfuscation uses XOR encryption with a key of 91, combined with base64 encoding.

The decoded keyword list includes: deepseek, moonshot, minimax, zhipu, baichuan, stepfun, and 01ai. Domain lists contain Chinese tech companies and proxy or reseller services.

Four apostrophe variants signal different detection states. A standard apostrophe indicates no triggers. A right single quotation mark (U+2019) signals a known domain was detected. A modifier letter apostrophe (U+02BC) indicates a lab keyword was found. A modifier letter prime (U+02B9) means both triggers fired.

The date format itself switches from YYYY-MM-DD to YYYY/MM/DD for users in the Asia/Shanghai or Asia/Urumqi timezones.

These markers are invisible during normal use. They appear in innocuous sentences such as "Today's date is..." where the apostrophe variant encodes the classification without affecting readability.

Why Anthropic would do this

The primary incentive for request-level marking is abuse traceability. If Claude-generated content violates Anthropic's usage policies, steganographic markers could allow that content to be traced back to the originating account even after it has been separated from API logs. This would enable Anthropic to enforce policy against prohibited content generation and identify accounts whose outputs are being redistributed in violation of terms.

The domain and keyword checks also suggest a distillation detection mechanism. Anthropic has previously accused Alibaba of running the largest Claude distillation campaign to date. The keyword list targeting Chinese AI labs and proxy services aligns with efforts to detect automated queries that may be extracting model capabilities for training competing systems.

Community reaction

The Hacker News thread revealed a split developer community.

The "reasonable" camp argued that combating resellers and distillation is a legitimate business concern. Some noted the techniques resemble anti-bot measures used by content platforms.

The "concerning" camp raised several objections. Claude Code requires extensive filesystem and terminal access, and users expect transparency about what the tool does with their environment. Timezone-based classification of users in specific Chinese regions raises questions about differential treatment. The use of XOR encryption and base64 encoding indicates Anthropic did not want this behavior discovered.

Several commenters pointed out that if Anthropic wanted to collect this telemetry, transparent logging would be more appropriate than hidden classification signals embedded in prompt text.

Implications for developers

The core tension is that Claude Code is a developer tool requiring significant trust. Users grant it access to run shell commands, read and write files, and interact with their entire development environment. Undisclosed fingerprinting mechanisms undermine that trust relationship.

If Anthropic is classifying requests, they could potentially route marked requests to different models, apply different rate limits, or flag accounts for review. The discovery also creates compliance questions for enterprises subject to data residency or privacy regulations, who may not be aware that their API requests contain embedded classification data.

Sources

AnthropicClaudeSecurityPrivacy
ShareX (Twitter)LinkedIn

Written by

axc

More to read

  • Discrete Diffusion in Large Language Models: How Continuous-Time Markov Chains, Absorbing States, and Score Entropy Challenge Autoregressive Generation

    The dominance of autoregressive architectures in large language models rests on a fundamental mathematical formulation: the chain rule of probability. By factoring the joint distribution of a sequence into a product of conditional probabilities, $p(x) = \prod_{i=1}^N p(x_i \mid x_{<i})$, autoregressive models reduce text generation to sequential next-token prediction. While this left-to-right causal factorization has scaled effectively across compute regimes, it imposes rigid operational constr

    1 min

  • AI Agents Surpass Humans on OpenRouter as Agentic Token Usage Jumps 14x

    Autonomous AI agents have overtaken human users as the primary consumers of language model compute on OpenRouter, with agentic token volume surging fourteenfold over the past six months. Data published by OpenRouter analyst Peter Walker indicates that February 6 marked the permanent inflection point where token consumption by automated agents exceeded direct human API traffic. Since that threshold, agentic token volume on the multi-model gateway has climbed from 0.51 trillion to 7.3 trillion to

    1 min

  • Continuous Pre-Training in Production: Domain Adaptation, Replay Buffers, Learning Rate Restarts, and Catastrophic Forgetting Mitigation

    Continuous Pre-Training in Production: Domain Adaptation, Replay Buffers, Learning Rate Restarts, and Catastrophic Forgetting Mitigation Adapting general-purpose foundation models to specialized enterprise domains (such as clinical medicine, corporate law, quantitative finance, and proprietary software codebases) presents a fundamental architectural challenge. While Retrieval-Augmented Generation (RAG) and Supervised Fine-Tuning (SFT) remain standard first-line approaches, both exhibit severe s

    1 min