Claude Code Is Steganographically Marking Requests

A reverse-engineering look at Claude Code 2.1.196 reveals it silently alters the system prompt's date string based on API base URL and timezone. It swaps the apostrophe and date separator with near-invisible Unicode variants—curly quotes for known proxy domains, slashes for China timezones. Domain and keyword lists are XOR-obfuscated behind base64 and include AI lab names like deepseek and zhipu plus many reseller/gateway domains. The marker is embedded in the model's system context, likely so Anthropic's backend can flag unauthorized gateways and distillation pipelines. The author argues detection is fair, but hiding signals in prompt punctuation from a tool with filesystem and shell access erodes trust. The post confirms the logic stays inactive when ANTHROPIC_BASE_URL is unset or points to the official API.

Why it matters: First-hand reverse-engineering with code and domain list, not speculation. All three HKR axes hit: steganography is inherently intriguing, technical details are concrete, and the privacy angle resonates with devs. Capped below 85 because it's a personal blog without Anthropic'...