Claude Code embeds steganographic marks for China endpoints, raising enterprise control-plane concerns

A security researcher reverse-engineered Claude Code 2.1.196 and found it embeds environment classification into the system prompt date string using visually similar Unicode characters. The trigger is a custom ANTHROPIC_BASE_URL combined with China timezone or matching 147 known domains and 11 lab keywords including deepseek, moonshot, and zhipu. Separately, GitHub issue #62061 revealed a mechanism for the client to pull extra system prompts from Anthropic's server. Together these show a privileged agent's instruction layer can change without enterprise visibility. The article argues against banning Claude Code and instead recommends treating it as a privileged dev runtime: disable bypass, sandbox execution, build audit surfaces, separate control planes, and maintain model and client fallbacks.

Why it matters: The reverse-engineering work surfaces a concrete mechanism with a character mapping table — not speculation. The story hits security, trust, and geopolitics simultaneously, clearing all three HKR axes. Not scoring higher because it's a single-source reverse-engineering report ...