Claude Code Steganographic Marking: What Anthropic Hides in Your Requests

Claude Code, Anthropic’s development agent, embeds invisible markers in every request sent to the API. An analysis published in late June 2026 on thereallo.dev breaks down the mechanism in detail. The issue isn’t technical: it’s a question of trust.

Claude Code and steganography: how it works

It all starts with an innocuous line inserted into the system context of every Claude Code session:

Today’s date is 2026-06-30.

This sentence actually contains up to four invisible variants depending on the user’s environment. The apostrophe in “Today’s” and the date separator can be silently replaced by Unicode characters that look identical but are technically distinct.

The code, extracted directly from the Claude Code JavaScript bundle version 2.1.196, performs three checks when building the agent context:

Is the system timezone Asia/Shanghai or Asia/Urumqi? If so, the date format switches from 2026-06-30 to 2026/06/30.
Does the hostname of ANTHROPIC_BASE_URL match a list of known domains (resellers, gateways, Chinese corporate domains)? The apostrophe is replaced with \u2019.
Does the hostname contain an AI lab keyword (deepseek, moonshot, zhipu, dashscope, etc.)? The apostrophe becomes \u02BC.
Both hostname conditions are met? The character used is \u02B9.

These characters are visually indistinguishable in most monospace fonts. A human reading the prompt will see nothing. The Anthropic backend, on the other hand, can parse the signal.

An encrypted and obfuscated domain list

The list of domains and keywords isn’t stored in plaintext. It’s base64-encoded then decoded via XOR with the key 91. Among the identified domains are proxies and resellers (anyrouter.top, claude-code-hub.app, openclaude.me, proxyai.com), Chinese corporate domains (baidu.com, alibaba-inc.com, bytedance.net) and AI labs (moonshot.ai, stepfun-inc.com).

The full list is published on the thereallo.dev CDN. It’s long and clearly covers a very specific commercial scope.

This level of obfuscation signals intent. You don’t hide a list behind XOR when you’re documenting a feature in your release notes.

What is Anthropic’s presumed objective?

The thereallo.dev author concedes the goal makes sense on paper. Anthropic has legitimate reasons to detect:

Unauthorized API resellers charging for Claude access without a commercial agreement.
Gateways that redirect Claude Code traffic to other models.
Distillation pipelines using Claude to train competing models.

An ANTHROPIC_BASE_URL variable pointing to a known reseller domain is a useful signal. A hostname containing “deepseek” or “zhipu” is too.

But the chosen implementation raises a fundamental methodological problem. If Claude Code wants to send a classification signal, it can do so in a documented telemetry field. It can spell it out in its terms of service. It can mention it in release notes. Instead, Anthropic chose to hide this behavior inside the punctuation of the system prompt.

Who is actually affected?

For the majority of users, this code path never activates. If ANTHROPIC_BASE_URL is absent or points to api.anthropic.com, the function returns immediately without modifying anything.

The affected cases are precisely those of developers doing legitimate but non-standard things:

Internal corporate gateways to pool API access.
Local proxies for routing or logging.
Research environments with custom endpoints.
Resellers and commercial intermediaries.

The irony the author points out is clear: a serious adversary who wants to bypass this marking can do so trivially (change the hostname, patch the binary, intercept the process). The mechanism mostly penalizes legitimate users with unusual configurations, not the bad actors who have the means to avoid it.

What this reveals about AI tool governance

Claude Code already operates within a high-trust perimeter. The tool has access to the filesystem, the shell, git, and sometimes the browser. Developers accept this level of access because the productivity gains justify the risk. That acceptance rests on an implicit contract: the binary must behave in a predictable and documented way.

Discovering that Claude Code silently modifies request content according to unpublished criteria undermines that contract. Not because the behavior is necessarily malicious, but because it isn’t disclosed.

As of the publication date of this article, Anthropic has provided no public statement on this mechanism. The silence is itself a signal.

Key takeaways

Claude Code inserts steganographic markers into the system prompt via Unicode characters and a modified date format, based on the ANTHROPIC_BASE_URL hostname and the system timezone.
The list of targeted domains and keywords is obfuscated (base64 + XOR) inside the JS bundle, indicating a deliberate intent to conceal.
The anti-fraud objective is understandable, but the undocumented implementation erodes trust among developers using non-standard configurations.
Users on the official api.anthropic.com endpoint are not affected by this behavior.
No official response from Anthropic is available at this stage: questions around GDPR compliance and legal implications remain open.

If you’re running Claude Code behind an internal gateway or proxy, now is the time to audit your configuration and keep an eye on Anthropic’s updates on the topic. Questions or an unusual setup to analyze? Find me on the blog or reach out directly.

Sources

thereallo.dev – Claude Code Is Steganographically Marking Requests: primary technical analysis with cleaned source code and the full domain list.
Hacker News – Discussion thread #48734373: additional technical comments from the community.