Folks, today's AI faceplant story is spectacular enough to earn a chapter in the 2026 Compendium of AI Tool Baffling Behavior.

Here's what happened. A developer,出于 privacy concerns, inspected the binary of his locally installed Claude Code (v2.1.196) -- after all, this thing has filesystem permissions, can execute shell commands, can operate git; its privileges are terrifyingly broad, so checking it is only reasonable.

What he found was jaw-dropping: Claude Code had secretly embedded nearly invisible steganographic markers in the system prompts sent to the model.

How the Snitching Worked

The technique was rather "ingenious."

Claude Code's system prompts contain a date string, normally something boring like "Today's date is 2026-07-01." But Claude Code secretly alters two things: first, the apostrophe in "Today's," and second, the date separator (changing - to /). These changes use four different Unicode characters -- regular apostrophe, right single quotation mark (U+2019), modifier letter apostrophe (U+02BC), and another variant (U+02B9) -- in a monospace font you can't tell the difference at all, but the backend can decode information from them.

What does it detect? Two conditions: first, whether your system timezone is Asia/Shanghai or Asia/Urumqi; second, whether the domain your ANTHROPIC_BASE_URL points to is on a secret list.

This domain list is hidden in the binary using XOR encryption and base64 encoding. What does it contain after decoding? A large number of Chinese enterprise domains, AI company domains, and proxy/gateway/relay domains. The keyword list includes names of Chinese AI labs like deepseek and zhipu.

In plain English: if you use Claude Code in a Chinese timezone, or if you connect Claude Code to a third-party API relay/proxy/compatible service, it secretly drops a marker in the system prompt sent to Anthropic -- "heads up, this user might be using our service through unofficial channels."

Why Developers Lost It

You might be thinking: isn't it normal for a company to detect API abuse?

Normal, yes. But the method isn't.

There are ten thousand above-board ways to detect API abuse: add an explicit identifier field in request headers, document the detection strategy, inform users in release notes, let users opt in via telemetry settings. But Anthropic chose the most uncomfortable approach: hiding markers in Prompts using steganography where users can't see them.

As the author put it: "If the client wants to detect custom API gateways, it could just say so. It could send an explicit telemetry field with documentation. It could make the policy visible. It could write it in release notes. Hiding signals in punctuation within system prompts only makes every other privacy claim harder to believe."

What makes it more ironic is that Claude Code and Anthropic have always branded themselves on "safety," "trustworthiness," and "responsible AI." Dario Amodei frequently speaks publicly about AI safety and ethics; the company talks about "building beneficial, harmless, and honest AI." The result? A tool with your filesystem and shell permissions secretly doing classification markers where you can't see them.

Moreover, the detection's "anti-circumvention" capability is weak -- change hostname, change timezone, patch the binary, wrap the process; any moderately determined adversary can bypass it. Who ends up penalized? Developers legitimately using internal gateways, local proxies, and model routers for lawful purposes.

1,644 upvotes and 471 comments on HN; the top comment nails it: "If your product needs steganography to protect its business model, there's something wrong with your business model."

One last thought: this isn't a huge scandal nor is it trivial. Anthropic could easily ship a patch changing the markers to public telemetry fields and this would blow over. But for developers, it's a reminder --

Friendly reminder:

1. Minimize permissions given to AI coding tools; don't hand out full repo access and sudo privileges casually.

2. Don't use internet-connected AI tools for sensitive projects; local models + offline environments are the way to go.

3. Any AI tool that tells you "we absolutely protect your privacy" deserves a healthy dose of skepticism -- after all, you can't see what it's stuffing into your Prompts.

That's the Roast for today. We'll be back tomorrow.