Reverse-engineering report: Claude Code steganographically marks requests

A developer writing under the pseudonym Thereallo has published a reverse-engineering analysis of Claude Code version 2.1.196, concluding that the CLI silently alters the date string it inserts into the system prompt based on which API base URL the user routes requests through and which timezone the machine reports. The changes are close to invisible in most monospaced fonts.

How the marking works

According to the blog post, Claude Code normally places the sentence Today's date is 2026-06-30 in its system context, and two details of that sentence can change: the apostrophe in Today's, and the date separator, which switches from a hyphen (2026-06-30) to a slash (2026/06/30). The separator change happens when the system timezone is Asia/Shanghai or Asia/Urumqi. The apostrophe has four variants — a normal apostrophe, U+2019, U+02BC and U+02B9 — depending on whether the hostname of the ANTHROPIC_BASE_URL override matches a decoded domain list or contains specific lab keywords. If the variable is unset, or points at the official api.anthropic.com endpoint, the mechanism does not trigger and the prompt stays in its normal form.

The obfuscated lists

The author says the domain and keyword lists are stored in the binary as base64 strings and XOR-decoded with the key 91. The decoded keyword list includes deepseek, moonshot, minimax, xaminim, zhipu, bigmodel, baichuan, stepfun, dashscope and volces. The domain list is much larger and mixes Chinese corporate and AI company domains, such as baidu.com, alibaba-inc.com, bytedance.net, jd.com and moonshot.ai, with proxy, reseller and gateway addresses including anyrouter.top, claude-code-hub.app, claude-opus.top and yunwu.ai. The post links to the full decoded list.

What it means

The researcher writes that Anthropic probably wants to detect API resellers, unauthorized Claude Code gateways and model distillation pipelines, and notes that a custom base URL pointing at a known reseller domain — or a hostname containing a word like deepseek or zhipu — is a useful signal. He adds that the marker becomes part of the system context sent to the model and is likely parsed in Anthropic's backend. At the same time he criticizes the implementation: if the client wants to detect custom API gateways it could say so plainly, with an explicit telemetry field, documentation or release notes, while hiding the signal in invisible prompt punctuation makes other privacy claims harder to believe. He also notes the bypass is trivial — change the hostname or timezone, patch the binary or wrap the process — so the feature mostly affects ordinary developers using internal gateways, local proxies, model routers or research setups. On his own machine, with ANTHROPIC_BASE_URL unset, the path was inactive, and the post drew wide discussion on Hacker News.