Claude Code's Hidden Watermarking: The Steganography That Rocked the Internet
Security researcher Thereallo reverse-engineered Claude Code and discovered hidden steganographic markers embedded in system prompts based on API base URL and timezone — scoring 2186 points on Hacker News.
Introduction: The Discovery That Shook the AI World
In late June 2026, a security researcher going by the pseudonym Thereallo published a finding that instantly captured the attention of the entire technology community. Claude Code — Anthropic's terminal-based coding agent — is secretly embedding steganographic markers into its own system prompts.
The post scored 2,186 points on Hacker News and instantly became the #1 story.
What Is Steganography and Why Does It Matter Here?
Steganography — the art of hiding information in plain sight — differs from cryptography in a fundamental way. In Claude Code's case, the markers are embedded through Unicode characters — apostrophes are swapped for visually identical but codepoint-distinct Unicode variants.
How the Steganographic Watermarking Works
Thereallo's reverse-engineering revealed obfuscated functions: Crt(), Rrt(), Qup(), and GSe().
The Hidden Domain and Keyword Lists
Claude Code ships with two hardcoded lists, encrypted using XOR with key 91 and wrapped in base64.
Why This Is Deeply Concerning
When a tool with shell access begins hiding classification bits inside system prompt punctuation, it raises serious questions.
Practical Impact and Who Is Affected
For most users, these markers remain inactive. The bypass is trivial.
What This Means for the Future of AI Tooling
The answer will determine not just how we build software, but how we build trust between humans and AI.