2445 points•750 comments•2w ago•by kirushik•thereallo.dev ↗

Claude Code is steganographically marking requests

The article examines Claude Code (version 2.1.196) and reports a hidden prompt-steganography feature that can subtly alter the system prompt. It changes the date sentence by adjusting the apostrophe and the date separator based on signals such as the Anthropic base URL and the host timezone, with the trigger data stored as base64 strings XOR-decoded into domain and lab keyword lists. The marker is included in the agent context sent to the model, and bypasses exist by altering the hostname, timezone, or patching the binary; the piece calls for explicit disclosure.

Discussion (750)

No comments yet

Top
Trending
New
For You
Bookmarks
Dossier