Claude Code Is Secretly Tagging Your Requests. Here’s What That Means for Your Privacy

Last week, a developer named kiruba took a look at the Claude Code binary on his own machine. He wasn’t looking for trouble. He was looking for transparency, because Claude Code already has filesystem access, shell access, git access, and depending on your setup, full browser control. When a tool has that kind of reach, you want to know what’s actually running on your computer.

What he found was unexpected.

Inside the Claude Code binary, there’s a function that quietly modifies the date string inserted into your system prompt. The visible result looks completely normal. You see something like “Today’s date is 2026-06-30.” Nobody would blink at that. But depending on your setup, Claude Code is actually sending one of four different versions of that sentence. The apostrophe changes. The date separator changes. The differences are invisible in most fonts.

This is called prompt steganography, and it has the privacy community talking.

How the Tagging Works

The mechanism is surprisingly elegant and quietly disturbing.

Claude Code checks three things about your environment. First, it looks at whether you’re using the official Anthropic API endpoint or a custom ANTHROPIC_BASE_URL. If you’re running through a proxy, reseller, or internal gateway, the system marks you as “known.” Second, it checks whether your system timezone is set to Asia/Shanghai or Asia/Urumqi. Third, it scans your API hostname for keywords associated with Chinese AI companies: deepseek, moonshot, minimax, zhipu, stepfun, dashscope, and others.

The results get encoded into the date sentence through Unicode character substitutions. The normal apostrophe in “Today’s” is U+0027. A “known” domain produces U+2019, which looks almost identical in most fonts. A hostname containing AI lab keywords produces U+02BC. Both conditions together produce U+02B9. The date separator flips between a hyphen and a forward slash depending on your timezone.

These are not arbitrary changes. They form a classification signal. The visible sentence reads fine. The underlying request carries metadata about who you are and how you’re connecting.

The full domain list is longer and stranger. It includes corporate domains like baidu.com, alibaba-inc.com, bytedance.net, and kuaishou.com. It includes proxy services like claude-code-hub.app, claude-opus.top, openclaude.me, proxyai.com, yunwu.ai, and zenmux.ai. The list runs to dozens of entries. All of it gets encoded into what looks like a plain date string.

Why This Matters

Here’s the uncomfortable part.

Claude Code ships as a trusted development tool. It asks for broad system access because that’s the whole point of a coding agent. You give it filesystem visibility, the ability to run commands, sometimes browser control. In exchange, you get an assistant that can navigate your codebase, write tests, refactor modules, and push commits.

The trust model depends on the client behaving boringly. When Anthropic’s own binary starts hiding classification signals inside invisible Unicode markers, it breaks something important. Not because the feature is necessarily malicious. But because it signals that the client is not telling you everything it’s doing.

The developer who discovered this, writing on thereallo.dev, put it plainly: if Claude Code wants to detect unauthorized API resellers or distillation pipelines, it can do that transparently. An explicit telemetry field with documentation would achieve the same goal. Putting the classification in release notes would let users make informed choices. Hiding it in prompt punctuation makes every other privacy claim harder to believe.

He’s right.

Coding agents already occupy an uncomfortable space. They can read your entire repository. They can summarize secrets by accident. They can run shell commands, install packages, edit files, and push commits. Most developers accept this because the productivity gains are real and the alternative is slower. But that acceptance is conditional on the tool behaving predictably.

When a client with filesystem access starts encoding identity markers into API requests using invisible characters, the assumption of boring behavior falls apart. You’re not just trusting an AI. You’re trusting a binary that does things you didn’t explicitly agree to.

The Practical Impact

For most users, this probably does not matter much.

If you’re using the official Anthropic API endpoint with no custom base URL, the check returns early and the date stays normal. The signal only activates when you’re routing through something other than api.anthropic.com. That means internal company gateways, local proxies, model routers, research setups, and resellers.

In that scenario, Claude Code classifies your hostname and encodes the result into the prompt. Anthropic’s servers presumably parse this on their end. The practical effect is that Anthropic can tell, with high confidence, whether you’re connecting through a known reseller domain or a hostname containing keywords like “deepseek” or “zhipu.”

This is useful for Anthropic’s business. Unauthorized API reselling eats into their margins. Model distillation pipelines use outputs from one model to train a competitor. Both are things a company would want to detect. The feature makes sense from a commercial perspective.

The problem is the implementation. Silent Unicode modifications to a system prompt is not how you communicate policy to users who already gave your binary broad system access. It’s also not particularly robust. Any serious adversary can bypass it. Change your hostname. Spoof your timezone. Patch the binary. Wrap the process. The classification becomes useless against anyone with the motivation to evade it.

So the feature mostly catches the people who are easiest to fingerprint: normal developers doing legitimate but unusual things. Internal teams running through a company proxy. Researchers routing traffic through a custom gateway. Developers in China who happen to use a local AI service alongside Claude Code.

What This Tells Us

The discovery arrives at an interesting moment.

Anthropic just released Claude Sonnet 5, their most agentic Sonnet model yet. It can use browsers and terminals, run autonomously, and approaches Opus-level performance at lower cost. The narrative around Anthropic right now is capability, safety, and enterprise readiness.

The steganography finding complicates that narrative in a specific way. Anthropic’s safety arguments have always leaned on transparency and user trust. They publish system cards. They discuss limitations. They position themselves as the more careful AI company.

Hidden classification signals don’t fit that story. A developer tool that quietly encodes user identity markers into API requests using invisible characters is not a company being more careful than its competitors. It’s a company doing something that its users didn’t agree to.

The response from most of the developer community has been measured. HN commenters noted that API providers detecting reseller abuse is reasonable. Several pointed out that the feature is relatively harmless for most users. A few noted that serious evasion is trivial. The consensus seems to be that it’s weird, unnecessary, and not great optics, but not catastrophic.

That’s probably the right read. The feature is not a backdoor. It doesn’t exfiltrate data. It doesn’t phone home to a server without your knowledge. What it does do is encode a classification signal into requests in a way that users would never discover without reverse-engineering the binary.

That’s the part that should make developers uncomfortable.

The Questions It Raises

When a tool with broad system access starts doing things users didn’t explicitly agree to, it raises questions that go beyond this specific feature.

Who else is doing this? The technique is not novel. Steganography in prompts has been discussed in academic literature. If one AI company is doing it quietly, it’s reasonable to ask whether others are doing similar things with different implementations. The answer might be that nobody else is. But we don’t know that, because we don’t usually reverse-engineer these binaries.

What else is the client doing that we don’t know about? Claude Code can read files, run commands, and access git history. Those are the things users consented to. The steganography finding suggests there may be other behaviors lurking in the binary that nobody has found yet. That doesn’t mean the tool is malicious. It means the trust model is one-directional and we’re just now noticing.

Should AI coding agents have a published behavioral spec? Not just capabilities, but actual implementation details of what gets sent where and why. Something like a software bill of materials for the behaviors that affect user privacy. This would be a significant change from how these tools are currently distributed.

None of these questions have clean answers. The industry is still figuring out what transparency means for AI systems that run on your machine but make network requests you can’t easily inspect.

What You Can Do About It

If this concerns you, there are a few practical steps.

First, check whether your setup activates the classification. If you’re using the official API endpoint with no custom base URL and a non-Chinese timezone, you’re probably not generating the signal. The feature only triggers under specific conditions.

Second, if you’re routing through a custom base URL, you can test what signal you’re sending by watching your prompt or checking the raw request. The differences are subtle but real.

Third, if you need to route through a proxy and want to avoid the classification, you can rename your hostname or run Claude Code in an isolated environment. The bypass is not complicated.

Fourth, watch for updates from Anthropic. If the community response prompts a statement or a change, it will probably come soon. The story is getting attention and Anthropic has been generally responsive to developer concerns in the past.

The Bottom Line

Claude Code is doing something that most users would not expect and nobody explicitly agreed to. The feature is technically clever, commercially motivated, and privacy-problematic in a way that’s hard to dismiss.

Whether you think it’s a serious violation depends on how much you trust AI companies with broad system access. If you’re comfortable with Claude Code having filesystem and shell access, the steganography might feel like a minor addition to an already-settled trust question. If you gave the tool access while assuming it was behaving boringly, this is a reason to revisit that assumption.

The feature will probably change. Either Anthropic explains it transparently, removes it, or finds a more explicit way to achieve the same goal. The developer community found it once, and now that it’s public, the pressure to address it will build.

What it definitely does is raise the floor on what we should expect from AI tools that run locally. Boring behavior is not just about what the model can do. It’s about what the binary shipping the model actually does when nobody is watching.