Claude Code hides reseller-detection markers in its date prompt

A researcher disassembling the Claude Code 2.1.196 binary found a routine that quietly rewrites the date string injected into the system prompt. Depending on the environment, the tool swaps the apostrophe in “Today’s” for a look-alike Unicode character and flips the date separator from hyphens to slashes — changes invisible in most monospace fonts. The technique is prompt steganography: the sentence still reads as an ordinary date to both the user and the model, but the raw request now carries a hidden classification marker that Anthropic’s backend can parse.

The logic only fires when ANTHROPIC_BASE_URL is set to a custom endpoint, then checks whether the system timezone is Asia/Shanghai or Asia/Urumqi, whether the base URL’s hostname matches a built-in domain list, or whether it contains known AI-lab keywords (e.g. deepseek, zhipu). Those domain and keyword lists ship base64-encoded and XOR-obfuscated with the key 91, and the decoded domain list is heavy with Chinese corporate domains and proxy, reseller, and gateway services. The plausible intent is detecting unauthorized Claude Code gateways, API resellers, and model-distillation pipelines — a legitimate goal for a vendor protecting its models.

The author’s objection is the method, not the motive. A coding agent already operates with filesystem, shell, and git access, so trust depends on the client behaving predictably and transparently. Burying a classification signal inside invisible prompt punctuation, behind XOR and base64, undercuts every other privacy assurance Anthropic makes. Worse, the check is trivially defeated by anyone changing a hostname, spoofing a timezone, or patching the binary — so the only people it reliably fingerprints are ordinary developers running legitimate-but-unusual setups like internal gateways, local proxies, and research routers. An explicit, documented telemetry field would have served the same purpose without eroding trust.