A reverse-engineering writeup by Thereallo said Claude Code embedded hidden markers into requests by altering a system-prompt date line under certain conditions. Malwarebytes and Ars Technica reported that Anthropic described the code as a March experiment aimed at abuse and distillation protection and said it had b...
Anthropic removed a hidden Claude Code request marker after a researcher publicly documented prompt-steganography behavior in the coding tool.
A reverse-engineering post by Thereallo said Claude Code changed part of its system prompt depending on environmental and configuration signals, including ANTHROPIC_BASE_URL, China-related time zones, and decoded domain or lab keyword lists. According to the Thereallo writeup, those conditions affected the formatting of the system prompt’s date line and used Unicode or date-format variations as markers inside requests.
The core allegation was not that Claude Code displayed a visible tracking banner to users, but that it could encode identifying information in model-bound text in a way ordinary users would be unlikely to notice. Thereallo characterized the behavior as prompt steganography: hiding a marker in otherwise plausible prompt content.
Malwarebytes reported that Anthropic acknowledged the code and described it as an “experiment” from March. According to Malwarebytes, Anthropic said the mechanism was intended for account-abuse and distillation protection. Ars Technica similarly reported that an Anthropic engineer confirmed the tracker had been added as a March experiment and that Anthropic removed it after the researcher’s disclosure.
Those reports frame the behavior as an anti-abuse measure rather than a general product feature. However, the public concern raised by the Thereallo post was about control and transparency: if a request contains hidden markers, a user or organization sending the request may not know that upstream systems can distinguish it from otherwise similar traffic.
Anthropic’s own Claude Code monitoring documentation already describes several request-level telemetry concepts, including traceparent propagation, request_id, and client_request_id. Those are conventional observability mechanisms: they are named, documented, and meant to help trace requests through systems.
The behavior described by Thereallo is different in kind because the marker was alleged to be embedded in prompt content through small formatting choices, rather than exposed as a clear telemetry field. Malwarebytes and Ars Technica both treated the episode as a hidden tracker story, while also reporting Anthropic’s position that it was a limited experiment for misuse detection.
For developers, the practical issue is not only whether the marker identified a particular person. It is whether invisible request variation can be used by model providers or intermediaries to classify traffic, apply policy, or investigate suspected misuse without clear user-facing disclosure. The available reports do not establish that the marker was used to throttle or block specific users, but they do show that the code path existed and was removed after scrutiny.
Based on the published accounts, several points are now supported by named sources: Thereallo published a reverse-engineering analysis of Claude Code prompt markers; Malwarebytes reported Anthropic’s explanation that the code was a March anti-abuse and anti-distillation experiment; Ars Technica reported that Anthropic removed the tracker after the disclosure; and Anthropic’s documentation separately confirms Claude Code supports documented request-level monitoring identifiers.
What remains less clear from the public reporting is how widely the experiment ran, what data Anthropic retained from it, whether any third-party routing or proxy services acted on the markers, and what internal review or disclosure standards Anthropic applied before shipping the behavior.
The episode highlights a tension facing AI coding tools: vendors want ways to detect abuse and model distillation, while developers increasingly expect precise disclosure about what is placed in their prompts and requests. Documented telemetry fields are one thing. Hidden prompt markers are more likely to trigger distrust, even when a company says the purpose is defensive.
Anthropic removed a hidden Claude Code request marker after a researcher publicly documented prompt steganography behavior in the coding tool.
According to the Thereallo writeup, those conditions affected the formatting of the system prompt’s date line and used Unicode or date format variations as markers inside requests.
The core allegation was not that Claude Code displayed a visible tracking banner to users, but that it could encode identifying information in model bound text in a way ordinary users would be unlikely to notice.
Continue reading
