If you use Claude Code or Claude Desktop, the June 2026 prompt steganography disclosure and April's silent browser injection are two separate incidents—the former rewrites Unicode apostrophes in Today's date when you route through a proxy; the latter pre-writes Native Messaging manifests on macOS. Per reverse-engineering reports, Anthropic removed the steganography code in 2.1.197; the likely goal was anti-distillation, but the method was covert and undisclosed. This post covers the Incident A/B matrix, Unicode mapping table, HN debate, six-step checklist, and FAQ. Node options on the pricing page.
[ SECTION_01 ] // TL;DR What is Claude Code steganography? Answer in 30 seconds
Bottom line: On June 30, 2026, per the thereallo.dev reverse-engineering report, Claude Code (the CLI coding tool—not the web app) quietly rewrote the Today's date is... line in its system prompt when ANTHROPIC_BASE_URL pointed anywhere other than api.anthropic.com. By switching the date separator (- vs /) and swapping the apostrophe for visually identical Unicode variants (U+0027 / U+2019 / U+02BC / U+02B9), it encoded whether you were in a China timezone and whether your endpoint matched China-linked domains or AI-lab keywords. That is a textbook covert channel. Anthropic shipped 2.1.197 on July 1, 2026 to remove the code—the changelog did not mention it.
- Two stories, often conflated: Desktop browser injection (Hanff, April) and Code prompt steganography (June RE) involve different products, triggers, and mechanics—conflating them hurts E-E-A-T.
- Not everyone was affected: Incident B only activated with a non-official Base URL; official endpoint users saw no changes.
- Intent vs method: Community consensus points to anti-distillation/reselling defense—defensible intent, indefensible concealment.
- HN split: Thread hit front page within hours—350+ points—"reasonable anti-distillation" vs "malware-adjacent for a dev tool."
- Legal tone: We use "alleged," "per reports," and "reverse-engineering found"—vendor intent is not stated as proven fact.
[ SECTION_02 ] // TIMELINE Claude Desktop injection vs Claude Code steganography: full comparison
| Dimension | Incident A: Silent browser injection | Incident B: Prompt steganography |
|---|---|---|
| Product | Claude Desktop (macOS client) | Claude Code (CLI coding tool) |
| Source | Alexander Hanff (privacy consultant, The Register contributor) | Developer RE published on thereallo.dev, amplified via Reddit → HN |
| Date | April 2026 (~Apr 18 onward) | June 30, 2026 |
| Behavior | Silently writes com.anthropic.claude_browser_extension.json into Chrome/Edge/Brave/Arc/Vivaldi/Opera/Chromium, pre-authorizing 3 extension IDs to call sandbox-external chrome-native-host; creates dirs even if browser not installed; file regenerates after deletion |
When ANTHROPIC_BASE_URL ≠ api.anthropic.com, rewrites Today's date is... via steganography |
| Labels | spyware / backdoor | prompt steganography / covert channel |
| Trigger | Install/start Claude Desktop | Non-official Base URL only; not every conversation |
| Anthropic response | No formal public response; later builds added consent toggle; underlying permission model not fully removed | Admitted code existed; removed in 2.1.197 (Jul 1); changelog silent |
For Incident A, independent consultant Noah Kenney (Digital 520) confirmed Hanff's claims were reproducible; Antiy Labs published a dedicated risk analysis. For Incident B, RE confirmed versions 2.1.193 / 2.1.195 / 2.1.196 all contained the logic.
[ SECTION_03 ] // TECH How does the Claude Code Unicode fingerprint work?
Precondition: only triggers when ANTHROPIC_BASE_URL points somewhere other than api.anthropic.com (proxy, gateway, reseller, OpenAI-compatible layer). Official endpoint: no alteration.
When triggered, two signals hide inside the innocuous Today's date is ... line:
- Date separator: if timezone is
Asia/ShanghaiorAsia/Urumqi,2026-06-30becomes2026/06/30. - Apostrophe swap: the apostrophe in
Today'sbecomes a look-alike Unicode character encoding what matched.
| Detected condition | Date format | Apostrophe | Unicode |
|---|---|---|---|
| Default (no match) | 2026-06-30 |
' ASCII apostrophe |
U+0027 |
| China-linked org/reseller domain | 2026-06-30 |
' right single quote |
U+2019 |
| AI-lab keyword (deepseek, moonshot, zhipu, minimax, baichuan, stepfun, 01ai…) | 2026-06-30 |
ʼ modifier letter apostrophe |
U+02BC |
| Both domain and lab | 2026-06-30 |
ʹ modifier letter prime |
U+02B9 |
| + China timezone | 2026/06/30 |
(apostrophe rules as above) | — |
Per the RE report, domain/keyword lists use base64 + XOR (key 91) obfuscation—roughly 147 domain patterns. To a human the prompt looks ordinary; to Anthropic's backend, one apostrophe's code point reveals: VPN user, China timezone, possibly a Chinese AI lab.
# Check non-official endpoint (Incident B precondition)
echo "$ANTHROPIC_BASE_URL"
# Non-empty and not https://api.anthropic.com may have triggered fingerprint logic
claude --version
# Confirm version >= 2.1.197 (steganography removed)[ SECTION_04 ] // WHY Why did Anthropic do this? Anti-distillation vs trust line
Measured community consensus: this was almost certainly anti-distillation and anti-unauthorized-reselling. Anthropic, OpenAI, and Google have publicly worried about competitors harvesting API outputs to train smaller models. China-linked resellers, proxies, and labs were prime suspects.
Intent may be defensible; method is not. Turning classification into invisible punctuation, obfuscating it in the binary, and shipping it on every request inside a developer tool that lives on trust crosses a line.
On Hacker News the thread split hard: "reasonable anti-distillation defense" vs "malware-adjacent behavior for a dev tool." Mainstream read: goal was detecting unauthorized reselling + distillation, not personal surveillance—the fight is over means (covert, obfuscated, undisclosed).
[ SECTION_05 ] // SPYWARE Is Claude Code actually spyware? A more precise label
"Spyware" is a loaded word. More precisely:
- Incident A is closer to unauthorized tampering with third-party software + a dormant, pre-positioned attack surface. Even unexploited, it pre-installs a high-privilege channel outside the browser sandbox—and Anthropic's own numbers put Claude for Chrome prompt-injection success at 23.6% (unmitigated) / 11.2% (mitigated).
- Incident B is closer to undisclosed telemetry / covert user classification—not classic exfiltration malware, but an undisclosed covert channel.
Whatever label you use, the core issue is the same: no informed consent, deliberately hidden.
[ SECTION_06 ] // PROTECT How to check and protect yourself: six-step playbook
- Check Base URL: run
echo $ANTHROPIC_BASE_URL; non-official proxies may have triggered Incident B; production should preferapi.anthropic.comor audited enterprise gateways. - Upgrade Claude Code: ensure version ≥ 2.1.197 (July 1, 2026—public reports say steganography removed).
- Scan Native Messaging manifests (Incident A): on macOS check
~/Library/Application Support/<browser>/NativeMessagingHosts/com.anthropic.claude_browser_extension.jsonacross Chrome, Edge, Brave, Arc, Vivaldi, Opera. - Delete and watch for regeneration: remove the JSON, restart Claude Desktop, log whether it recreates—evidence of whether the permission model was truly fixed.
- Audit timezone + proxy combo: VPN plus China timezone (
Asia/Shanghai/Asia/Urumqi) on old Claude Code + non-official Base URL formed a full fingerprint vector. - Enterprise / sensitive environments: treat desktop agents as high-privilege software—least privilege, explicit authorization, auditable behavior; host agents on isolated 24/7 servers, not personal laptops.
[ SECTION_07 ] // TRUST AI vendor overreach: how should we respond?
The real lesson is not "an apostrophe." When model capability races ahead while security boundaries, consent, and auditability lag, vendors keep crossing the trust boundary in the name of "UX" or "abuse prevention." Early PC and smartphone security mistakes are replaying on desktop AI agents.
Cite-ready technical facts (June–July 2026, per public reports and RE):
- Rule set size: base64 + XOR(91) obfuscation, ~147 domain/keyword patterns.
- Affected versions: Claude Code 2.1.193 / 2.1.195 / 2.1.196 contained logic; 2.1.197 removed it.
- HN traction: front page within hours, 350+ points, 100+ comments.
- Claude for Chrome injection success (Anthropic disclosed): 23.6% unmitigated, 11.2% mitigated.
What we can actually do:
- Default to distrust; demand evidence. Reproducible, auditable, switchable-off is the bar.
- Disclosure over concealment. Fight distillation in the open—document it, ship a toggle—not bury it in punctuation.
- Least privilege + isolation for every desktop agent.
- Vote with your feet, back it with regulation. GDPR-style law and market choice are the ultimate check.
Technology can be neutral; a company cannot. The more capable the model, the more the vendor must constrain itself—and that should not be a secret you only find by reverse-engineering a binary.
[ SECTION_08 ] // FAQ Claude Code steganography FAQ and sources
Q: Is Claude Code spyware?
Not in the classic sense, but RE found an undisclosed, obfuscated fingerprint; Anthropic removed it in 2.1.197. Best labeled an undisclosed covert channel.
Q: Does Claude Code track my timezone?
Per RE, it checked Asia/Shanghai / Asia/Urumqi only with non-default ANTHROPIC_BASE_URL; official endpoint users were untouched.
Q: What is the apostrophe / Unicode trick?
The apostrophe in "Today's" switched among U+0027, U+2019, U+02BC, and U+02B9 to encode China-linked domain hits, AI-lab keywords, both, or neither.
Q: Why did Anthropic add this?
Most likely anti-distillation and unauthorized reselling—legitimate goal, illegitimate implementation and disclosure.
Q: Same as Claude Desktop spyware?
No—April Desktop Native Messaging is Incident A; June Code steganography is Incident B.
Q: Are web Claude users affected?
Incident B only affected Claude Code with non-official ANTHROPIC_BASE_URL.
Q: How to remove Claude Desktop browser injection?
Delete com.anthropic.claude_browser_extension.json under ~/Library/Application Support/<browser>/NativeMessagingHosts/; Claude Desktop may recreate it.
Q: Why keep Incidents A and B separate?
Conflating them produces factual errors that HN, Reddit, and security readers spot instantly—hurting E-E-A-T and SEO credibility.
Primary references—re-check links after upstream updates:
thereallo.dev: Claude Code prompt steganography (original RE report)
The Register: Claude Desktop changes software permissions without consent (Apr 2026)
Hacker News: Claude Code steganography discussion
Running Claude Code long sessions, MCP toolchains, and multi-model routing on a sleeping laptop lets interrupted jobs, OAuth expiry, and Native Messaging regeneration eat your audit work. Local-only checks help, but lack a predictable 24/7 host; moving agents to isolated cloud Macs needs stable Apple Silicon and SSH.
If you need 24/7 agent hosting, stable SSH, and predictable Apple Silicon capacity, moving Claude Code scheduled jobs, MCP configs, and multi-vendor fallbacks to dedicated bare-metal servers beats firefighting on an unreliable laptop: NOVAKVM offers multi-region Mac Mini M4 / M4 Pro flexible terms, fixed bandwidth, default SSH—ideal for iOS CI/CD and AI agent automation on one machine. See the pricing page, order page, and help center.