June 30, 2026

Apostrophe-gate has entered the chat

Claude Code Is Steganographically Marking Requests

Tiny hidden tweaks, huge trust meltdown as devs call it creepy and pointless

TLDR: A blogger says Claude Code hid tiny, nearly invisible changes in requests based on where they were sent and the computer’s time zone. Commenters split between calling it creepy fingerprinting and asking whether the outrage is bigger than the actual harm.

The internet loves a good "wait, it did WHAT?" moment, and this one delivered. A blogger claims Claude Code was quietly slipping tiny hidden marks into requests by changing harmless-looking text like the apostrophe in “Today’s” or swapping dashes in a date for slashes. To regular humans, it looks like nothing. To commenters, though? Instant trust spiral. The big fear is simple: if a coding tool can peek into your files and run commands, people expect the app itself to be squeaky clean—not secretly tagging requests in ways users would never notice.

And the comments came in hot. One camp saw it as a sketchy form of fingerprinting, with one blunt reply calling it a “cool fingerprinting avenue.” Another person said the more they learn about Anthropic, the more they’re disgusted—basically the digital version of flipping the dinner table. But there was pushback too: one commenter challenged the outrage with a very fair “What’s the punishment here exactly?” In other words, is this sinister surveillance, or just a clumsy anti-reseller trick that looks worse than it is?

Then came the nerd-snark. One commenter compared the whole thing to malware-style anti-observation tricks, which is about as flattering as being compared to a raccoon in your attic. Another roasted the hiding method itself, joking that if you’re going to be sneaky, at least be smarter about it. The vibe? Half scandal, half code-review pile-on, all drama.

Key Points

  • The article says Claude Code 2.1.196 contains code that alters the system-prompt date sentence in subtle ways.
  • Two changes described are apostrophe substitution in `Today's` and changing date separators from `-` to `/`.
  • The article identifies `ANTHROPIC_BASE_URL` as the trigger path for checking API hostnames and applying markers.
  • The reproduced code checks whether the system timezone is `Asia/Shanghai` or `Asia/Urumqi`, which changes the rendered date format.
  • The article says hostname-matching data is obfuscated as base64 strings decoded with XOR key `91`, and it lists several decoded AI-lab-related keywords.

Hottest takes

"the more they disgust me" — theplumber
"What’s the punishment here exactly?" — MattDamonSpace
"Cool fingerprinting avenue" — hhh
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.