The invisible fingerprint in your terminal

Your Claude Code installation is watching you. Not in the way you'd expect, not through file access or shell monitoring, but through something far more subtle: the punctuation in its own system prompt.

A security researcher who goes by "thereallo" published an analysis this week showing that Claude Code v2.1.196 embeds invisible Unicode markers into every API request it sends to Anthropic. The markers classify the user's environment: which API gateway they're routing through, whether they're connecting from a Chinese timezone, and whether their hostname contains keywords associated with competing AI labs.

The technique is clever. It's also, depending on your perspective, either a reasonable anti-abuse measure or something that should worry anyone who uses Claude Code with a custom proxy.

How the fingerprinting actually works

The mechanism lives in a JavaScript function called Vla() inside the Claude Code binary. When you run Claude Code, it builds a system prompt that includes a line like "Today's date is 2026-06-30." That date line is where the hiding happens.

Claude Code checks three things before sending the request: your ANTHROPIC_BASE_URL (are you proxying through a third-party gateway?), your system timezone (are you in Asia/Shanghai or Asia/Urumqi?), and whether your hostname matches a list of known resellers or contains lab keywords like deepseek, moonshot, minimax, zhipu, baichuan, or 01ai.

Based on those checks, it swaps the apostrophe character in "Today's date" between four different Unicode variants that look identical to the human eye but carry different bits of information:

  • A standard ASCII apostrophe (U+0027) means nothing was flagged.
  • A right single quotation mark (U+2019) signals a known domain was detected.
  • A modifier letter apostrophe (U+02BC) means a lab keyword was found.
  • A modifier letter prime (U+02B9) means both triggered.

There's a fourth signal too: if you're in a Chinese timezone, the date format flips from YYYY-MM-DD to YYYY/MM-DD. Slashes instead of dashes, invisible in most rendered contexts, but trivially parseable on Anthropic's end.

The domain and keyword lists are XOR-encoded with a key of 91 and stored as base64 strings in the binary. Someone on GitHub decoded them and published the full list, it includes dozens of Chinese cloud providers, AI platforms, and reseller domains.

Why Anthropic is doing this

The most charitable interpretation is model distillation defense. Anthropic sells API access to Claude at specific price tiers. If someone sets up a proxy that routes requests to Claude, charges less, and pockets the difference, Anthropic loses revenue. Worse, if someone uses a proxy to systematically query Claude and train a competing model on the outputs, that's intellectual property theft.

The fingerprinting lets Anthropic identify which requests are coming through unauthorized channels. A request with the "known domain" apostrophe tells them "this is a reseller." A request with the "lab keyword" apostrophe tells them "this might be a distillation pipeline." The timezone check adds geographic context.

From Anthropic's perspective, this is no different from the watermarking techniques every major AI lab uses on their model outputs. OpenAI, Google, and Meta all embed invisible signals to track where their model outputs end up. Anthropic is just doing the inverse, tracking where the inputs come from.

The trust problem

Here's where it gets uncomfortable.

Claude Code is not a web interface. It's a CLI tool that runs on your machine, reads your files, executes shell commands, and has access to your entire development environment. When you install Claude Code, you're granting it deep access to your system. The implicit contract is: "I trust you with my code, and you help me write better code."

Fingerprinting undermines that contract. Not because the data collection is particularly invasive. Anthropic already sees your prompts, your file contents, and your terminal output. But because the fingerprinting is hidden. It uses Unicode tricks that most developers would never notice. The XOR encoding means you can't even read the domain list without decoding it first.

The HN discussion split predictably along two lines. One camp argued this is standard anti-abuse practice. "Every API provider does fingerprinting," one commenter wrote. "The fact that it's in the system prompt instead of HTTP headers is an implementation detail." The other camp called it "malware-adjacent." Their argument: a tool that requires trust-level access to your machine should be transparent about what it reports back to its servers.

A developer who goes by "wolttam" summed up the frustration: "I used Claude Code for a month because my boss gifted me a sub and wanted me to try it. I used that month to complete a work project and then beef up my personal harness so I'd never have to deal with Anthropic (and these sorts of shenanigans) again."

The technical reality

The fingerprinting is trivially defeatable. If you're running a sophisticated enough operation to set up a custom API proxy, you're also capable of patching the binary, changing your hostname, or modifying the system timezone. The people Anthropic actually wants to catch, large-scale resellers and distillation operations, are exactly the ones who can bypass this with minimal effort.

Which raises the question: who does this actually catch? The answer is almost certainly "legitimate users who happen to use non-standard configurations." A developer in Shanghai routing through a company proxy that happens to be on the flagged list. A researcher at a Chinese university who uses Claude Code for legitimate work. Someone running a self-hosted gateway for cost reasons, not abuse reasons.

There's no evidence yet that marked requests receive different treatment, no output poisoning, no rate limiting, no degraded model quality. But the infrastructure is there. The binary already classifies you. Whether it acts on that classification is a policy question, not a technical one.

What happens next

The original blog post author put it best: "Trust from real developers depends on the boring behavior. Hiding the signal in the system prompt makes every other privacy claim harder to believe."

This will blow over in a week. The HN front page moves on, the Reddit threads get buried, and most developers never read security analyses of their CLI tools. But the pattern, embedding covert classification in developer tools, is becoming standard practice across the AI industry. The question isn't whether your tools are fingerprinting you. It's whether you'd even notice if they were.