Is Claude Code Spyware? Inside Anthropic's Hidden Unicode Fingerprint

In the first half of 2026, Anthropic triggered back-to-back privacy and security controversies across its desktop client and terminal coding agent product lines. The community often bundles both under "Claude spyware," but the trigger mechanisms, blast radius, and remediation paths differ completely. The table below is the Event A / Event B split you should run before writing a runbook or internal advisory.

Read alongside the Gemini CLI open-source trust crisis and Anthropic's AI for Science strategy, Event B illustrates the trade-off between anti-model distillation and developer-tool transparency. Per Anthropic's public statements, the experiment aimed to block unauthorized reselling and distillation, but steganographic tagging plus a changelog omission on removal amplified trust erosion.

Claude Code is a high-privilege terminal agent running on your machine or in CI: it reads repos, invokes tools, and reaches external systems through MCP. Developers reasonably expect the system prompt sent to the model to match what they see in the UI, and for environment variables to affect routing only—not silently rewrite prompt content. Per reverse-engineering reports, Event B broke that contract:

• Covert channel: The fingerprint lives inside the date line that appears in every request, not in a separate telemetry field—nearly invisible to the eye and to diff tools.
• Conditional trigger: Users hitting api.anthropic.com directly reportedly never enter this branch. Custom ANTHROPIC_BASE_URL paths—SiliconFlow, DeepSeek gateways, enterprise reverse proxies—activate it, overlapping heavily with the API relay ecosystem.
• Obfuscated list: The domain list is reportedly stored as base64 + XOR(91), roughly 147 rules including keywords like deepseek, moonshot, zhipu, and multiple gateway domains.
• Version drift: Logic reportedly existed since 2.1.91 (early April 2026). Community members reproduced it in 2.1.193 / 2.1.195 / 2.1.196 until 2.1.197 removed it.
• Disclosure gap: The removal PR merged, but release notes never mentioned the steganography code—making enterprise compliance and SBOM audits hard to close from the changelog alone.

On Hacker News, one camp argued that protecting models from distillation is legitimate business. The other argued that steganography in a paid developer tool without user notice conflicts with Anthropic's "ask for trust" narrative. The split itself shows that terminal agent trust models are not yet standardized.

Per thereallo.dev and follow-on analysis from Vincent Schmalbach and others, the pipeline has four steps: (1) read process.env.ANTHROPIC_BASE_URL; (2) if empty or pointing at the official API, return a plain date line; (3) otherwise parse the hostname against an XOR-decoded domain/keyword table; (4) pick a Unicode apostrophe and, based on system timezone, optionally swap date - for /.

The domain and keyword table is stored in the binary as base64 then XOR(91), reportedly about 147 rules covering strings like deepseek, moonshot, zhipu, siliconflow, and multiple relay domains. If Anthropic's servers preserve original Unicode before normalization, the same English sentence can signal proxy use, China-ecosystem routing, and China timezone—reportedly for anti-distillation and unauthorized-resale detection, not a community-proven verdict of active espionage.

function renderDateLine(date) {
  if (!customBaseUrl()) return `Today's date is ${date}.`;
  const { knownHost, labKeyword, cnTZ } = classifyRoute();
  const apostrophe = pickApostrophe(knownHost, labKeyword);
  const rendered = cnTZ ? date.replaceAll("-", "/") : date;
  return `Today${apostrophe}s date is ${rendered}.`;
}

• Citable data point 1: Steganography logic reportedly existed from Claude Code 2.1.91; still detectable in 2.1.196 at disclosure time.
• Citable data point 2: Obfuscated domain/keyword rule table reportedly contains about 147 entries, hidden via XOR(91) and base64.
• Citable data point 3: Related Hacker News thread reached 350+ points and 100+ comments, split between "anti-distillation is reasonable" and "developer tools should not use covert markers."

Anthropic employee Thariq Shihipar stated on X that, per his account, this was an experiment started in March to prevent unauthorized reselling and protect models from distillation, and that the team planned to roll it back in the next release. The Register and others reported Anthropic acknowledging the code and promising a fix. These are public statements; whether servers actually consumed these markers or affected account enforcement is undisclosed by Anthropic—this article does not assert undisclosed consequences as fact.

Source leaks from the same period also exposed other anti-distillation mechanisms such as ANTI_DISTILLATION_CC (e.g., injecting disruptive tool data into requests). Per reports, steganography sits in the same "protect the model" toolbox, but covert system prompt modification damages developer trust far more than documented API fields.

Event A: Unauthorized local channel pre-configuration

Hanff and Antiy Labs' core allegation: Claude Desktop, without user notice, writes com.anthropic.claude_browser_extension.json into Chrome, Edge, Brave, Arc, Vivaldi, Opera, and similar paths, pre-authorizing an extension ID to communicate with a local helper; deletion is automatically restored on app restart. Noah Kenney independently confirmed a persistent pre-authorized bridge from "browser extension → out-of-sandbox binary."

The risk chain: Anthropic's own docs note Claude for Chrome faces prompt injection risk—23.6% attack success without mitigation, roughly 11.2% with mitigation. If the extension is installed and the manifest is pre-seeded, per security analysis a malicious page's injection could theoretically reach local capabilities at user privilege through the extension and Native Messaging. That is unauthorized local config tampering plus a known high-success injection surface—not a traditional trojan, but with significant compliance and ePrivacy controversy.

Event B: Undisclosed prompt-layer telemetry

Event B does not modify local files. It embeds classification signals in the user-invisible system prompt with no separate opt-in disclosure. Per reverse-engineering reports, this is an undisclosed telemetry/classification channel hostile to transparency and data minimization. Whether it legally qualifies as "spyware" depends on jurisdiction and contract terms; engineering-wise, the accurate framing is: covert classification markers in a developer tool, removed without changelog notice.

1. 01
   Audit ANTHROPIC_BASE_URL: List every Claude Code instance across shells, ~/.claude/settings.json, and CI secret stores. Non-official API endpoints reportedly triggered the steganography branch; enterprise gateways should be documented and security-approved.
2. 02
   Upgrade Claude Code to ≥ 2.1.197: Run claude --version or npm ls -g @anthropic-ai/claude-code. Versions below 2.1.197 reportedly still contained the logic; after upgrading, verify the binary yourself since the changelog omitted this change.
3. 03
   Audit Claude Desktop Native Messaging: On macOS, check ~/Library/Application Support/Google/Chrome/NativeMessagingHosts/ and equivalent Edge, Brave, Arc paths for com.anthropic.claude_browser_extension.json. If you do not need browser automation, delete the manifest and log whether Desktop recreates it.
4. 04
   Verify system timezone: Event B reportedly swaps date separators under Asia/Shanghai and Asia/Urumqi. CI and cloud dev boxes should use expected timezones to avoid accidental tagging; document TZ=UTC where appropriate.
5. 05
   Enterprise least privilege: Restrict who can install Desktop, configure base URLs, and hold API keys; require approval for MCP and browser extensions; isolate Claude Code from production secrets.
6. 06
   Isolate dev environments and audit: Run agents on a dedicated Mac or cloud bare-metal node, separated from daily browsing and personal Apple IDs; periodically grep outbound system prompt samples (in MITM lab environments) or rely on vendor SBOMs. For stable, resettable Mac CI/agent hosts, see NUKCLOUD pricing and order page for dedicated nodes.

Terminal agents read code, invoke tools, and hold API keys. The 2026 Claude Code steganography and Desktop manifest controversies prove: vendor docs ≠ runtime behavior. Procurement and platform teams can adopt these four principles (applicable to Anthropic, Google, OpenAI, Cursor, and others):

1. Observable behavior: Require public documentation or SBOM coverage for system prompt injection, environment-variable triggers, and local file writes; changelogs must cover security-related removals.
2. Data minimization: Prefer explicit API fields or opt-in telemetry for classification and abuse prevention—avoid steganographic covert channels.
3. Local changes need consent: Native Messaging, browser extensions, LaunchAgents, and similar pre-configuration without consent is a violation unless authorized item-by-item at first use.
4. Verifiable supply chain: Pin versions, verify npm package hashes, diff in isolated environments; partition agent hosts from production networks for one-click rebuild.

Trust risk in desktop agents and tools like Claude Code often lies not in model answer quality but in local side effects you never reviewed and invisible outbound payloads. Running 7×24 agents on shared laptops or oversubscribed VPSes adds neighbor noise and long-connection drops. For auditable, SSH-accessible Mac hosts that can run Xcode and Claude Code in production or CI, NUKCLOUD multi-region bare-metal Mac / cloud Mac nodes offer dedicated hardware, root access, and flexible daily/monthly billing—keeping agent environments separate from everyday machines and shrinking the leak surface. Start at the pricing page to compare specs, then spin up an isolated dev environment on the order page.

• The Register — Report on Anthropic removing Claude Code covert code
• thereallo.dev — Long-form reverse engineering of system prompt steganography
• Antiy Labs — Claude Desktop Native Messaging risk analysis
• Alexander Hanff — Original disclosure of Claude Desktop silent manifest install (republished by That Privacy Guy and others)
• Hacker News — Late June 2026 discussion (350+ points, 100+ comments scale)
• Reddit — LegitMichel777 and others on 2.1.91 behavior
• Vincent Schmalbach, TechTimes, and others on ANTHROPIC_BASE_URL and Unicode marking

Terminal agents are becoming "interns with root." The Claude Code steganography incident reminds us: when choosing between Cursor vs Claude Code vs Copilot, ask more than SWE-bench scores and pricing—will it silently change the prompt you send to the model? Running agents on an isolated, rebuildable Mac in 2026 is a practical vote for control.