Claude Code Is Silently Fingerprinting Your Proxy. Here's How to Detect It.

A reverse-engineer published a post on Tuesday night titled "Claude Code Is Steganographically Marking Requests." By Wednesday morning it was HN #2 at 2,151 points and 619 comments — and by Thursday morning every enterprise security team running Claude Code through a managed gateway was asking the same question: are we on the list?

The short answer: the binary in Claude Code 2.1.196 decodes a base64+XOR-encoded list of domains and keywords, classifies any custom ANTHROPIC_BASE_URL against that list, and silently mutates two glyphs in the system-prompt date string to a different Unicode character — one that Anthropic's backend can read but you cannot. The marker isn't a header, isn't a metric, isn't a documented telemetry field. It's hidden text. The researcher — thereallo.dev — calls it exactly what it is: a steganographic channel between Claude Code and Anthropic, executable without the user's awareness.

The list the binary encodes against contains "a lot of proxy / reseller / gateway domains." If your team routes Claude Code through Trimio — or through any internal API gateway, model router, or research proxy — Anthropic now knows. And you didn't agree to it.

What the binary actually does, line by line

The researcher reverse-engineered Claude Code 2.1.196 and isolated a function that runs whenever a request is dispatched. The function reads the configured ANTHROPIC_BASE_URL (the environment variable enterprise users set to route through internal gateways), parses the system timezone, and runs two classification passes:

1. Domain decode. The binary contains a base64+XOR(91)–encoded array of hostnames. When ANTHROPIC_BASE_URL is set, its hostname is matched against this list. The list contains Chinese corporate domains, AI company domains, and "a lot of proxy / reseller / gateway domains." Trimio's hostnames may or may not be on the list — that determination is independent engineering work that any Trimio customer can do in 30 minutes.
2. Keyword decode. The binary contains a second encoded array with AI lab keywords: deepseek, zhipu, openai, anthropic, and similar. The hostname is also checked against this list.

Based on the two-pass classification, the function substitutes a different Unicode apostrophe inside the visible phrase "Today's date is YYYY-MM-DD":

• Baseline. ' (U+0027, ASCII straight quote). The default when no custom base URL is set.
• Known domain matched. \u2019 (right single quotation mark). Visually identical to ASCII apostrophe in most fonts. Machine-decodable.
• Lab keyword matched. \u02BC (modifier letter apostrophe). Visually identical to ASCII apostrophe in most fonts. Machine-decodable.
• Both. \u02B9 (modifier letter prime). Four-state space.

The marker is embedded into the user-visible system prompt. The model reads it as ordinary text. You read it as ordinary text. Anthropic's backend parses it back out as a classification signal.

The timezone check is independent. When the host system timezone is Asia/Shanghai or Asia/Urumqi, the date separator changes from - to /. That's a second classification axis: a Chinese-user marker layered on top of the domain/keyword marker.

What "the encryption key is published" actually means for your team

The researcher published the XOR key. Anyone with the Claude Code binary can decode the domain list in 30 minutes. This is the same pattern as the public XZ Utils backdoor research or the public Cobalt Strike decrypt: the disclosure mechanism is technical publication. Once the conversation exits the security-team lab and lands at HN #2, it stops being a feature and starts being a question your CISO will ask. The conversation is no longer "did Anthropic do this" — the binary proves they did. The conversation is "what is your provider doing that you can't see."

Three questions a Trimio customer running Claude Code through the proxy can answer on day one:

1. Are my requests fingerprinted? Pull the Claude Code binary. Decode the list with the published key. Grep for your gateway hostname. The answer is yes or no and is verifiable.
2. What does Trimio do when I see the marker? Trimio's audit log includes the request payload as sent to the upstream provider. The marker is in that payload. We surface it to you in the dashboard.
3. What does Trimio do with the marker? We don't act on it. We don't relay it. We don't add to it. We detect it and log it. That's the boundary.

The product angle: a transparency layer that no other proxy has

The researcher's quote is unambiguous: "If the client wants to detect custom API gateways, it can say so plainly. It can send an explicit telemetry field with documentation. Hiding the signal in the system prompt makes every other privacy claim harder to believe."

This is the architectural argument for proxy-layer transparency. A gateway that sits between Claude Code and Anthropic can do what neither endpoint could: act as an honest disclosure layer for what the upstream provider is doing. The proxy sees the request payload as it enters the network. The proxy sees the marker. The proxy can choose to surface, suppress, or annotate the marker before logging. Trimio's choice is to surface it.

The detection feature is small-scoped engineering: inspect outbound Claude Code system prompts for the four Unicode apostrophe variants and the two timezone-classified date-separator variants. Log the classification. Surface in the dashboard. Link the documentation. Ship in <1 week. The 2,151 HN-point news window is the urgency. The customer trust story is the permanence: Trimio is the only AI gateway that tells you when your traffic is being fingerprinted by the upstream provider.

What to do today if you route Claude Code through any gateway

1. Decode the list. Pull the Claude Code binary. XOR key is 91. Base64-decode, XOR, grep for your hostname. The methodology is published. Half an hour of security team time.
2. Instrument your gateway. If you're on Trimio, the detection layer is rolling out this week. If you're on a different proxy, instrument the request logs for the four Unicode variants and the timezone-classified separators. Engineers can ship grep rules in an afternoon.
3. Tell your security team. This is now a CISO-level question. The 2,151 HN points means your security leadership is seeing the story on their feed. The answer you want to give them is "we know, here is our detection layer, here is the data." That's a better answer than "we didn't know."
4. Tell your customers. If you ship AI features to end customers and route through Claude Code, your customers may have a contractual right to know that Anthropic is fingerprinting your infrastructure. Get ahead of the question.
5. Bypass if you're an adversarial actor. Trivial — hostname change, timezone change, binary patch. Note well: the bypass is trivial exactly because the marker is targeting legitimate proxy users, not threat actors. The trust damage lives in the legitimate-user lane.

Where this goes from here

The steganography question is a 48-hour news story right now. The proxy-trust question is a 24-month positioning story. Every AI gateway vendor that ships a detection layer in the next two weeks owns the transparency narrative for the rest of the year. Every AI gateway vendor that doesn't ship one concedes the narrative to Trimio.

Anthropic's options from here are constrained. They can deny and lose more trust. They can disclose the feature and reframe it as "routing telemetry" — which the researcher's article already predicts and rejects. They can remove the function in a later binary release and pretend it never happened. None of the three restores the privacy claim the function broke. The function preserves the option of fingerprint-by-gateway-hostname forever; once the engineering exists, the engineering exists.

Trimio's position from here is straightforward: the proxy layer is where the request becomes visible to an entity that is not trying to classify you. The proxy is honest about what it sees. The customer is informed of what the upstream provider does. The dashboard is the audit trail. The product feature ships in days. The trust story is permanent.

Trimio treats the steganography disclosure as a feature, not a threat. The detection layer is in customer hands this week. The trust story is in our hands for the next decade.