An independent developer writing as Thereallo reported finding code in Claude Code 2.1.196 that can alter punctuation in a system-prompt date according to a user’s API base URL and timezone. The analysis characterized the behavior as prompt steganography because the resulting sentence remains visually ordinary while carrying a small classification signal.
The report said the normal prompt reads “Today’s date” with a standard apostrophe and a date formatted with hyphens. In the cleaned-up code published by the developer, a function can select among four apostrophe-like characters depending on whether a custom hostname matches a known-domain list, contains selected AI-lab keywords, or meets both conditions. A separate check replaces date hyphens with slashes when the system timezone is Asia/Shanghai or Asia/Urumqi.
According to the analysis, the relevant path is tied to the `ANTHROPIC_BASE_URL` environment variable, which lets Claude Code use an API endpoint other than the default. If the variable is absent, or if it points to Anthropic’s official API host, the function returns early and the marker is not applied. That means the reported behavior would remain inactive for many standard installations.
Thereallo said the hostname and keyword lists were stored as Base64 data and decoded with an XOR key. The published keyword examples included DeepSeek, Moonshot, MiniMax, Zhipu and DashScope, while the domain list reportedly covered Chinese companies, AI services, proxies, resellers and gateways. The date string then becomes part of the system context sent to the model, the report said.
The developer examined a locally installed binary signed by Anthropic and included its identifier, team identifier, signing timestamp and SHA-256 hash. On that machine, `ANTHROPIC_BASE_URL` was unset and the timezone was Asia/Hong_Kong, so the analysis said the prompt would retain the normal punctuation. The finding was therefore based on code inspection, not a claim that the marker activated in the author’s own configuration.
Thereallo suggested the feature might be intended to identify resellers, unauthorized gateways or model-distillation pipelines, but described that purpose as an inference. The supplied source contains no statement from Anthropic confirming why the code exists, how any backend might interpret the signal, whether it is logged or how long it has been present. NeoTechNews has not independently reproduced the reverse engineering.
The practical scope also appears limited and easy to evade. The report said changing a hostname or timezone, patching the binary or wrapping the process could defeat the marker. Its concern focused less on technical strength than transparency: a developer tool with broad access was allegedly encoding endpoint classifications inside near-invisible prompt characters instead of using a documented field. Without an Anthropic response or independent confirmation, that remains a documented researcher finding requiring further scrutiny rather than a settled account of company policy.
