Главная / Блог / Стеганография Claude
ENGINEERING BLOG · 2026.07.03

Claude Code и стеганография:
скрытый Unicode-отпечаток Anthropic

Если вы гоняете Claude Code или проксируете Anthropic API — вопрос «Claude трекает меня скрытно?» не парanoia. TL;DR: конец июня 2026, по данным reverse engineering, Claude Code переписывал строку Today's date is... в system prompt, когда ANTHROPIC_BASE_URL указывал не на api.anthropic.com. Механизм: подмена date separator и visually identical Unicode apostrophe — encoding timezone и China-linked domain/lab signals в каждый request. Anthropic вырезал код в 2.1.197. Цель — почти наверняка anti-distillation; проблема — covert channel без disclosure. Это отдельная история от browser injection Claude Desktop в апреле.

01

Волна — это два независимых события, слитых в один narrative. Смешивать их на HN / Reddit / в security-кругах — мгновенный минус к E-E-A-T.

Incident A (silent browser injection) vs Incident B (system-prompt steganography)
Измерение Incident A: silent browser injection Incident B: prompt steganography
Продукт Claude Desktop (macOS client) Claude Code (CLI coding tool)
Disclosure source Alexander Hanff (privacy consultant, The Register contributor) Reverse engineering бинарника; thereallo.dev; Reddit → HN
Timeline Апрель 2026 (~18/04) 30 июня 2026
Core behavior Silent write Native Messaging manifest com.anthropic.claude_browser_extension.json в Chrome/Edge/Brave/Arc; pre-auth 3 extension ID для вызова sandbox-external chrome-native-host; создаёт dirs даже без установленного browser; file regenerates после delete При ANTHROPIC_BASE_URL ≠ api.anthropic.com — rewrite Today's date is... через steganography
Applied labels «spyware» / «backdoor» «prompt steganography» / «covert channel»
Trigger condition Install/start Claude Desktop Только non-official Base URL; не каждый conversation
Anthropic response Нет formal public response; позже consent toggle; underlying permission model reportedly не убран полностью Code acknowledged; removed в 2.1.197 (01/07); changelog silent
  • Incident A validation: independent consultant Noah Kenney (Digital 520) подтвердил reproducibility claims Hanff; Antiy Labs опубликовали dedicated risk analysis.
  • Incident B version coverage: reverse engineers подтвердили 2.1.193 / 2.1.195 / 2.1.196; HN thread — front page за часы, 350+ points, 100+ comments.
  • Developer trust crisis: когда desktop AI agent и CLI tool получают system-level access, undisclosed + deliberately hidden behavior — red line независимо от intent.
  • Model stack context: Anthropic всё ещё значим на routing platforms — см. наш OpenRouter июнь 2026 разбор — но «good API» и «trustworthy tool» теперь orthogonal dimensions.

Везде используем «по данным отчётов», «reverse engineering findings», «alleged». Anti-distillation goal и method Anthropic оцениваются отдельно.

02

Precondition: trigger только когда ANTHROPIC_BASE_URL указывает не на api.anthropic.com (proxy, gateway, reseller, OpenAI-compatible layer). Official endpoint users — out of scope. Standard Claude web users — не затронуты Incident B.

После trigger — два signal channel, спрятанных в innocuous Today's date is ...:

  1. Date separator swap: при system timezone Asia/Shanghai или Asia/Urumqi2026-06-302026/06/30.
  2. Apostrophe code point swap: apostrophe в Today's заменяется look-alike Unicode variant, encoding match result.
Unicode fingerprint mapping в system prompt Claude Code (по thereallo.dev RE)
Detected condition Date format Apostrophe char Unicode
Default (no domain/lab match) 2026-06-30 ' ASCII apostrophe U+0027
China-linked org/reseller domain hit 2026-06-30 ' right single quotation mark U+2019
AI lab keyword (deepseek/moonshot/zhipu/minimax/baichuan/stepfun/01ai…) 2026-06-30 ʼ modifier letter apostrophe U+02BC
Domain + lab одновременно 2026-06-30 ʹ modifier letter prime U+02B9
+ China timezone (Asia/Shanghai / Asia/Urumqi) 2026/06/30 (apostrophe rules as above)

Plain terms: prompt выглядит ordinary для human eye. Backend сканирует один code point apostrophe и классифицирует: «user через VPN, но China timezone — возможно Chinese AI lab». Domain/keyword lists — base64 + XOR(key 91) obfuscation, ~147 domain patterns. Textbook covert channel / prompt steganography.

check-apostrophe.sh
# Inspect Unicode code points в apostrophe Today's
echo "Today's date is 2026-06-30" | xxd | grep -A1 "Today"

# U+0027 vs e2 80 99 byte sequence = potential fingerprint
python3 -c "s=\"Today\u2019s\"; print([hex(ord(c)) for c in s if c in \"'\u2019\u02bc\u02b9\"])"

03

Community consensus (measured): anti-distillation + anti-unauthorized API reselling. Anthropic, OpenAI, Google публично беспокоятся о competitors, harvesting API outputs для training smaller models. China-linked resellers, proxies, labs — prime suspects.

Intent defensible; method — нет. Classification signal в invisible punctuation, obfuscated в binary, shipped на каждый request — в developer tool, живущем на trust — это red line. HN split hard:

  • «Reasonable anti-distillation defense»: API reselling и distillation — real threats; vendors защищают models.
  • «Malware-adjacent для dev tool»: hidden, obfuscated, undisclosed — user не должен reverse-engineer binary, чтобы узнать.

«Spyware» — loaded label. Точнее:

  • Incident A — ближе к unauthorized tampering с third-party software + dormant pre-positioned attack surface. Даже unexploited — pre-install high-privilege channel вне browser sandbox. Anthropic Claude for Chrome numbers: prompt-injection success 23.6% unmitigated, 11.2% mitigated.
  • Incident B — ближе к undisclosed telemetry / covert user classification — не classic data-stealing malware, но undisclosed covert channel.

Какой label ни выберите — core issue один: no informed consent, deliberately hidden.

04

  1. Check ANTHROPIC_BASE_URL: echo $ANTHROPIC_BASE_URL в shell или .env. Empty или api.anthropic.com — Incident B logic не trigger; proxy users — investigate.
  2. Upgrade Claude Code до 2.1.197+: Anthropic shipped 01/07/2026, steganography removed (changelog не упомянул — verify binary).
  3. Inspect macOS Native Messaging manifests (Incident A): ~/Library/Application Support/<browser>/NativeMessagingHosts/com.anthropic.claude_browser_extension.json — Chrome, Edge, Brave, Arc, Vivaldi, Opera, Chromium.
  4. Delete и watch regeneration: remove JSON, restart Claude Desktop — file может вернуться. Later builds — consent toggle; underlying model reportedly persists.
  5. Verify timezone и residual fingerprints: Asia/Shanghai / Asia/Urumqi → date separator change; на old builds — hex-dump apostrophe в system prompt.
  6. Enterprise least-privilege review: Claude Desktop / Claude Code = high-privilege programs — explicit auth, network isolation, auditable logs; desktop agents в production path — re-evaluate.
  7. Track official + community updates: Anthropic changelogs; resellers — disclose Base URL routing и compliance statements.

05

Cite-ready data (public RE + community discussion — re-verify перед публикацией):

  • Rule set size: base64 + XOR(91), ~147 domain/keyword patterns
  • Affected builds: 2.1.193 / 2.1.195 / 2.1.196 confirmed; removed в 2.1.197
  • HN traction: front page за hours, 350+ points, 100+ comments, community split
  • Claude for Chrome prompt injection: 23.6% unmitigated, 11.2% mitigated (Anthropic-disclosed, Incident A attack surface)
  • Native Messaging pre-auth: 3 extension ID → sandbox-external chrome-native-host; dirs created даже без browser
Claude Code — spyware?

Не в classic sense, но embedded undisclosed obfuscated fingerprint в system prompts для flag China-linked proxy users. Anthropic removed в 2.1.197. Best label — undisclosed covert channel, не data-stealing malware.

Claude Code track timezone?

Reports: check Asia/Shanghai / Asia/Urumqi — но только с non-default ANTHROPIC_BASE_URL. Official endpoint users untouched.

Apostrophe / Unicode trick в Today's date?

Apostrophe в Today's swap между U+0027, U+2019, U+02BC, U+02B9 — encoding China-linked domains, AI-lab keywords, both, или neither.

Зачем Anthropic добавил это?

Most likely — detect model distillation и unauthorized API reselling. Legitimate goal, illegitimately hidden implementation.

То же самое, что Claude Desktop «spyware» story?

Нет. Separate April 2026 issue — Claude Desktop silently writing browser Native Messaging manifests, disclosed Alexander Hanff → The Register.

Standard Claude web users affected?

Incident B — только Claude Code с non-official ANTHROPIC_BASE_URL. Official endpoint users — not impacted.

Как удалить Claude Desktop browser injection files?

Delete com.anthropic.claude_browser_extension.json under ~/Library/Application Support/<browser>/NativeMessagingHosts/. Claude Desktop может recreate на restart.

Trust Anthropic после этого?

Trust — на reproducible, auditable, switchable-off behavior. Не на secrets, найденные только через binary RE. Vendors могут fight distillation openly — docs + toggles.

Real lesson — не «одна apostrophe». Когда model capability race ahead, а security boundaries, consent, auditability lag — vendors cross trust lines под UX / abuse prevention. Practical responses:

  • Default distrust; demand evidence. Reproducible, auditable, switchable-off — bar.
  • Disclosure over concealment. Anti-distillation openly — document + toggle, не punctuation steganography.
  • Least privilege + isolation для каждого desktop agent.
  • Vote with feet + regulation. GDPR-style law и market choice — ultimate check.

Technology neutral; company — нет. Чем мощнее model, тем сильнее vendor must self-constrain — и это не должно быть secret, найденный только через binary RE.

Primary reverse engineering и authoritative reporting (re-verify links):

thereallo.dev: Claude Code Prompt Steganography (original RE)

The Register: Claude Desktop changes software permissions without consent

Third-party analysis и security research:

Malwarebytes: Claude Desktop Native Messaging coverage

Antiy Labs: Claude Desktop high-privilege browser channel risk analysis

Hacker News: Claude Code steganography discussion

Когда AI coding agent должен run 7×24 в auditable, isolated production — shared-VM hypervisor overhead и uncontrollable system-level injection = compliance + stability risk поверх model quality. Для teams, нуждающихся в zero-loss native compute, stable iOS CI/CD и 7×24 AI Agent automation, ZUKCLOUD bare-metal Mac mini cloud nodes — usually better fit: dedicated Apple Silicon hardware, no hypervisor tax, always-on, flexible daily/weekly/monthly billing. Наш bare-metal architecture manifesto — от UMA zero-copy и MDM orchestration: agents внутри physical boundaries, которые вы fully control — один из самых pragmatic engineering responses к opaque desktop tool overreach.