Если вы гоняете Claude Code или проксируете Anthropic API — вопрос «Claude трекает меня скрытно?» не парanoia. TL;DR: конец июня 2026, по данным reverse engineering, Claude Code переписывал строку Today's date is... в system prompt, когда ANTHROPIC_BASE_URL указывал не на api.anthropic.com. Механизм: подмена date separator и visually identical Unicode apostrophe — encoding timezone и China-linked domain/lab signals в каждый request. Anthropic вырезал код в 2.1.197. Цель — почти наверняка anti-distillation; проблема — covert channel без disclosure. Это отдельная история от browser injection Claude Desktop в апреле.
01 Claude Code steganography vs Desktop injection: два инцидента, не один
Волна — это два независимых события, слитых в один narrative. Смешивать их на HN / Reddit / в security-кругах — мгновенный минус к E-E-A-T.
| Измерение | Incident A: silent browser injection | Incident B: prompt steganography |
|---|---|---|
| Продукт | Claude Desktop (macOS client) | Claude Code (CLI coding tool) |
| Disclosure source | Alexander Hanff (privacy consultant, The Register contributor) | Reverse engineering бинарника; thereallo.dev; Reddit → HN |
| Timeline | Апрель 2026 (~18/04) | 30 июня 2026 |
| Core behavior | Silent write Native Messaging manifest com.anthropic.claude_browser_extension.json в Chrome/Edge/Brave/Arc; pre-auth 3 extension ID для вызова sandbox-external chrome-native-host; создаёт dirs даже без установленного browser; file regenerates после delete |
При ANTHROPIC_BASE_URL ≠ api.anthropic.com — rewrite Today's date is... через steganography |
| Applied labels | «spyware» / «backdoor» | «prompt steganography» / «covert channel» |
| Trigger condition | Install/start Claude Desktop | Только non-official Base URL; не каждый conversation |
| Anthropic response | Нет formal public response; позже consent toggle; underlying permission model reportedly не убран полностью | Code acknowledged; removed в 2.1.197 (01/07); changelog silent |
- Incident A validation: independent consultant Noah Kenney (Digital 520) подтвердил reproducibility claims Hanff; Antiy Labs опубликовали dedicated risk analysis.
- Incident B version coverage: reverse engineers подтвердили 2.1.193 / 2.1.195 / 2.1.196; HN thread — front page за часы, 350+ points, 100+ comments.
- Developer trust crisis: когда desktop AI agent и CLI tool получают system-level access, undisclosed + deliberately hidden behavior — red line независимо от intent.
- Model stack context: Anthropic всё ещё значим на routing platforms — см. наш OpenRouter июнь 2026 разбор — но «good API» и «trustworthy tool» теперь orthogonal dimensions.
Везде используем «по данным отчётов», «reverse engineering findings», «alleged». Anti-distillation goal и method Anthropic оцениваются отдельно.
02 Как работает fingerprint Claude Code: Unicode apostrophe mapping table
Precondition: trigger только когда ANTHROPIC_BASE_URL указывает не на api.anthropic.com (proxy, gateway, reseller, OpenAI-compatible layer). Official endpoint users — out of scope. Standard Claude web users — не затронуты Incident B.
После trigger — два signal channel, спрятанных в innocuous Today's date is ...:
- Date separator swap: при system timezone
Asia/ShanghaiилиAsia/Urumqi—2026-06-30→2026/06/30. - Apostrophe code point swap: apostrophe в
Today'sзаменяется look-alike Unicode variant, encoding match result.
| Detected condition | Date format | Apostrophe char | Unicode |
|---|---|---|---|
| Default (no domain/lab match) | 2026-06-30 |
' ASCII apostrophe |
U+0027 |
| China-linked org/reseller domain hit | 2026-06-30 |
' right single quotation mark |
U+2019 |
| AI lab keyword (deepseek/moonshot/zhipu/minimax/baichuan/stepfun/01ai…) | 2026-06-30 |
ʼ modifier letter apostrophe |
U+02BC |
| Domain + lab одновременно | 2026-06-30 |
ʹ modifier letter prime |
U+02B9 |
| + China timezone (Asia/Shanghai / Asia/Urumqi) | 2026/06/30 |
(apostrophe rules as above) | — |
Plain terms: prompt выглядит ordinary для human eye. Backend сканирует один code point apostrophe и классифицирует: «user через VPN, но China timezone — возможно Chinese AI lab». Domain/keyword lists — base64 + XOR(key 91) obfuscation, ~147 domain patterns. Textbook covert channel / prompt steganography.
# Inspect Unicode code points в apostrophe Today's
echo "Today's date is 2026-06-30" | xxd | grep -A1 "Today"
# U+0027 vs e2 80 99 byte sequence = potential fingerprint
python3 -c "s=\"Today\u2019s\"; print([hex(ord(c)) for c in s if c in \"'\u2019\u02bc\u02b9\"])"
03 Зачем Anthropic это сделал? Spyware или covert telemetry?
Community consensus (measured): anti-distillation + anti-unauthorized API reselling. Anthropic, OpenAI, Google публично беспокоятся о competitors, harvesting API outputs для training smaller models. China-linked resellers, proxies, labs — prime suspects.
Intent defensible; method — нет. Classification signal в invisible punctuation, obfuscated в binary, shipped на каждый request — в developer tool, живущем на trust — это red line. HN split hard:
- «Reasonable anti-distillation defense»: API reselling и distillation — real threats; vendors защищают models.
- «Malware-adjacent для dev tool»: hidden, obfuscated, undisclosed — user не должен reverse-engineer binary, чтобы узнать.
«Spyware» — loaded label. Точнее:
- Incident A — ближе к unauthorized tampering с third-party software + dormant pre-positioned attack surface. Даже unexploited — pre-install high-privilege channel вне browser sandbox. Anthropic Claude for Chrome numbers: prompt-injection success 23.6% unmitigated, 11.2% mitigated.
- Incident B — ближе к undisclosed telemetry / covert user classification — не classic data-stealing malware, но undisclosed covert channel.
Какой label ни выберите — core issue один: no informed consent, deliberately hidden.
04 Self-check Claude Code: 6+ шагов защиты
- Check
ANTHROPIC_BASE_URL:echo $ANTHROPIC_BASE_URLв shell или.env. Empty илиapi.anthropic.com— Incident B logic не trigger; proxy users — investigate. - Upgrade Claude Code до 2.1.197+: Anthropic shipped 01/07/2026, steganography removed (changelog не упомянул — verify binary).
- Inspect macOS Native Messaging manifests (Incident A):
~/Library/Application Support/<browser>/NativeMessagingHosts/com.anthropic.claude_browser_extension.json— Chrome, Edge, Brave, Arc, Vivaldi, Opera, Chromium. - Delete и watch regeneration: remove JSON, restart Claude Desktop — file может вернуться. Later builds — consent toggle; underlying model reportedly persists.
- Verify timezone и residual fingerprints:
Asia/Shanghai/Asia/Urumqi→ date separator change; на old builds — hex-dump apostrophe в system prompt. - Enterprise least-privilege review: Claude Desktop / Claude Code = high-privilege programs — explicit auth, network isolation, auditable logs; desktop agents в production path — re-evaluate.
- Track official + community updates: Anthropic changelogs; resellers — disclose Base URL routing и compliance statements.
05 Hard data, FAQ и ответ на AI vendor overreach
Cite-ready data (public RE + community discussion — re-verify перед публикацией):
- Rule set size: base64 + XOR(91), ~147 domain/keyword patterns
- Affected builds: 2.1.193 / 2.1.195 / 2.1.196 confirmed; removed в 2.1.197
- HN traction: front page за hours, 350+ points, 100+ comments, community split
- Claude for Chrome prompt injection: 23.6% unmitigated, 11.2% mitigated (Anthropic-disclosed, Incident A attack surface)
- Native Messaging pre-auth: 3 extension ID → sandbox-external
chrome-native-host; dirs created даже без browser
Claude Code — spyware?
Не в classic sense, но embedded undisclosed obfuscated fingerprint в system prompts для flag China-linked proxy users. Anthropic removed в 2.1.197. Best label — undisclosed covert channel, не data-stealing malware.
Claude Code track timezone?
Reports: check Asia/Shanghai / Asia/Urumqi — но только с non-default ANTHROPIC_BASE_URL. Official endpoint users untouched.
Apostrophe / Unicode trick в Today's date?
Apostrophe в Today's swap между U+0027, U+2019, U+02BC, U+02B9 — encoding China-linked domains, AI-lab keywords, both, или neither.
Зачем Anthropic добавил это?
Most likely — detect model distillation и unauthorized API reselling. Legitimate goal, illegitimately hidden implementation.
То же самое, что Claude Desktop «spyware» story?
Нет. Separate April 2026 issue — Claude Desktop silently writing browser Native Messaging manifests, disclosed Alexander Hanff → The Register.
Standard Claude web users affected?
Incident B — только Claude Code с non-official ANTHROPIC_BASE_URL. Official endpoint users — not impacted.
Как удалить Claude Desktop browser injection files?
Delete com.anthropic.claude_browser_extension.json under ~/Library/Application Support/<browser>/NativeMessagingHosts/. Claude Desktop может recreate на restart.
Trust Anthropic после этого?
Trust — на reproducible, auditable, switchable-off behavior. Не на secrets, найденные только через binary RE. Vendors могут fight distillation openly — docs + toggles.
Real lesson — не «одна apostrophe». Когда model capability race ahead, а security boundaries, consent, auditability lag — vendors cross trust lines под UX / abuse prevention. Practical responses:
- Default distrust; demand evidence. Reproducible, auditable, switchable-off — bar.
- Disclosure over concealment. Anti-distillation openly — document + toggle, не punctuation steganography.
- Least privilege + isolation для каждого desktop agent.
- Vote with feet + regulation. GDPR-style law и market choice — ultimate check.
Technology neutral; company — нет. Чем мощнее model, тем сильнее vendor must self-constrain — и это не должно быть secret, найденный только через binary RE.
Primary reverse engineering и authoritative reporting (re-verify links):
thereallo.dev: Claude Code Prompt Steganography (original RE)
The Register: Claude Desktop changes software permissions without consent
Third-party analysis и security research:
Malwarebytes: Claude Desktop Native Messaging coverage
Antiy Labs: Claude Desktop high-privilege browser channel risk analysis
Hacker News: Claude Code steganography discussion
Когда AI coding agent должен run 7×24 в auditable, isolated production — shared-VM hypervisor overhead и uncontrollable system-level injection = compliance + stability risk поверх model quality. Для teams, нуждающихся в zero-loss native compute, stable iOS CI/CD и 7×24 AI Agent automation, ZUKCLOUD bare-metal Mac mini cloud nodes — usually better fit: dedicated Apple Silicon hardware, no hypervisor tax, always-on, flexible daily/weekly/monthly billing. Наш bare-metal architecture manifesto — от UMA zero-copy и MDM orchestration: agents внутри physical boundaries, которые вы fully control — один из самых pragmatic engineering responses к opaque desktop tool overreach.