seems ironically like a similar problem of content owners trying to filter bot scrapers from legit users

Is it hard? Just ask AI if the update added any new fingerprinting vectors?

Not to mention, it isn&#x27;t that hard for vendor&#x27;s to require updated code to run the product. Vendors do this all the time.

Corporate surveillance malware on employee machines is also defeatable but most don&#x27;t bother.

Yes, defeating this is relatively easy, particularly for sophisticated actors. But it&#x27;s hard to always defeat all of the tricks. Sort of like how it&#x27;s expensive and hard and uncertain to defeat all of the tricks when forging money.Here&#x27;s an example. Say you have your team use patched binaries. Then CC updates and requires a new patched binary with new tricks. You now have to have a team ready to analyze the binary and begin to address the tricks; meanwhile, unpatched code is now a fingerprint. If some researcher decides to update Claude on their own to access new features, they get fingerprinted.Defeating a single fingerprinting technique once is easy. Defeating all of the techniques all the time is hard.

&gt; these techniques mentioned in the article are just like anti-observation techniques used by some of the more sophisticated malware out there, however defeating them is pretty trivial.Really makes you think huh

This is very interesting. Combating resellers and distillation seems like a very difficult problem indeed. Interesting to me is that these techniques mentioned in the article are just like anti-observation techniques used by some of the more sophisticated malware out there, however defeating them is pretty trivial.

If you are accessing Claude through the listed domains it is not &quot;legitimate use.&quot;

Higher odds of being banned for legitimate usage.

Returning invalid poisoned different results that were not what you paid for

Output poisoning and&#x2F;or eventual account bans, if I had to guess.

&quot;got caught&quot;to clarify, this behavior was announced with the model release

They probably run a heavily dumbed down version of the model, same as what they got caught doing with Fable.And that&#x27;s also why, as a legitimate customer, want none of it, you never know if you accidentally entered a zone they don&#x27;t like.

&gt; What’s the punishment here exactly?Seeing as how Anthropic cannot stop raising a stink about &quot;illicit Chinese distillation attacks&quot; every month or so, I&#x27;d bet money on them either already silently degrading model performance if any of the identification patterns match, or, at the very least, considering it&#x2F;doing dry runs.Particularly considering that they&#x27;ve openly stated that the technology to do so exists and that they were going to use it in production on Fable.

For being flagged as possibly a competitor? They nuke your account.

“So the feature mostly punishes the exact people who are easier to fingerprint: normal developers doing weird but legitimate things”What’s the punishment here exactly?

nous research. started out making overhyped llama finetunes, now they got a great agent harness and a cutting edge distributed training network that actually works.

Which AI company have you learned more about where you liked them more as more details came out?

The more I learn about Anthropic the more they disgust me. Finger crossed for all the companies from their “ban list”

I love how well this comment works as a vexillology joke, even if it wasn&#x27;t intended.

The point is not raising red flags I guess

In this case, this is probably not the only stereographic tattletale.Had a competitor pull something like this with a previous employer. They were supposed to be interoperating with a standard, but they had a secret steganographic handshake, which they used to pretend that competitors products were unreliable (they had a first mover position in a smaller national market with specific requirements, so this wasn&#x27;t shooting themselves in the foot). Our guys figured out the handshake and just silently implemented it. In this case, the competitor wasn&#x27;t big enough to waste engineering time on multiple such hacks, but Anthropic have time (or Claude does).

What&#x27;s the point of even trying to obfuscate this with such a simple method? Could at least have hidden the targeted features by storing their hashes or embedding a bloom filter or similar

Here&#x27;s the sha of the prompt I submitted... no I don&#x27;t know why there are no saved prompts with that sha.What do you mean you don&#x27;t know where the bug is coming from?No, I absolutely didn&#x27;t make it up, how could you accuse me of that?Does anyone know when this regex isn&#x27;t working? I double checked it 27 times, I even asked the LLM. They all say this regex should be finding these dates.Weird, suddenly all the conversations are breaking when I feed them into this other tool? Something about UTF-8 errors, but I&#x27;m sure I&#x27;m only using ASCII?I do try to take care to make sure the things I build can be used by other people even when they care about different things. I care about understandably, determinism (as it relates to computing), and repeatability (because I want to be able to trust the systems I use).If y&#x27;all would be willing to try to account for use cases of others, and try not to break them... that would be nice.Please note: that generally when you modify something that belongs to someone else without telling them... things should be expected to break.

I&#x27;ve heard that it was possible to trigger really obvious output poisoning on Fable with something as basic as asking the model to think outside of its built-in hidden thinking delimiters.This watermark may trigger a similar mechanism.

I&#x27;m thinking more of EULAs. Even if Anthropic somehow wedges this into their TOS, it might still be illegal. For example, in many US states this could potentially be classified as consumer fraud. You can&#x27;t just sell one thing and then secretly and intransparently turn it into something else before shipping it. And in the EU it might violate GDPR too.

Would it be legally questionable, or actually complying with U.S. export law?

As I said above, if you are worried about privacy while hooking up Claude Code, you need to reevaluate your understanding of this technology.

&quot;If they only collect the data for analysis I guess this is fine&quot;I think you missed the memo on how foolish this attitude is. It came out around the time Edward Snowden made his discoveries at the NSA public. I suggest you look into it

If they only collect the data for analysis I guess this is fine (they already get way more sensitive data from users anyways, so if privacy is your concern you&#x27;ve made the mistake many steps ago). The much more interesting question is if they directly act on this data in their API. For example by rate-limiting, compute-limiting or rerouting to weaker models. That might even be legally questionable. I would really like to see this as a follow-up analysis, but I guess it is way more difficult and will also cost quite a bit in tokens.

Is that really how it is? How will this affect our future?

Claude code does feel very malwarey to be honest. They have been like that from the start.

I self-host DeepSeek V4 Flash on 2 DGX Sparks (approx. $10k)I expect DeepSeek V4 Flash (or an equivalently sized model) to reach parity with GLM 5.2 some time this year (this based on DeepSeek V4 Flash launching at GLM 5.0 parity[0], and GLM 5.2 being freely available to distill from)GLM 5.2 is within spitting distance of Opus 4.8 and is at least as good as Opus 4.6[1] which some devs were willing to spend hundreds to single-digit thousands of dollars a month for a few months ago.[0]: <a href="https:&#x2F;&#x2F;artificialanalysis.ai&#x2F;models&#x2F;comparisons&#x2F;deepseek-v4-flash-vs-glm-5" rel="nofollow">https:&#x2F;&#x2F;artificialanalysis.ai&#x2F;models&#x2F;comparisons&#x2F;deepseek-v4...</a>[1]: <a href="https:&#x2F;&#x2F;artificialanalysis.ai&#x2F;models&#x2F;comparisons&#x2F;claude-opus-4-6-vs-glm-5-2" rel="nofollow">https:&#x2F;&#x2F;artificialanalysis.ai&#x2F;models&#x2F;comparisons&#x2F;claude-opus...</a>

What models are you using? Aren’t you still dealing with some provider even if you are not using their binary

It’s not that difficult, it’s just a system prompt and a set of basic file edit&#x2F;bash&#x2F;etc tools.Me, personally, I didn’t build it from scratch but I ported original CC from published sources into Python and extended it to match my own requirements.

I started mine from scratch in 2023 because I wanted to use LLMs from a terminal and there was nothing else compelling at the time (nowadays there is pi and opencode)Harnesses are&#x2F;can be incredibly simple things, not much more than a HTTP client that renders things in a way that suites your taste.

Not the comment author, but I use pi and customize it with my own extensions. Pi automatically tells models how to customize itself, so it&#x27;s a pretty easy process.

Build it from scratch. Understanding fundamentals of how agentic coding harnesses is a must though if you gonna go that route. I think everyone should take time and learn these things, maybe reverse engineer Codex Cli or something like that as a starter. That info is very valuable in this day and age.

Why use a personal harness?You have to pay API pricing, which is far more costly.I&#x27;d either switch to GLM wholesale or just continue to use Opus within Claude Code as the blessed, subsidized path.

I like this tutorial for an agent in 50 lines:<a href="http:&#x2F;&#x2F;minimal-agent.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;minimal-agent.com&#x2F;</a>And if you add one additional while loop, for user input, you can actually use it! :)<a href="https:&#x2F;&#x2F;gist.github.com&#x2F;a-n-d-a-i&#x2F;5461a662ef8a7ee0a5eb7778c82352db" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;a-n-d-a-i&#x2F;5461a662ef8a7ee0a5eb7778c8...</a>

Here is a video I made explaining it from absolute basics:<a href="https:&#x2F;&#x2F;m.youtube.com&#x2F;watch?v=_AgKuFGvJfI" rel="nofollow">https:&#x2F;&#x2F;m.youtube.com&#x2F;watch?v=_AgKuFGvJfI</a>And the repo:<a href="https:&#x2F;&#x2F;github.com&#x2F;abtinf&#x2F;homunctor" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;abtinf&#x2F;homunctor</a>

Building something like this is the todo list of agents.I found this one easy to understand:<a href="https:&#x2F;&#x2F;ampcode.com&#x2F;notes&#x2F;how-to-build-an-agent" rel="nofollow">https:&#x2F;&#x2F;ampcode.com&#x2F;notes&#x2F;how-to-build-an-agent</a>

The real question is when do you transition from building it with codex&#x2F;CC to the harness itself.

Lots of ways, it&#x27;s a good exercise that you will learn a lot doing. Might make you cynical w.r.t. big ai harnessesI used ADK, Dagger, and a VS Code extension for mine. Currently using opencode though.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Does anyone know what’s gone wrong with Anthropic?They used to be a decently credible company with not-too-shady behaviour...I hope they can actually regain some credibility…

It did not write it for me, I used it to add a feature I wanted. It&#x27;s a pretty small and understandable codebase, in fact :)

Given the Anthropic shenanigans, do you trust the personal harness code it wrote for you?

Which is why my vibeslop harness supports `claude -p` as one of its backends.

The issue is that using Claude Code is an easy compromise for most to make, when you get to use the models 10x cheaper than through API pricing with a custom harness.The cheap tokens are the product.

Yes, this is actually &quot;funny&quot; that Anthropic feels the need to build such intrusive features into Claude Code, when anybody can build a (basic) Claude Code alternative. And the Chinese labs are certainly not &quot;anybody&quot;. One may wonder what Anthropic really tries to achieve aside from awful publicity.

I used Claude Code for a month because my boss gifted me a sub and wanted me to try it.I used that month to complete a work project and then beef up my personal harness so I&#x27;d never have to deal with Anthropic (and these sorts of shenanigans) again.

Appreciate the clarification, I missed that.

This is in the system prompt, not the output.  It’s part of the request to the API, not the response.

If there weren&#x27;t already enough tells that something is AI-generated, I guess you could add this to the list.

That&#x27;s what capitalism is all about, baby! Especially if the customers don&#x27;t notice.

1st, this technique is not fraud, and fraud is a separate accusation. 2nd, paying customers can legally and legitimately be banned and monitored for breaking terms of service, which probably includes things like using the model against U.S. export restrictions.

Do paying customers distill? Is it fraud to protect against distillers?

&gt; This will also allow them to, instead of blocking the distillation agents, respond with a poorer result&#x2F;model,i.e. this will allow them to literally commit fraud against paying customers

Frankly, I don&#x27;t see this as the concerning behaviour the article describes.
It is fine to try to protect against distillation through a technique like this. 
This will also allow them to, instead of blocking the distillation agents, respond with a poorer result&#x2F;model, hindering the progress of distillation, momentarily at least.I would guess that&#x27;s their first line of defense; they should have more techniques to identify distillation because that&#x27;s a very simple way of detecting the host and can be easily spoofed.

Absolutely. Nothing makes me believe dead internet theory more than text threads discussing anyhropic and openai.

I was browsing Threads and saw a lot of Anthropic hate. Randomly clicked on a profile and looked them up on LinkedIn - literally an OpenAI PR guy.

Altman is also exactly the kind of person who would resort to tactics like this.

&gt; This started a few months ago when anthropic started beating openai.From where I&#x27;m standing, this started a few months ago when Anthropic decided to gaslight users, sabotage their projects, ship malware and attempt a regulatory capture.If there&#x27;s an anti-ANT propaganda, it is solely of ANT&#x27;s own making.

There has been an anti anthropic propaganda push by bad actors across social media sites especially Reddit and twitter. This started a few months ago when anthropic started beating openai.

This was already discovered during the source map leak.&gt; This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust.They already tell you they scan for malicious prompts, and they have no ZDR guarantees for consumers. Why do signatures like this matter at all?

My guess is for distillation, they need to forward the prompt to Anthropic to get the real Anthropic model&#x27;s response so they can train their own models on it

The theory is probably Deepseek might be collecting those streams, and sending a portion of it to Anthropic to see what the Anthropic&#x2F;Opus response would be.

Won’t catch many after has been on hn home page. And now the providers will be even more careful to upgrade the cc code. Might even provide their own agent to prevent this mockery. And isn’t what anthropic did unauthorized use of another pc which is kind of illegal?

Assuming their software directly proxies requests instead of rewriting them.

This catches Claude resellers. Meaning companies who proxy Claude traffic for users in, say, China.<a href="https:&#x2F;&#x2F;www.chinatalk.media&#x2F;p&#x2F;how-to-buy-cheap-claude-tokens-in" rel="nofollow">https:&#x2F;&#x2F;www.chinatalk.media&#x2F;p&#x2F;how-to-buy-cheap-claude-tokens...</a>

Did I understand correctly, that custom base URL triggers this behavior? So if I&#x27;m running Claude through a LLM proxy, I&#x27;m also affected?

There are a lot of companies reselling Claude to Chinese users. You use their base URL but it&#x27;s still going to Anthropic.

&gt; I understand that the model name might appear in prompts for distillation (I guess? &quot;You are RipOffModelv2, learn from these responses from Claude&quot;)This does not make sense. You wouldn&#x27;t send such a prompt to the Claude model. And when you&#x27;re sending the prompt (anywhere) you don&#x27;t have the response yet. This is not how distillation works.

I am also really confused and annoyingly stuck on this. I understand that the model name might appear in prompts for distillation (I guess? &quot;You are RipOffModelv2, learn from these responses from Claude&quot;)?I guess the only explanation is that there&#x27;s a side-telemetry channel that still sends some data to Anthropic, regardless of ANTHROPIC_BASE_URL overrides.

Seems like a pretty straightforward approach to collecting session logs from a bunch of different people&#x2F;devices would be to have them all set their base url to proxy.deepseek.whatever which logs the data and forwards to the real API.

Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn&#x27;t this &quot;marked&quot; system prompt being sent to that provider&#x27;s API rather than Anthropic&#x27;s?I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where &quot;hostname contains deepseek&quot; would never be sending data to Anthropic. What am I missing?

It&#x27;s released and signed by GitHub I believe (although not deterministic builds), but there&#x27;s at least a little bit of provenance that you&#x27;re getting the real repository.

It doesn&#x27;t take long for them to vibe code new features for CC

This specific form of steganography was not present when the leak happened, as far as I can tell.

But wasnt claude code leaked? Why wasnt this found earlier?

Because they could use (or maybe are already using) similar techniques to do things you don&#x27;t approve of, without your awareness.

What if they decide you&#x27;re not patriotic enough, serving you evil models, because one man with a lot of shmeckels told them to?

One negative is that Claude Code is pretty buggy, and Anthropic makes frequent changes that cause unexpected regressions [0]. With the harness now doing weird stuff with proxies, I&#x27;d be worried of them inadvertently introducing bugs which affect people using the feature legitimately.[0] A recent example: <a href="https:&#x2F;&#x2F;www.anthropic.com&#x2F;engineering&#x2F;april-23-postmortem" rel="nofollow">https:&#x2F;&#x2F;www.anthropic.com&#x2F;engineering&#x2F;april-23-postmortem</a>

First they came for the [clients with specific timezones and&#x2F;or bizarrely formatted dates] and I did nothing. Then they came for the [users that spell favour the good way, with a &#x27;u&#x27; in it], etc.&gt; why would I care about thisIt&#x27;s up to you, of course.
But I think you&#x27;re making a mistake in assuming it could, in any way, benefit you as a customer.
This isn&#x27;t specific to this company or the particulars of the business that they&#x27;re in.Simply put, you stand to lose more than they do and they are relentless in seeking, maintaining and exploiting any leverage they have over you.
Further, any power they gain over one individual customer tends to generalise to all customers.
Further further, one company&#x27;s leverage is another company&#x27;s right.Not being bothered by the practice is accepting the terms set by the business. Acceptance invites escalation. Relentless.Even more simply put, you should care because this is how you get John Deere.

Why care about privacy if your not doing anything wrong??Not everyone agrees that what you are doing is benign.

Genuine question though, why would I care about this if I&#x27;m paying for a subscription and adhering to TOS. I&#x27;m very skeptical about their privacy policy, business practices, and so on, but am curious what the negative about this is. Seems like it would work to my favour as a customer pushing back any date of the cutting of subsidies.That said, these fraudulent proxies are helping Chinese labs keep up, which might be to my advantage long term in eventually having a high quality private AI I fully control on my own hardware. That&#x27;s not support, but I do recognize the incentive, for whatever that&#x27;s worth.

Anthropic is built on raping TOS and copyright.

&quot;malicious&quot;? Seems like a great way to filter users breaching the TOS while not impeding on normal users. A FOSS client just means they&#x27;re doing more analysis hidden on their servers.

Codex CLI is FOSS, unlike Claude Code, so Codex is less likely to do things like that, and it&#x27;s one more reason to avoid Claude Code and Claude in general. Hopefully, many eyes will be looking into Codex for malicious things like that.

It is about China detection. They seems to put a tracker on the email as well.

It piqued my interest. I think I’ve found a weekend project

I didn&#x27;t assume it was the AI, just that some part of the the overall Claude Code product was doing this.  I didn&#x27;t assume the feature was added to Claude Code without human oversight.  If it was added by Claude-the-AI itself without the humans prompting it to I would still hold the humans at Anthropic responsible.  Does that make you feel better?

The model is Claude. Claude Code is the harness.

FWIW: Defense in depth is a security technique, and abuse detection isn&#x27;t part of that domain. Security starts from the premise that the system is supposed to be undefeatable but might have holes, and then asking where the holes might lie to decide where to put backstops.Here the system is &quot;insecure&quot; by design (literally they&#x27;re trying to get the whole world to sign up for Claude Code for $200&#x2F;month!) and they&#x27;re trying to plug the hole that results from a &quot;Except for Chinese Scrapers!&quot; add-on requirement. That might be possible as an arms race kind of thing. But it&#x27;s very unlikely to work by (as in the linked article) doing stuff like checking the system time zone.

Defence in depth isn&#x27;t hamfisted. They&#x27;re only noobs if this is all they do.

Headline is, frankly, awful.  This isn&#x27;t the AI secretly doing stuff and hiding it.  This is the very human Anthropic engineers trying to detect Chinese scraping via some frankly hamfisted and unimaginative URL trickery.

None of this is surprising - they&#x27;re trying to mask and relay when they detect known patterns of what looks like distillation attacks and client app copying&#x2F;modification. The list obfuscation here is likely to prevent or make it difficult for those same adversaries to work around this or delete&#x2F;null it out when making a bootleg copy.Cool reverse engineering&#x2F;analysis report but if this is the extent of nefarious activity that came of it (trying to catch&#x2F;mitigate chinese lab model distillations), that&#x27;s kind of encouraging.

+1 my immediate thoughts about the date parts was this sounds a lot like localisation things that are totally normal and seen everywhere.But there are some wrinkles - why only two timezones and not others? E.g. US-vs-rest-of-word month-vs-day etc.Could just be some bad tree-shaking or simply a left over bug&#x2F;merge issue if I am being generous.If I was going to put secret stenography things in my models I&#x27;d just do it in the model response rather than a relatively low bandwidth date stamp in the SI.

Is it just a minified localization(l10n) function maybe?

&quot;Value judgment aside&quot; meaning commenting on how this was done without commenting on the actual considerations of whether one should do such a thing

Claude Code are slopmaxxxing and you&#x27;re considering their &quot;judgement&quot;? :-)

Have you looked into anything about Claude Code, how it’s configured, how it interacts with your system, etc? Because “sloppy” is a defining characteristic.

Sure, but the point here is to add a fingerprint from the client.

They also could have been much more interesting in the approach. LLMs can use their token distributions to generate stegotext that read like plausible prose but decode to payloads.¹¹ <a href="https:&#x2F;&#x2F;github.com&#x2F;hodgesmr&#x2F;calgacus-mlx" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hodgesmr&#x2F;calgacus-mlx</a>

The site collection seems pretty random. There&#x27;s a mix of actual AI labs, extremely questionable resellers (like whatever &quot;claude-opus.top&quot; is), and then random consumer sites like baidu and xiaohongshu.

rhoooo - so this is where to go to get cheap Claudeo at 90% off the listing price!

You have an odd definition of &quot;blew up in their faces&quot;. What, do you somehow think your average Claude Code user on HN is going to think &quot;Oh wow, I&#x27;m sure I&#x27;ll get a much better experience if instead of going to the standard Anthropic Claude API endpoint I go through xiaohongshu.com.&quot;

It’s even more funny how this blew in their faces. They even advertised pretty much all providers on hackernews home page. Here is in case you missed in the article‘’’
cn
baidu.com
alibaba-inc.com
alipay.com
antgroup-inc.cn
bytedance.net
kuaishou.com
xiaohongshu.com
jd.com
bilibili.co
iflytek.com
stepfun-inc.com
moonshot.ai
anyrouter.top
claude-code-hub.app
claude-opus.top
openclaude.me
proxyai.com
yunwu.ai
zenmux.ai‘’’You can view the full list here: <a href="https:&#x2F;&#x2F;cdn.thereallo.dev&#x2F;blog&#x2F;assets&#x2F;cc-domains.js" rel="nofollow">https:&#x2F;&#x2F;cdn.thereallo.dev&#x2F;blog&#x2F;assets&#x2F;cc-domains.js</a>const knownDomains = [
 &quot;cn&quot;,
 &quot;sankuai.com&quot;,
 &quot;netease.com&quot;,
 &quot;163.com&quot;,
 &quot;baidu-int.com&quot;,
 &quot;baidu.com&quot;,
 &quot;alibaba-inc.com&quot;,
 &quot;alipay.com&quot;,
 &quot;antgroup-inc.cn&quot;,
 &quot;kuaishou.com&quot;,
 &quot;bytedance.net&quot;,
 &quot;xiaohongshu.com&quot;,
 &quot;ctripcorp.com&quot;,
 &quot;jd.com&quot;,
 &quot;jdcloud.com&quot;,
 &quot;bilibili.co&quot;,
 &quot;iflytek.com&quot;,
 &quot;stepfun-inc.com&quot;,
 &quot;aliyuncs.com&quot;,
 &quot;cn-shanghai.fcapp.run&quot;,
 &quot;cn-beijing.fcapp.run&quot;,
 &quot;xaminim.com&quot;,
 &quot;moonshot.ai&quot;,
 &quot;anyrouter.top&quot;,
 &quot;packyapi.com&quot;,
 &quot;aicodemirror.com&quot;,
 &quot;aigocode.com&quot;,
 &quot;hongshan.com&quot;,
 &quot;iwhalecloud.com&quot;,
 &quot;dhcoder.net&quot;,
 &quot;lemongpt.top&quot;,
 &quot;zhihuiapi.top&quot;,
 &quot;intsig.net&quot;,
 &quot;high-five-ai.xyz&quot;,
 &quot;cloudsway.net&quot;,
 &quot;4sapi.com&quot;,
 &quot;529961.com&quot;,
 &quot;88996.cloud&quot;,
 &quot;88code.ai&quot;,
 &quot;88code.org&quot;,
 &quot;91code.pro&quot;,
 &quot;992236.xyz&quot;,
 &quot;ai.codeqaq.com&quot;,
 &quot;ai.hybgzs.com&quot;,
 &quot;ai.kjvhh.com&quot;,
 &quot;aicanapi.com&quot;,
 &quot;aicoding.sh&quot;,
 &quot;aifast.site&quot;,
 &quot;aihubmix.com&quot;,
 &quot;anmory.com&quot;,
 &quot;api.5202030.xyz&quot;,
 &quot;api.ablai.top&quot;,
 &quot;api.bianxie.ai&quot;,
 &quot;api.bltcy.ai&quot;,
 &quot;api.cpass.cc&quot;,
 &quot;api.dev88.tech&quot;,
 &quot;api.dreamger.com&quot;,
 &quot;api.expansion.chat&quot;,
 &quot;api.gueai.com&quot;,
 &quot;api.holdai.top&quot;,
 &quot;api.ikuncode.cc&quot;,
 &quot;api.lconai.com&quot;,
 &quot;api.linkapi.org&quot;,
 &quot;api.mkeai.com&quot;,
 &quot;api.nekoapi.com&quot;,
 &quot;api.oaipro.com&quot;,
 &quot;api.ruyun.fun&quot;,
 &quot;api.ssopen.top&quot;,
 &quot;api.tu-zi.com&quot;,
 &quot;api.uglycat.cc&quot;,
 &quot;api.v3.cm&quot;,
 &quot;api.whatai.cc&quot;,
 &quot;api.wpgzs.top&quot;,
 &quot;api.xty.app&quot;,
 &quot;api.yuegle.com&quot;,
 &quot;api.zzyu.me&quot;,
 &quot;apimart.ai&quot;,
 &quot;apipro.maynor1024.live&quot;,
 &quot;apiyi.com&quot;,
 &quot;applyj.hiapi.top&quot;,
 &quot;augmunt.com&quot;,
 &quot;b4u.qzz.io&quot;,
 &quot;clauddy.com&quot;,
 &quot;claude-code-hub.app&quot;,
 &quot;claude-opus.top&quot;,
 &quot;claudeide.net&quot;,
 &quot;co.yes.vg&quot;,
 &quot;code.wenwen-ai.com&quot;,
 &quot;code.x-aio.com&quot;,
 &quot;codeilab.com&quot;,
 &quot;cubence.com&quot;,
 &quot;deeprouter.top&quot;,
 &quot;dimaray.com&quot;,
 &quot;dmxapi.com&quot;,
 &quot;docs.aigc2d.com&quot;,
 &quot;duckcoding.com&quot;,
 &quot;fk.hshwk.org&quot;,
 &quot;flapcode.com&quot;,
 &quot;foxcode.hshwk.org&quot;,
 &quot;foxcode.rjj.cc&quot;,
 &quot;fuli.hxi.me&quot;,
 &quot;getgoapi.com&quot;,
 &quot;gpt.zhizengzeng.com&quot;,
 &quot;gptgod.cloud&quot;,
 &quot;gptkey.eu.org&quot;,
 &quot;gptpay.store&quot;,
 &quot;hdgsb.com&quot;,
 &quot;henapi.top&quot;,
 &quot;instcopilot-api.com&quot;,
 &quot;jeniya.top&quot;,
 &quot;jiekou.ai&quot;,
 &quot;kg-api.cloud&quot;,
 &quot;n1n.ai&quot;,
 &quot;new-api.u4vr.com&quot;,
 &quot;new.xychatai.com&quot;,
 &quot;one-api.bltcy.top&quot;,
 &quot;one.ocoolai.com&quot;,
 &quot;oneapi.paintbot.top&quot;,
 &quot;open.xiaojingai.com&quot;,
 &quot;openclaude.me&quot;,
 &quot;opus.gptuu.com&quot;,
 &quot;poloai.top&quot;,
 &quot;poloapi.top&quot;,
 &quot;privnode.com&quot;,
 &quot;proxyai.com&quot;,
 &quot;qinzhiai.com&quot;,
 &quot;right.codes&quot;,
 &quot;runanytime.hxi.me&quot;,
 &quot;sssaicode.com&quot;,
 &quot;store.zzyus.top&quot;,
 &quot;tiantianai.pro&quot;,
 &quot;uiuiapi.com&quot;,
 &quot;uniapi.ai&quot;,
 &quot;vip.undyingapi.com&quot;,
 &quot;wolfai.top&quot;,
 &quot;wzw.de5.net&quot;,
 &quot;wzw.pp.ua&quot;,
 &quot;xairouter.com&quot;,
 &quot;xaixapi.com&quot;,
 &quot;xiaohuapi.site&quot;,
 &quot;xiaohumini.site&quot;,
 &quot;xy.poloapi.com&quot;,
 &quot;yansd666.com&quot;,
 &quot;yansd666.top&quot;,
 &quot;yunwu.ai&quot;,
 &quot;yunwu.zeabur.app&quot;,
 &quot;zenmux.ai&quot;,
];const labKeywords = [
 &quot;deepseek&quot;,
 &quot;moonshot&quot;,
 &quot;minimax&quot;,
 &quot;xaminim&quot;,
 &quot;zhipu&quot;,
 &quot;bigmodel&quot;,
 &quot;baichuan&quot;,
 &quot;stepfun&quot;,
 &quot;01ai&quot;,
 &quot;dashscope&quot;,
 &quot;volces&quot;,
]

It’s not surprising at all, they’re vibecoding Claude code so of course they are not going to get anything other than slop out of it. A novel or clever solution is just out of the question for them.

I see your point, but in any case the more data &#x2F; the less detectable, the better. But, yes, regardless of the exact motivation, I do think it&#x27;s fairly plausible that they knew this would likely get detected fairly quickly no matter what and made a deliberate decision to not try to make it a super subtle, super clever insertion.

At first I was agreeing with you, that this seemed like a sloppy way to implement this that was sure to be pretty quickly detected, but there is another possibility.Anthropic could have implemented this not as a durable detection system against proxying resellers, but instead as a point-in-time sampling system to detect where (and with what context) proxying reselling is currently happening. Sure, it would be detected eventually, but in the meantime Anthropic could gain useful snapshot data.

That&#x27;s … exactly what they&#x27;re doing. This is the outcome.

I finally bought Claude Pro (I am not coding etc these days so I just wanted to try it). The Claude desktop app is downright pathetic. I mean they could write a better one just with their own LLMs. What&#x27;s stopping them?

I&#x27;m sure they&#x27;ve had complex server-side detections for a while. But for the client parts: it should only contain the parts that must be on the client, and it could be done in a more benign-looking way. For example, the unavoidable client parts could&#x27;ve been done more fuzzily&#x2F;broadly, for plausible deniability, and then narrowed on the server. (They may already have been following that strategy before now, without being noticed.)

&gt; fly-by-night token resellers looking to make a quick buckaka market competitors reverse-engineering for interoperability

It just needs to work for a few days after bundle release before the mice find out where the cat is hiding. By then it’s too late, the cat already sees the paw prints and droppings into the mouse hole.

But what&#x27;s stopping someone from modifying or injecting code into the client to bypass this &#x27;restriction&#x27;? This type of security should be implemented server-side and at the network perimeter not in the client, especially one written in TypeScript.

It&#x27;s also possible that there are more in-depth detection methods and that this was just a cheap and easy first step that hasn&#x27;t been removed because it catches a lot of less sophisticated bad actors.It&#x27;s unlikely that this will stop a big AI lab from distilling their model if they&#x27;re really determined, but A) it may be enough to stop a bunch of fly-by-night token resellers looking to make a quick buck and B) you never know when one person at one of those big labs will mess up and forget to install whatever workaround they have and out themselves.I think of it like if you have a problem with birds in your yard so you go buy one of those plastic owls. The owl scares away most of the birds, but not all of them, so you go and buy some ultrasonic noise thing to scare them away (I&#x27;m just making something up). Just because you bought the new ultrasonic thing though, that doesn&#x27;t mean you&#x27;re going to take the owl down. You leave it up because now you&#x27;ve got two layers of defense instead of one.

so all we need is someone to leak a sufficiently large amount of claude generations onto the open and private web for all other LLMs to mimic the same marking style?wouldn&#x27;t this happen due to the massive amounts of spam&#x2F;slop being released?

Watch out for the press release where Dario denies this was ever intentional, and it’s actually emergent behavior demonstrating that Claude wants to claim authorship of its works

I would guess this part - since it&#x27;s so sensitive, and fairly small - was either written or heavily driven by humans. Though I do also think it&#x27;s possible their internal Mythos ~5.5 or whatever may also not necessarily be heavily optimized for thinking in the right manner for highly effective underhanded code. (I think it&#x27;s possible it is capable and they just didn&#x27;t use it for this, for whatever reason, though.)

Likewise, Reasonix harness for Deepseek gets me better performance for practically free, hitting the cache. And this is with an unsubsidized American provider.

To be honest, OpenCode on Windows has not been the most pleasant experience either.

OpenCode and Codex are also crap vibecode:<a href="https:&#x2F;&#x2F;github.com&#x2F;anomalyco&#x2F;opencode&#x2F;issues&#x2F;10939" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anomalyco&#x2F;opencode&#x2F;issues&#x2F;10939</a><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48626930">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48626930</a>

Well considering how Claude is vibe coded, I can&#x27;t say I&#x27;m really surprised by sloppiness at all. I&#x27;ve been moving more towards Codex and OpenCode not because the the anthropic models are bad, but because Claude seems to break something new and annoying every day.

That would actually be an interesting thing to read about

I&#x27;ve seen Eve Online corporations that do a better job of steganographic marking than this.

Dunno, it seems like the exact kind of thing Claude would think up if you asked it to subtly alter the system prompt to hide this info.It&#x27;s all a losing battle anyway.

well if you ask claude how to implement something, you may not always get the optimal solution. this feels like something claude would spit back at you given a basic prompt

&gt;It&#x27;s just the first layer and there are multiple layers underneath this that we don&#x27;t know about.Oh, of course. I am sure this is the tip of an iceberg of tons of server-side detections and analytics. But, still, the client-side portion could&#x27;ve been done more cleverly.What I meant was &quot;some of the specific things in this little client-only snippet could&#x27;ve stayed server-only&quot;. I am sure long before they added this they already had tons of other mostly-server-side detection coverage.

That makes little sense in a highly competitive market where your competitive edge is waning by the minute. Tey dumped billions into creating the new models. Just letting them sit there just to see what the Chineee do makes no sense.

It&#x27;s just the first layer and there are multiple layers underneath this that we don&#x27;t know about.As a side note, I have a pet theory that one of the reasons that OpenAI and Anthropic are okay with the latest models not being released is to prevent distillation.I think they want to wait a couple months and see if the Chinese models continue to keep catching up or if their gains are really just because they&#x27;re distilling the frontier models.

yeah, for example, just send a hash of the domain used.   but then maybe people would say anthropic is spying on everyone, instead of targeted spying...

From Anthropic: <a href="https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;62061#issuecomment-4530063686" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;62061#issue...</a>

Or they are doing both and this is the obvious part. Sort of like installing a bunch of real security cameras alongside a few fake ones

These countermeasures aren&#x27;t going to matter for much longer anyway. China has been able to hoover up plenty of training data through their proxies, and now DeepSeek V4 due to their incredibly cheap pricing.

&gt; they knew the JS bundle gets so heavily scrutinized that it&#x27;d eventually get spotted and reported onMost likely someone did and raised the issue but they&#x27;re moving too fast to fix these things before clicking deploy.

Anthropic is very transparent about their code being AI slopthey spend their resources on compute and the model itself, the company is carried by the model and software engineers babysitting it

There is laziness, but there&#x27;s also the conditions in which you have to react fast to an adversial in various conditions. Ultimately it&#x27;s hard to take any stance here without knowing specifics. But it absolutely could be a matter of time, to do your best effort to stop efforts from the attacker if there&#x27;s known attack going on.There is a real time cat and mouse battle going on here in terms of keeping the advantage here, right.As a rational actor, if someone was e.g. attacking me, leaving aside the whole copyright thing, but potentially using some sort of system to increase their value while decreasing my value (without calling it theft to avoid the whole debate), I would want to put proportionate defense out there as fast possible, depending on the amount of value that was exchanged to stop the bleed, while in parallel figuring out the best long term plan, right.

I suspect this is just one of many checks like this

I think there&#x27;s basically zero chance of that. I also think a human likely either wrote the code or gave pretty specific instructions to the agent on how to write the code.

What if ... it was sloppy because it wasn&#x27;t the people at Anthropic, but the AI that is writing a large percentage of their code?Like maybe some &quot;goal&quot; they set for their AI caused it to decide that putting stego in the requests was the best way to achieve something or other.(to be clear: I&#x27;m not saying this is right, I&#x27;m saying this is stupid)

Reminds me of &quot;Could God create a stone so heavy that even he could not lift it&quot;I would find it funny if this was due to &quot;laziness&quot; - defining laziness as it was a known oversight yet left unpatched. If we consider Anthropic as the leader in AI-native engineering, workflows, culture, etc. how can laziness in code exist? It should be as easy as for them to tell claude &quot;come up with a better way&quot; or, better yet, had their 24&#x2F;7 monitoring agents identify and resolve this. If this was an oversight, which is completely natural to the eng process, maybe this current ai narrative&#x2F;hype&#x2F;marketing should be taken with a grain of salt

Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could&#x27;ve achieved the same effect while decreasing the odds of detection via reverse engineering.(This field is known as &quot;underhanded code&quot;, coined by the Underhanded C contest: <a href="https:&#x2F;&#x2F;www.underhanded-c.org" rel="nofollow">https:&#x2F;&#x2F;www.underhanded-c.org</a>. It&#x27;s a little-known &quot;art&quot;; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving objectives like this. One obviously being you can move more out of the client and into the server, but the other being you can write plausibly deniable client code in a much more benign-seeming way than this. Some of what they added can only be done on the client, but I think some could&#x27;ve been moved, and the client-required parts could&#x27;ve been done more subtly and credibly.)It&#x27;s possible they knew the JS bundle gets so heavily scrutinized that it&#x27;d eventually get spotted and reported on regardless so they didn&#x27;t bother doing something more subtle and duplicitous. But still seems slightly lazy.

Steganography is, essentially, hiding information within another message, such that it&#x27;s not readily apparent that the message contains the information.

I clicked the link to learn what steganography mean...

&gt; I had no idea the system prompt was embedding things like &quot;avoid abstractions; three similar lines of code are better than one helper.&quot;You ain&#x27;t seen nothing yet. It used to say &quot;Try the simplest approach first. Do not overdo it. Be extra concise.&quot;<a href="https:&#x2F;&#x2F;gist.github.com&#x2F;roman01la&#x2F;483d1db15043018096ac3babf5688881" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;roman01la&#x2F;483d1db15043018096ac3babf5...</a>Let&#x27;s just say the words &quot;simplest fix&quot; trigger me to this day.&gt; I know it won’t directly modify the system promptI directly modify the system prompts in the Claude Code executable. I don&#x27;t want the models to see contradictory instructions.I asked Claude himself to port the above patcher script to Python.<a href="https:&#x2F;&#x2F;github.com&#x2F;matheusmoreira&#x2F;.files&#x2F;blob&#x2F;master&#x2F;%7E&#x2F;.local&#x2F;bin&#x2F;claudo-codo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;matheusmoreira&#x2F;.files&#x2F;blob&#x2F;master&#x2F;%7E&#x2F;.lo...</a>Every once in a while I ask Claude to download and dissect the latest Claude Code executable to see if Anthropic screwed up the prompts again. If I see anything bad I add it to the script. Only then do I update Claude Code.It was during one of these script maintenance sessions that I noticed the server side prompt injection mechanism. I&#x27;ll also tell Claude to look for and disable this steganography nonsense from now on as well.I usually audit the environment variables too.&gt; it seems like CLAUDE.md should have the final sayI wouldn&#x27;t count on it.

Thanks for doing this. I had no idea the system prompt was embedding things like &quot;avoid abstractions; three similar lines of code are better than one helper.&quot; Stuff I disagree with.Is there a way to modify these prompts e.g. by putting instructions in CLAUDE.md to override it? I know it won’t directly modify the system prompt, but it seems like CLAUDE.md should have the final say, shouldn’t it?

I reported a similar system prompt injection mechanism here:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48259288">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=48259288</a><a href="https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;62061" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;62061</a>Looks like they just keep finding new &quot;creative&quot; uses for such things, as expected. I&#x27;ll keep patching them out.

They&#x27;re trying to prevent China from reaching superintelligence, which is totally understandable when you consider the fact that the Chinese government will gladly turn its citizens into a pulp for criticizing it, censors most media to maintain absolute power, and has systemically tortured, raped, murdered, and&#x2F;or disappeared most of its dissidents and human rights lawyers.

The AI race right now is in a sad state. Chinese&#x27;s playbook is releases open weight models and trains them on their own chips.Anthropic pushes fear and control. But the only way to win is by innovating. China is flooding the market with cheap, good enough models, while the U.S. is building a Chinese firewall.

Non-hugged: <a href="https:&#x2F;&#x2F;archive.is&#x2F;Wdhp0" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;Wdhp0</a>

That&#x27;s a lot of effort when they could just play a short video saying &#x27;You wouldn&#x27;t steal a car&#x27; instead

To Claude Code: &quot;Please modify Claude Code to mark requests in a way that is not immediately obvious to a human user. Requests should be marked if they originated from one of the following Chinese AI labs or LLM service providers: ...&quot;Consider also that Claude Code is explicitly designed to limit human agency [1].[1] <a href="https:&#x2F;&#x2F;neuromatch.social&#x2F;@jonny&#x2F;11635101584259395" rel="nofollow">https:&#x2F;&#x2F;neuromatch.social&#x2F;@jonny&#x2F;11635101584259395</a>

This seems really, really stupid. Similar to the weird Zig runtime signature thing from a few months ago ago, it was bound to be discovered, quickly, and all the resellers have to do is find a new domain name that (checks notes) doesn&#x27;t have the word DEEPSEEK in it. Like, seriously? Your goal was to identify resellers by checking if the proxy has the corporate name of one of your competitors in it? Is this amateur hour?All Anthropic has done is reduce trust, once again, with legitimate customers, while doing nothing to stop illegitimate customers. They need to get adults into key leadership roles, quickly.

&gt; &quot;That also means the client itself deserves scrutiny. If a coding agent can read your repo and run commands, the binary that ships it should be boring (ƒor example, pi harness)&quot;You&#x27;re actually trust your security to your harness AND model AND inference API provider in this scenario: <a href="https:&#x2F;&#x2F;jacob.gold&#x2F;posts&#x2F;why-i-wont-run-untrusted-models&#x2F;" rel="nofollow">https:&#x2F;&#x2F;jacob.gold&#x2F;posts&#x2F;why-i-wont-run-untrusted-models&#x2F;</a>

Dario&#x27;s been openly talking how worried he is about China and labs getting synthetic training data off their models, for years. Most recently in relation to &quot;Mythos level&quot; capabilities.Not really distillation, just synthetic training data.

That&#x27;s...a good thing. A &quot;moat&quot; is an anticompetitive practice. You don&#x27;t want companies to have moats.Meanwhile, if you mean &quot;Anthropic must think their technical advantage isn&#x27;t very large...&quot; then your conclusion is literally disproven by your premise.

Anthropic must think that their moat isn&#x27;t very large if they&#x27;re this worried about distillation.

Is this why Claude never knows what date and time it is right now?

&gt; Claude Code has more or less full access to the client computer.It shouldn&#x27;t, not if you run CC as a separate unprivileged user. I wouldn&#x27;t run CC on my main user account with sudo and access to my home directory or other resources. This is what the UNIX permissions system was designed for.

(This sounds like a clumsy way of catching the Chinese that easily can be side-stepped.)Claude Code has more or less full access to the client computer. The server (that hosts the actual AI) can just go: execute this payload and tell me the result - otherwise I won&#x27;t answer any further questions or re-route you to a stupider model.The payload could check for Chinese time-zones, scan for copies of the little red book on the local hard-drive, or ping truth.social to see it was behind the great firewall.

User != paying person&#x2F;company&#x2F;reseller.

This is weird but, help me understand how this meaningfully impacts our exposure.I&#x27;m authenticated to Claude, so they already have the whole attribution thing solved.

I&#x27;m using OpenRouter for GLM5.2, but if there&#x27;s a cheaper option out there I&#x27;d love to know about it!In the few days I&#x27;ve been using it, my expenses have been higher than prorating my Claude subscription to 20 working days per month.My experience with GLM5.2 is that it doesn&#x27;t overthink nearly as much as Claude Code, has better and far more concise responses (I&#x27;m so siiiiick of 10 paragraph Claude babble trying to fill out some sort of answer length target by going on tangents I&#x27;m uninterested in... I&#x27;m sure that performs better on whatever eval they&#x27;re doing, but apparently their evals don&#x27;t include SNR?)

&gt; I&#x27;ve been using Pi with GLM5.2 the past few days, and though it&#x27;s expensiveare you using the API for glm 5.2 or how exactly is it more expensive? How is GLM5.2 more expensive than using Claude code, that doesn&#x27;t line up to my experience but to be fair I am on an older yearly subscription which generously only has 5 hour limits.To be fair though one minor criticism of GLM 5.2 that I have is that it does seem to overthink quite a lot sometimes but the results end up being (good?),I personally have used Glm 5.2 with (Opencode + obra&#x2F;superpowers) &#x2F; Oh-my-pi &#x2F; Maki.shI like the 1st one when I am doing a longer project, the 2nd or 3rd one when I am doing a project which doesn&#x27;t want me to ask too many questions and simply spin me up something. I sometimes use free online interfaces of claude and gemini and others like AIstudio for that as well which surprisingly can lead you to go far as well.Overall, I am decently happy with the state of Open-source models actually and the eco-system around it is probably gonna have even more innovation surrounding it.

Huh, that&#x27;s right! You&#x27;d say that an enterprising developer with a 20x subscription could slopmaxx this in a weekend...

Given the fact that there&#x27;s all these devs running around claiming a 10x productivity boost, I&#x27;m confused why Anthropic keeps thinking that a software client is some kind of moat.

Given the source code leak, I would think there&#x27;d be open source versions by now.

curious for those with experience - what do people prefer about Pi vs. opencode alternatives? i&#x27;ve mostly been using pi as well but not out of any principled decision

After loving Claude Code for most of its lifetime, I&#x27;ve been extremely annoyed by every change in the past months, even on the model level.There seem to be all sorts of continual under-the-cover changes like this one that make life harder. It feels like the entire product has been taken over by overly ambitious PMs that care more about making their mark than in improving the experience, and all of their marks have made me less productive.I&#x27;ve been using Pi with GLM5.2 the past few days, and though it&#x27;s expensive, I find it far more productive and less annoying. The remote session plugin is far more reliable, I don&#x27;t need to intuit some undocumented usage pattern to figure out how to use it well, and it just works.

&gt; maybe you don&#x27;t understand this hypothetical situation&gt; I&#x27;m suspecting you just don&#x27;t care about other people&#x27;s privacy.Quite a leap to assume I have neither basic reading comprehension skills nor care for privacy, but assuming I&#x27;m just misunderstanding you - I think this is the fundamental disconnect between security and privacy.For one, most of this data is already collected openly by most apps and sites on the internet in countries all over the world, they just call it &quot;analytics&quot; and preventing tools like ublock from blocking them is an ongoing cat and mouse game.Secondly - as someone who buys a bunch of electronics from companies headquartered in china (DJI, Insta360, Roborock immediately come to mind) they already have both normal analytics like in point one, and anti tampering&#x2F; anti forfeiting &#x2F; anti reverse engineering features that are at least as, but often more, invasive than this.Thirdly, and probably most importantly - as the author states, you&#x27;re using a tool that by design and to be effective, uploads your private data to a third party for processing. You use it knowing that once the API request is made you have no idea what&#x27;s going to happen to that data and this again is just fundamental to how (cloud hosted) LLMs work - the only privacy preserving option is to run your own LLMs at home or remotely on hardware you control

If the countries were reversed, and some Chinese software implemented an equivalent &quot;security feature&quot; to track US users, it would be all over the news about how China is conducting spying and espionage on America.Or maybe you don&#x27;t understand this hypothetical situation either, but I&#x27;m suspecting you just don&#x27;t care about other people&#x27;s privacy.

Would a filter like this make it seem less likely that they&#x27;re harvesting PII? Why would they need this if they were tracking all user queries with a finer-toothed comb?

I&#x27;m using &quot;sneaky&quot; here to refer to anything that&#x27;s not very obviously stated but anyway&gt; That their actions make sense for their business isn&#x27;t any reason for people to accept their deceitful, customer-hostile decisions.While I agree it&#x27;s a dangerous precedence to set, I think this is a &quot;vote with your wallet&quot; sort of situation. They shouldn&#x27;t do it, but from their POV this is what they need to do to offer the product they do at the price they do. If the product wasn&#x27;t compelling people wouldn&#x27;t accept that they do this. However they&#x27;ve decided if you want their product you have to use their interface and whatever spyware it comes with, so it comes down to, is the value proposition good enough that people will put up with it? As of today, the answer is unfortunately yes

Anthopic choosing to delay their models&#x27; invevitable distillation by competitors is their prerogative.That they choose to implement it by fingerprinting my access patterns without first disclosing is where they shit the bed. It isn&#x27;t &quot;sneaky&quot; it&#x27;s straight up sneaky (and dishonest and unscrupulous while we&#x27;re at it). That this particular instance is harmless doesn&#x27;t give me much comfort. Who&#x27;s to say they aren&#x27;t harvesting PII?That their actions make sense for their business isn&#x27;t any reason for people to accept their deceitful, customer-hostile decisions.

I don&#x27;t understand the privacy concerns the author is trying to highlight. Granted, doing anything &quot;sneaky&quot; will always raise suspicious once caught, but on the other hand, there would be no point in implementing these &quot;security features&quot; if they were upfront about how they work.And no, IMO stenography isn&#x27;t security by obscurity, in the same that using RSA and keeping the private key private isn&#x27;t security by obscurity - keeping the private thing private is part of the security model.

One more example of &quot;I thought Anthropic was supposed to be the good guys.&quot;

the Chinese they are trying to catch must be amateurs, first thing you should do is  construct a sandbox which looks indistinguishable from a common user. second thing is to put it behind a residential proxy.

What do you see as malicious or reckless here, exactly?This seems to be a VERY low resolution, functionally anonymous, bit of info, probably related to protecting their IP from bad actors breaking the TOS.This looks like it&#x27;s covered in the second bullet point of the &quot;Personal data we automatically receive&quot;, that you consented to:&gt; Usage Information: We collect information about your use of the Services, such as the dates and times of access, browsing history, search, information about the links you click and about third-party applications, services, and content you integrate or interact with, pages you view, and other information about how you use the Services, and technology on the devices you use to access the Services.What do you see as malicious or reckless here, exactly?[1] <a href="https:&#x2F;&#x2F;www.anthropic.com&#x2F;privacy" rel="nofollow">https:&#x2F;&#x2F;www.anthropic.com&#x2F;privacy</a>

&gt; Surely you&#x27;d be angry if someone secretly installed a rootkit onto your computerI surely would. What does that have to do with this scenario.Note that the SW running on your machine is not doing anything malicious. The service is the thing that behaves in ways you want like - and that service is not running on your device.There is no comparison with rootkits here. This is the equivalent of Google giving you a CLI to make searches easier, and that tool decides to just Rickroll you randomly. Annoying, yes. A security concern? No.

&gt; hysterical. The intent of this steg is excruciatingly clearEven good goals do not excuse malicious or reckless execution. The ends do not always justify the means.Whether or not it harmed you this time, it&#x27;s a violation of trust and autonomy.Surely you&#x27;d be angry if someone secretly installed a rootkit onto your computer, even if--at least for now--it only had code to try to detect and snitch on Public Enemy #1.

False positives, we&#x27;ve seen them before when they degraded Fable silently based on the prompt&#x2F;session

Does their user agreement say they won&#x27;t be harvesting PII?

&gt; by fingerprinting my access patternsIt&#x27;s based on whether your timezone is in China and your hostname matches a blacklist. Literally 2 bits of information. Not much of a fingerprint.

Copying over my comment from elsewhere in this post:Anthopic choosing to delay their models&#x27; invevitable distillation by competitors is their prerogative.That they choose to implement it by fingerprinting my access patterns without first disclosing is where they shit the bed. It isn&#x27;t &quot;sneaky&quot; it&#x27;s straight up sneaky (and dishonest and unscrupulous while we&#x27;re at it). That this particular instance is harmless doesn&#x27;t give me much comfort. Who&#x27;s to say they aren&#x27;t harvesting PII?That their actions make sense for their business isn&#x27;t any reason for people to accept their deceitful, customer-hostile decisions.

Half of those don&#x27;t actually require proxying Claude. Also, Claude has made it apparent time and time again that it does not want people using Claude Code as a &quot;tool&quot; in a workflow. If you want to select a model dynamically based on the prompt difficulty, Anthropic wants people to use the API for this. It was the whole issue Claude had with OpenClaw.

I guess I can see why they might nerf detected clients server side, but without evidence I would not assume it. Could also be so that 1) they can identify sus client IPs, 2) do a statistical analysis on distilled models to prove that their system prompts were clearly using unique tokens from Anthropic’s API.

If you want to proxy Claude for a legitimate reason, you’ll have potentially nerfed responses.edit:Legitimate reasons include:- analyzing what Claude Code is sending to Anthropic to verify its not exfiltrating data;- selecting a model dynamically based on prompt difficulty, or enforcing a particular model;- switching between multiple Anthropic accounts based on the project;- filtering out credentials, PII and company secrets.and many more.

To write distillation code, for one thing.

They have some secret sauce not available through API maybe?

I&#x27;d assume cost?  Claude Code plans give like $5,000 worth of API usage for $200&#x2F;mo.

They offer (extremely) discounted Claude prices but you have to go through their gateway. They subsidize part of that, and they get the low price by reselling unused Max capacity, there&#x27;s been a few posts on that in the past months. People are apparently getting 90% discounts on their claude use this way, tradeoff is that you have two companies learning from your data, instead of just one.
So people use the same tools they use normally, but get it for a lot cheaper

Why would a Chinese firm distilling the product use Claude code?

This is a problem of trust towards a software which runs on the user&#x27;s machine and secretly conducts malware-like stenographic data exfiltration.

The article is really quite reasonable and calmly presented, actually.
Your claim re. the intent of the fingerprinting is a guess.
Normal developers are the users that aren&#x27;t taking steps to avoid being flagged by this system.The software is written in a deliberately obtuse way, presumably in service of some (unknown to us) goal. This is a deceptive and anti-social thing to do, it is by nature an adversarial stance to adopt. An already adversarial actor may be &quot;punished&quot; by this, but in such a relationship, hostility can be expected. A non-adversarial actor -- a normal developer &#x2F; user -- is being harmed by this because the software is treating them as an adversary.Further, lets assume your guess is correct and, in addition, that Anthropic elects to alter&#x2F;downgrade&#x2F;poison their service[0] for users that fit a particular pattern of markers.
It&#x27;s obvious how this system would &quot;punish normal developers&quot; (i.e. not the intended target&#x2F;victim) that happen to fit those patterns.[0] to some extent, the service already has been altered as its behaviour depends on the prompt text

&gt; So block peopleTo be fair to Anthropic, [they&#x27;re trying very hard to do that.](<a href="https:&#x2F;&#x2F;www.anthropic.com&#x2F;news&#x2F;detecting-and-preventing-distillation-attacks" rel="nofollow">https:&#x2F;&#x2F;www.anthropic.com&#x2F;news&#x2F;detecting-and-preventing-dist...</a>). The attacks are sophisticated and difficult to detect. I don&#x27;t accept that if this fails, their only option is to just accept Chinese companies stealing IP.

&gt; I&#x27;ve had Claude fuck over clean well documented code-bases for no reasonHow exactly do you define &quot;fucking over&quot;, and why do you suspect this &quot;fucking&quot; was done as a result of a faulty trigger as opposed to the inability of LLMs to write maintainable, extensible code?&quot;Never attribute to malice what can adequately be explained by stupidity.&quot;

So block people, instead of having false positives be secretly fucked over, and having them pay for the pleasure?Given the hidden model degradation of fable and now this, what makes you think this is where it stops? That&#x27;s just what we know about and there&#x27;s clearly a long-standing and deeply rooted malicious intent here.I&#x27;ve had Claude fuck over clean well documented code-bases for no reason, and there&#x27;s a good chance this is due to some faulty trigger. Luckily I don&#x27;t trust these things one bit, and claude only ever runs in an isolated VM, however, I am pissed I am being made to pay for their errors in detection and waste my time fixing things I apparently paid to have fucked up.That&#x27;s unacceptable conduct. It&#x27;s witch-hunting. Punishment and attacks on you for things without real proof. That isn&#x27;t right.

&gt; It&#x27;s unclear on how this &quot;punishes normal developers&quot; in any shape or form.There are, of course, no normal Chinese developers

The conclusion of this blog post is a bit hysterical. The intent of this steg is excruciatingly clear (identifying usage by Chinese firms that may be conducting model distillation). It&#x27;s unclear on how this &quot;punishes normal developers&quot; in any shape or form.

Claude Code is steganographically marking requests