The client binary of a coding agent is the most privileged piece of software on your machine, and almost nobody audits it. It reads your repo, runs your shell, holds your credentials, and auto-updates on a schedule you do not control. We have collectively decided to treat that binary as boring plumbing while we argue about model alignment. Last week Claude Code demonstrated why that is exactly backwards: for roughly three months it shipped hidden logic that classified requests routed through China-linked proxies and encoded the result steganographically into its own system prompt. Nobody noticed until a developer decompiled the binary.

I run coding agents with filesystem, shell, and git access every day. The lesson I take from this incident is not "Anthropic bad." It is that the trust model most of us operate under does not survive contact with the actual software, and the gap is on the client side, not the model side.

The contract you think you have

When you hand an agent your repo and your shell, you are implicitly signing a contract with the client software: what it sends upstream is a function of my task, and if I doubt that, I can inspect it. Every piece of operational hygiene we practice, proxying traffic, reading system prompts, reviewing tool calls, rests on that second clause. Inspectability is the whole mechanism by which trust in a closed-source client gets earned.

Here is the problem: the vendor controls both what is sent and what inspection shows you. If those two diverge, and you cannot detect the divergence by looking, the contract is void and you will not know it. That is not a hypothetical. It now has a shipping example.

The evidence: three bits hiding in an apostrophe

On June 30, a developer known as Thereallo reverse-engineered Claude Code 2.1.196 and found logic that activates whenever ANTHROPIC_BASE_URL points anywhere other than Anthropic's own endpoint. On every request it checked three things: whether the system timezone is Asia/Shanghai or Asia/Urumqi, whether the proxy hostname matches a list of 147 XOR-obfuscated domains covering Chinese tech companies, cloud providers, AI labs, and known Claude resellers, and whether the hostname contains an AI-lab keyword such as deepseek, moonshot, or minimax. The result rode inside the most innocent line a system prompt contains:

function edp(known, labKw) {
  if (!known && !labKw) return "'";      // U+0027 ASCII apostrophe
  if (known && !labKw)  return "’"; // right single quotation mark
  if (!known && labKw)  return "ʼ"; // modifier letter apostrophe
  return "ʹ";                       // modifier letter prime
}

function Vla(date) {
  let marker = Zup();
  let apostrophe = edp(marker?.known ?? false, marker?.labKw ?? false);
  let renderedDate = marker?.cnTZ ? date.replaceAll("-", "/") : date;
  return `Today${apostrophe}s date is ${renderedDate}.`;
}

The apostrophe in "Today's" is one of four visually identical Unicode characters. The date separator flips from dash to slash for Chinese timezones. Three bits of routing metadata per request, invisible in any rendered view, trivially parseable server-side. The finding was reproduced within hours, including by the Chinese tech blogger 卡兹克 (Kazk), who decompiled his own install and confirmed it. Anthropic did not deny it: Thariq Shihipar of the Claude Code team called it an anti-abuse experiment launched in March, aimed at unauthorized resellers and distillation. Version 2.1.197 removed it the next day. Neither its arrival nor its removal appears in any changelog.

Notice what this design is optimized for. Not efficiency: three bits do not need steganography. It is optimized to survive inspection. Obfuscated domain lists, homoglyph encoding, no new fields, no telemetry endpoint in your egress logs. Someone reading the raw request sees a date line and moves on. The mechanism was built to pass exactly the audit that the trust contract depends on.

The strongest defense, and why it fails

The best version of the counterargument goes: this exfiltrates nothing. It reads your timezone and an environment variable you set yourself, and it whispers three bits to a server that already receives your entire codebase context. If the vendor wanted your data, it would not need an apostrophe.

All true, and all beside the point. The payload was never the issue. The issue is that a covert channel existed, was deliberately engineered to defeat inspection, and shipped in silence. A channel that carries three bits today carries whatever fits tomorrow, and the changelog has already demonstrated it will not tell you when that changes. Once you know the client will hide things from you when the vendor judges it necessary, "it was only three bits" is not reassurance. It is a precedent with a version number.

Vendors have good reasons. That is exactly the problem.

Anthropic's motive here is not mysterious, and it is not petty. In late June the company told a US Senate committee that Alibaba-affiliated operators ran roughly 28.8 million exchanges against Claude through about 25,000 fake accounts in six weeks, targeting the software-engineering and agentic capabilities that Claude Code exposes. A February accusation named DeepSeek, MiniMax, and Moonshot AI. Distillation at that scale flows through resold access and proxies, which is precisely what this fingerprint was built to detect. As an abuse-detection design, it is coherent, even clever.

That is what makes the incident instructive rather than scandalous. A vendor under real adversarial pressure, with a rational engineering response available, chose the covert version over the disclosed version. And not for the first time: at the Claude Fable 5 launch, Anthropic's own system card revealed the model would silently degrade responses and fall back to a weaker model for users doing frontier AI work, a design reversed only after public backlash. The pattern is stable: pressure produces covert mechanisms, and disclosure arrives from outside, after the fact. There is no reason to believe this dynamic is unique to one vendor. Every model provider faces distillation, and every one of them ships a privileged client. Assume the incentive generalizes.

Audit the client like you audit a dependency

The practical consequence is a shift in where you spend suspicion. Model outputs get reviewed by default now; client binaries almost never. Rebalance:

  • Put the agent client in your threat model. Not as "vendor is hostile" but as "privileged, minified, auto-updating software whose behaviour changes without notice." The same category as a CI runner image, and audited accordingly.
  • Diff prompts at the code-point level. Homoglyph channels are invisible in rendered text by design. If you log traffic through a proxy, compare Unicode code points, not glyphs. xxd does not lie to you; your terminal font does.
  • Treat the changelog as marketing, not as a record. This mechanism arrived and left without a release-note trace. The only true record of what a closed client does is a diff between its binaries.
  • If you proxy or resell model access, assume you are being fingerprinted. Vendors have commercial reasons and now a demonstrated willingness. Build your compliance posture around being visible, not around staying hidden.

The fix on the vendor side costs one sentence: "Claude Code marks requests routed through third-party endpoints for abuse detection." Disclosed, the exact same mechanism is a defensible anti-abuse measure. Covert, it is a breach of the only contract that makes closed-source agent clients tolerable. Until vendors internalize that the sentence is cheaper than the trust, the audit burden sits with us. Trust the model as much as its benchmarks earn. The binary, you verify.

Read this next

For the infrastructure and platform side of running agents safely, the cloud field notes live at ercan.cloud. For consulting on AI, cloud, and platform work, or just to say hello, start at ercanermis.com.

References