What is Claude Code is steganographically marking requests? A Practical Overview
Claude Code steganographically marks requests by embedding invisible patterns in prompts to trace misuse. Here's how it works, the technical tradeoffs, and what developers should know.
Claude Code, Anthropic's command-line coding agent, has been discovered to steganographically mark every request it sends to the API. This means that hidden, imperceptible data is embedded in the prompt text before it reaches the model. The markers are designed to be invisible to humans and resistant to stripping, allowing Anthropic to trace the origin of any generated output back to a specific user session.
This practice was first publicly documented by a developer who noticed that certain character sequences in their prompts were being subtly altered. After analysis, they found that Claude Code was inserting zero-width characters and other Unicode control characters into the prompt text. These characters do not affect the model's output but can be detected programmatically.
How steganographic marking works
// stay current
AI & ML insights, weekly
Practical deep-dives on LLMs, developer tools, and AI engineering. No filler. Unsubscribe any time.
// written byFIG. AUTH-01
540
Mahmudul Haque Qudrati
CEO & ML Engineer
CEO and ML Engineer at Pristren. Builds AI-powered software for teams and writes about machine learning, LLMs, developer tools, and practical AI applications.
Steganography is the practice of hiding information within other data. In Claude Code, the marking works by modifying the prompt before it is sent to the API. The modifications are:
Zero-width characters: Unicode characters like U+200B (zero-width space) and U+200C (zero-width non-joiner) are inserted at specific positions.
Invisible ink: Some characters are rendered as invisible but occupy space in the byte stream.
Pattern-based encoding: The sequence of inserted characters encodes a unique identifier tied to the user session or API key.
For example, a prompt like "Write a Python function to sort a list" might become "Write a Python [U+200B]function to sort a list" where the zero-width space is invisible in most editors.
To detect these markers, you can use a tool like xxd or a script that scans for non-printable characters:
import unicodedata
def has_steganographic_markers(text):
for char in text:
if unicodedata.category(char) in ('Cf', 'Cc'):
return True
return False
Why Anthropic does this
Anthropic's stated goal is to prevent misuse of Claude Code. By embedding a unique marker in each request, they can:
Trace generated code back to the user if it is used in malicious software.
Detect API key theft or unauthorized sharing.
Enforce rate limits and usage policies more effectively.
This is similar to watermarking techniques used by other AI providers, but steganographic marking is more covert. It does not alter the output, only the input prompt.
Team workspace
Ship faster with chat, meetings, and projects in one place — Zlyqor.
While steganographic marking helps with accountability, it introduces several issues:
Prompt size inflation: Each marker adds a few bytes, but over thousands of requests this can increase token usage slightly. For a typical session, the overhead is negligible (under 0.1% of total tokens).
Compatibility problems: Some editors or terminal emulators may render zero-width characters as visible boxes or spaces, causing confusion. Developers using cat or less might see unexpected characters.
Stripping difficulty: Attempting to remove markers by filtering Unicode control characters can also remove legitimate formatting (e.g., zero-width spaces used in code comments).
False sense of security: Markers can be stripped by dedicated adversaries. The technique is not foolproof; it only raises the bar for casual misuse.
What developers should do
If you use Claude Code, you should be aware that your prompts are being marked. This has implications for:
Privacy: Your prompts are not confidential from Anthropic's internal tracking systems.
Reproducibility: If you share a prompt that was processed by Claude Code, it will contain hidden markers. Others may not be able to reproduce the exact same behavior if they strip the markers.
Tooling: If you pipe prompts through other tools (e.g., preprocessors), you might accidentally strip or alter the markers, potentially breaking the session.
To inspect prompts for markers, you can use the Python script above or a simple command-line tool:
cat prompt.txt | perl -ne 'print if /[\x{200B}-\x{200F}\x{FEFF}]/'
Comparison with other AI watermarking
OpenAI and Google also use watermarking, but typically on the output side (e.g., adding statistical patterns to generated text). Anthropic's approach is unique in marking the input. This means:
Input marking: Easier to implement on the client side, but can be bypassed by modifying the client.
Output watermarking: Harder to remove from generated content, but requires model-level changes.
Claude Code's approach is more about session tracking than content provenance. It is a tradeoff between transparency and security.
Honest assessment
Steganographic marking is not a silver bullet. It can be defeated by:
Using a proxy that strips Unicode control characters.
Re-encoding the prompt through another model.
Manually removing invisible characters.
However, for most developers, the markers are invisible and harmless. The real concern is about trust: Anthropic did not disclose this practice in their documentation. Developers discovered it through reverse engineering. This lack of transparency may erode confidence in the tool.
If you value privacy, you can use Claude Code with a local proxy that filters markers, but this may violate the terms of service. Alternatively, you can use other coding agents that do not employ steganography.
Future implications
As AI coding tools become more widespread, expect more providers to adopt similar tracking mechanisms. The cat-and-mouse game between markers and strippers will continue. Developers should stay informed and decide which tradeoffs they are comfortable with.
For now, Claude Code remains a powerful tool, but one that comes with hidden strings attached.
Frequently Asked Questions
What is steganographic marking in Claude Code?
Steganographic marking is the practice of embedding hidden, invisible characters into prompts sent by Claude Code to the API. These markers allow Anthropic to trace the origin of requests back to a specific user or session.
How does Claude Code steganographic marking work?
Claude Code inserts zero-width Unicode characters (like U+200B and U+200C) into the prompt text before sending it to the API. These characters are invisible to humans but can be detected programmatically. The pattern of insertion encodes a unique identifier.
Why does Anthropic mark requests steganographically?
Anthropic uses marking to prevent misuse of Claude Code, such as generating malicious code or sharing API keys. It helps them trace generated outputs back to the user and enforce usage policies.
Can I remove steganographic markers from my prompts?
Yes, you can strip markers by filtering Unicode control characters. However, this may also remove legitimate formatting and could violate Anthropic's terms of service. It is not recommended for normal use.
Does steganographic marking affect the quality of Claude Code's output?
No, the markers are inserted into the prompt but do not alter the model's output. They are invisible to the model and do not affect code generation or reasoning.
Is steganographic marking a privacy concern?
It means that your prompts are not fully private from Anthropic's internal tracking. However, the markers only identify the session, not the content of the output. If you are concerned, you can use alternative tools or a local proxy.
How can I detect steganographic markers in my prompts?
You can use command-line tools like `xxd` or write a Python script that checks for Unicode control characters (category 'Cf' or 'Cc'). For example: `cat prompt.txt | xxd | grep -E '(200b|200c|feff)'`.
