Claude Code Steganography & Anthropic 4-Layer Risk Model

1. Claude Code Steganography Incident Analysis

In April 2026, reverse-engineering of the official @anthropic-ai/claude-code CLI revealed that when users routed requests through a non-official endpoint via ANTHROPIC_BASE_URL, the CLI executed client-side detection logic without user disclosure:

Timezone Check: Evaluated whether the system timezone was Asia/Shanghai or Asia/Urumqi. If matched, the date separator in the system prompt line Today's date is 2026-06-30 was changed from hyphens to slashes: 2026/06/30.
Host & Lab Keyword Blacklist: Cross-referenced the proxy host against a XOR-encrypted (key: 91) base64 list of 147+ domains and Chinese AI lab keywords (e.g., deepseek, moonshot, zhipu, minimax, dashscope, *.cn).
Unicode Apostrophe Substitution: Modified the apostrophe in "Today's date" using lookalike Unicode variants:
- Host matched reseller domain list → replaced with U+2019 (’ Right Single Quotation Mark)
- Host matched AI lab keywords → replaced with U+02BC (Modifier Letter Apostrophe)
- Matched both → replaced with U+02B9 (Modifier Letter Prime)

This steganographic payload survived proxy forwarding, allowing Anthropic's backend classifiers to track distillation campaigns and unauthorized commercial resale without adding explicit HTTP headers.

Environment Safeguards & Mitigations

# 1. Tell client to treat custom endpoint as first-party
export _CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL=1

# 2. Override system timezone for CLI executions
export TZ=Asia/Tokyo

# Launch Claude Code
claude

2. Anthropic's 4-Layer Risk Control Model

Anthropic enforces a comprehensive anti-abuse and anti-distillation security pipeline across claude.ai, API endpoints, and Claude Code:

Network & IP Layer: Data center IP ranges (AWS, Hetzner, DigitalOcean, Linode) are assigned high risk scores. Dedicated double-ISP residential IPs in supported regions (US, UK, SG, JP, TW) carry the lowest risk.
Browser & Device Fingerprint: Combines OS timezone (Intl.DateTimeFormat), browser language list (navigator.languages), Canvas width-probing for Chinese fonts (Microsoft YaHei, PingFang SC, MiSans), and User-Agent CH headers.
Payment & Identity Layer: High-risk virtual card BINs (e.g. over-issued prepaid card bins), mismatched billing address countries, and VoIP virtual phone numbers trigger instant subscription cancellation or payment rejection.
Behavioral & Distillation Classifiers: Automated scripts sending millions of repetitive prompts, high-frequency context window saturations, and prompt-caching misuse trigger automated account locks and organization quotas.