AI tools
Claude Code Hidden Prompt Markers: What the Date String Encodes
A technical reading of Thereallo’s report on classification data in Claude Code’s date prompt, its trigger path, and the implications for client trust.
On this page
Thereallo reported that Claude Code 2.1.196 could encode gateway and timezone classification in punctuation inside the current-date sentence sent to the model.[1] For teams routing requests through custom infrastructure, the review question is which local signals enter a request and whether that behavior is documented.
The analysis below is commentary on that public report, not an independent reproduction of the Claude Code binary.
What the post found
The author inspected Claude Code 2.1.196 and found logic that can alter the current-date sentence inserted into the system prompt.
The ordinary sentence looks like this:
Today's date is 2026-06-30.
The marker is tiny. Two pieces can change:
- The apostrophe in
Today's. - The date separator, from
-to/.
To a person reading the prompt, the sentence still looks boring. To a log processor, gateway, or backend parser, those small character choices can carry classification data. The original post calls this prompt steganography: hiding a signal inside otherwise normal prompt text.
When it triggers
The key trigger in the post is ANTHROPIC_BASE_URL.
If that environment variable is unset, or if it points at the official api.anthropic.com endpoint, the logic returns early and keeps the date prompt normal. The interesting path starts when Claude Code is routed through a custom base URL, such as:
- an internal API gateway
- a local proxy
- a model router
- a reseller or forwarding service
- a research endpoint
Once that path is active, the client checks a few signals:
| Signal | Effect |
|---|---|
Whether the system timezone is Asia/Shanghai or Asia/Urumqi | The date may change from YYYY-MM-DD to YYYY/MM/DD |
| Whether the API base URL hostname matches a domain list | The apostrophe in Today's changes to a specific Unicode character |
| Whether the hostname contains certain AI lab keywords | The apostrophe changes to another Unicode character |
The post also notes that the domain and keyword lists are not stored as plain text. They are lightly obfuscated with base64 and XOR. The decoded keywords include AI-company and model-platform terms; the domain list includes Chinese internet companies, AI companies, and proxy, gateway, or reseller services.
The client trust boundary
The report describes classification behavior; it does not establish the provider’s intent. A custom API endpoint can serve legitimate operational needs, so its presence alone is not evidence of abuse.
A coding client can operate with repository context and local tool permissions. That makes request construction part of the client review. An explicit, documented classification field would be easier for a gateway operator to inspect than a signal encoded in ordinary punctuation.
That does not prove malicious intent. It is better understood as a trust-design mistake: the goal may be defensible, but the expression damages confidence.
Practical impact
The original report places this path behind a custom-base-URL condition. That limits the reported scope; it does not verify the behavior of other releases.
In the version examined by the report, an unset ANTHROPIC_BASE_URL or the official endpoint followed the ordinary date path. The people who need to pay attention are those running Claude Code through custom infrastructure.
That includes:
- company-wide API gateways
- local debug proxies
- multi-model routers
- third-party Claude API resellers
- research middleware
Those setups are not automatically suspicious. The issue is that the client may classify the hostname and encode the result into system context sent to the model.
What the report does not establish
The described inputs are configurable, which suggests the marker may be sensitive to environment changes. That is an inference from the reported design. No bypass test, detection-accuracy measurement, or assessment of current releases is supplied here.
For a gateway operator, the actionable question is whether the deployed client sends such fields and whether the request policy accounts for them. Check the actual client version and captured request construction before extending this report to another setup.
Client trust checklist
Evaluate client behavior as well as model capability:
- Does it place local environment information into the system prompt?
- Which environment variables, timezones, hostnames, and paths enter requests?
- Are those fields documented?
- Are telemetry, logging, and policy controls visible?
- After client updates, can behavior changes be audited?
A coding agent that can read files, modify repositories, and run commands operates inside the local development trust boundary. Any request field used to transmit classification data, including an encoded date string, should therefore be documented and auditable.
References
[1] Thereallo. “Claude Code Is Steganographically Marking Requests.”