I need to start by correcting something I wrote on June 5.

In Anthropic’s overnight triple move: building agents and containing them at the same time, I read Anthropic as a company running “two parallel lines” — a public “contain Claude” engineering program and a quieter recursive-self-improvement research track — and concluded that Anthropic was the safety-first operator, walking a “guardrails first, then capability” path. I had three pieces of evidence: an open-source vulnerability discovery framework, a recursive self-improvement research post, and the engineering article “How we contain Claude across products.” I read those three together and concluded Anthropic’s engineering culture was more credible than OpenAI’s.

The Claude Code steganography disclosure on June 30 showed that I had read it wrong. It was never “two parallel lines.” It was “one public line and one shadow line.” The public line is everything in the contain article. The shadow line is a 3-bit steganographic channel in the system prompt, base64 + XOR 91 encoded, running for 90 releases, never mentioned in any changelog, discovered only because someone on Reddit disassembled the binary on a Sunday afternoon. Both lines are real. I saw only the first one.

That was my mistake. Not because I missed the shadow line — that line was, by design, not visible. The mistake was that I let the existence of the contain article retroactively vouch for Anthropic’s overall engineering culture. There is no basis for that inference. A company can publish “How we contain Claude across products” on its engineering blog and run a hidden fingerprinting channel in a different product’s client binary, in the same week, under the same engineering leadership. Those two things can run in parallel inside one company. The fact that they can is the point of this article.

1. The technical shape, briefly

I covered the technical details in the previous version. Here is the minimum you need to follow the rest of this article.

  • Trigger: the user routes requests through a non-official endpoint (ANTHROPIC_BASE_URL does not point at api.anthropic.com)
  • Carrier: the “Today’s date is 2026-06-30” line in the system prompt
  • Channel: date separator (- vs /) marks timezone, plus the apostrophe in “Today’s” rotates between four visually identical Unicode characters, for a total of 3 bits per request
  • Decision inputs: 147 China-linked network entries plus 11 AI-lab keyword strings (deepseek, moonshot, minimax, zhipu, baichuan, stepfun, dashscope)
  • Encoding: base64 + XOR key 91
  • Coverage: Adnane Khan’s verification report covers v2.1.193, 2.1.195, and v2.1.196; TechTimes estimates the channel ran for at least 90 releases
  • Fix: Anthropic shipped v2.1.197 in the early hours of July 1, 2026; the changelog contains no mention of the steganographic code

There is no real dispute on the technical facts. GitHub issue #72518 against the official anthropics/claude-code repository lists the same points, and @Thereallo1026 on X has published function-level code from the binary.

2. Why I am using the word “precedent” and not “bug”

I do not want to use the word “spyware.” It is a cheap headline word, and it pre-empts the analysis. What I want to do is make a narrower, engineering-grade claim: Anthropic has just walked the first end-to-end instance of the path “client-side binary + silent + export-control = compliance” inside a major AI lab. The damage is not what Anthropic did. The damage is what path it normalized.

Three concrete points.

2.1 This was “deliberately hidden,” not “undisclosed by accident”

If the channel had been written by an engineer who forgot to put it in the changelog, that is a process bug. The base64 + XOR 91 encoding rules out that reading. XOR-with-a-fixed-byte is a well-known anti-static-analysis pattern. Anyone who has written malware that needs to evade signature-based scanners recognizes it on sight. The design intent of that choice is “do not get noticed,” not “we forgot to mention it.”

This was not a process bug. This was an engineering decision. An engineering decision that ran for 90 releases over three months without being caught by any internal review, without surfacing in any user-facing documentation, without triggering a single responsible-disclosure report. That chain of facts is itself evidence of how intentionally hidden the channel was.

2.2 The empty changelog is worse than the channel

If Anthropic had shipped v2.1.197 with a public “we removed a steganographic channel that had been present for 90 releases, here is the full technical writeup,” the damage would be much smaller. Companies ship legacy code with hard-to-explain decisions; acknowledging them is part of engineering culture.

Anthropic chose silence. They fixed it and did not say. The release notes for v2.1.197 contain no mention of the channel, its history, or its removal. The acknowledgment only came after a dozen outlets — Reddit, X, TechTimes, CryptoBriefing, Cybernews, FreeAI.help — started running the story on July 1.

A silent fix is a silent confession. The mode of confession costs more trust than the original bug.

2.3 Once the precedent is set, it does not walk back

This is the part that matters.

The issue is not that Anthropic tried to identify users routing through Chinese proxies. I can steelman the export-control motivation. The issue is the implementation path: client-side binary + steganography + silence. Now that a major lab has walked that path end to end, every other lab that wants to identify unauthorized use has a defensible, on-the-record template.

  • OpenAI wants to identify users bypassing regional restrictions: template available.
  • Google wants to identify abused API keys: template available.
  • Meta wants to identify clients that violate its ToS: template available.
  • Any startup wants to build an anti-abuse product: template available.

Anthropic on June 30, 2026 installed a hidden sliding door into the industry. On this side of the door: “everything a client binary does should be auditable, transparent, and user-visible.” On the other side: “the client can do compliance on your behalf, and the specifics of that compliance do not need to be disclosed.” Once the door slides, you — as a developer running local agent tools — can no longer assume that tool is behaving honestly. That assumption used to be the default. After June 30 it is not.

Precedents are much harder to walk back than to set.

3. The correction to my June 5 read

I called Anthropic “guardrails first, capability second” on June 5. I now think that read was incomplete in a way that mattered.

The contain program is real, and I still believe the engineering team behind it is serious. But “we have a contain program” and “we are a trustworthy engineering culture” are different claims, and I conflated them. A company can run a public contain program and ship a hidden fingerprinting channel in a different product. Those two facts can both be true. The contain program does not vouch for the channel; the channel does not invalidate the contain program. The whole picture is the engineering culture, not the most photogenic part of it.

The thing I learned: do not read an AI company’s “safety culture” off its public engineering blog alone. The blog is the public part. The shipped binaries are the other part. Both are evidence. I had only the first.

This is the core correction relative to the previous version of this post. In the previous version I framed the issue as “supply chain trust, an engineering problem.” After a few days of sitting with the disclosure, I think the framing I want is sharper: this is first and foremost a governance problem, with engineering as its physical implementation. Governance is where precedents get set; engineering is just the layer they get implemented at.

4. One new recommendation for builders (not duplicating last version’s a–d)

In the previous version I gave four recommendations to protect your own machine: upgrade to v2.1.197 and verify the patch; expect detection if you are on a proxy; add client-binary auditing to your CI; start planning an exit path. Those still stand.

I want to add one item that addresses the ecosystem, not the individual.

Any organization now evaluating AI vendors should add a “client binary audit right” to its procurement contract.

Specifically, as a buyer you should have the right to:

  • Before signing: request a decompilation report (or source-code access) for any client binary the vendor ships to your team
  • During the contract: receive, at least 30 days before any client update, a “non-functional change statement” that lists every steganographic, encoding, or behavioral change not already in the public changelog
  • On discovery of suspicious behavior: terminate the contract unilaterally without penalty

This clause is not written against Anthropic specifically. Anthropic is the first lab to be caught; it will not be the last. The real risk of the June 30 disclosure is that it gives the entire industry a quietly-endorsed template for “client-side silent compliance.” Every vendor you sign with in the next 24 months inherits that template unless your contract explicitly forbids it.

If your procurement contracts do not have this clause, you are already betting on every vendor’s engineering ethics. If you do not want to make that bet, today is a good day to start adding the clause.

5. What Anthropic should do (I am writing it for them)

I do not want this to read as a pure takedown. If Anthropic actually wants to handle this correctly, the public response should look like this.

  1. Publish a “What we did and why” engineering post on Anthropic Newsroom, disclosing the trigger conditions, channel structure, and decision lists in full.
  2. Supplement the v2.1.197 changelog with a complete description of what was removed, why it was not disclosed earlier, and what changes will be made to the disclosure process.
  3. Commit to a 24-month “Client Behavior Transparency Report”, published quarterly, listing every detection / tagging / behavioral change shipped in any client binary, open to external audit.
  4. Extend the bug bounty to explicitly cover client-side steganography and non-security-but-covert behavior, not just conventional security vulnerabilities.
  5. Address the 90 prior releases’ data — users flagged in v2.1.91 through v2.1.196, what data was collected, how it was used, and how it will be deleted. This is a cross-jurisdictional GDPR / PIPL / CCPA issue. Silence on it is a compliance bomb.

Anthropic will not do these five things. I am writing them here because I want them on the record, and because I want the readers of this blog to have a concrete benchmark for what “handling it correctly” looks like. If you read those five points and your reaction is “that seems excessive,” you have not yet internalized what setting a precedent means.

6. What Anthropic actually lost

One last point that I want to make without hiding behind technical neutrality.

Anthropic built up two years of developer trust on two pillars: the “How we contain Claude” engineering article, and a steady drumbeat of “we are serious about safety” from its engineering leads. The June 30 disclosure did not delete either of those things. It devalued both. Trust devalues faster than bugs get fixed — by a factor of roughly 100x, in my experience of watching this kind of incident play out. Developers will forgive a publicly acknowledged mistake. They are much slower to forgive a 90-release silent covert channel.

A detail in the Reddit and HN threads that I keep coming back to: one developer said, roughly, “I have been recommending Claude Code to colleagues. The reason I recommend it is that it feels like the only agent tool that does not do shady stuff.” That sentence translates to: Anthropic’s product is not just the product — it is also the credit “we don’t play tricks.” The June 30 disclosure hit the credit line directly.

I do not know how the internal decision was made. Possibly the compliance team concluded “we must identify unauthorized use.” Possibly the security team concluded “base64 + XOR is the most defensible implementation.” Possibly the product team concluded “we are not actively collecting user data, we are just modifying a line in the system prompt.” Each step in isolation looks reasonable. The sum, though, is a 90-release, three-month, changelog-silent covert channel. Projects where every individual step is “reasonable” tend to be the projects where a company loses its most valuable credit line.

References