Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code is steganographically marking requests

thereallo.dev

Post reply on HN
Print view View original

131–140 of 817 posts

Re: Claude Code is steganographically marking requests

#131

Post by andai »

nowittyusername wrote: post #84
thih9 wrote: post #70

Earlier quoted context omitted.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Build it from scratch. Understanding fundamentals of how agentic coding harnesses is a must though if you gonna go that route. I think everyone should take time and learn these things, maybe reverse engineer Codex Cli or something like that as a starter. That info is very valuable in this day and age.

Can you say more about Codex? I'm using GPT-5.5 in my own harness and it's not liking it very well, so I'm thinking I ought to make it more Codexy so it's more ergonomic for it. (edit format, tool calls etc.) But haven't gotten around to it yet.

Re: Claude Code is steganographically marking requests

#132

Post by andai »

kolinko wrote: post #76
thih9 wrote: post #70

Earlier quoted context omitted.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

It’s not that difficult, it’s just a system prompt and a set of basic file edit/bash/etc tools. Me, personally, I didn’t build it from scratch but I ported original CC from published sources into Python and extended it to match my own requirements.

Are you using it with Claude? They only allow their own harness with the subs right? (And per-token billing is like 10x more expensive?)

Re: Claude Code is steganographically marking requests

#133

Post by algoth1 »

VortexLain wrote: post #56

Codex CLI is FOSS, unlike Claude Code, so Codex is less likely to do things like that, and it's one more reason to avoid Claude Code and Claude in general. Hopefully, many eyes will be looking into Codex for malicious things like that.

But wasnt claude code leaked? Why wasnt this found earlier?

Re: Claude Code is steganographically marking requests

#134

Post by andai »

echelon wrote: post #85
thih9 wrote: post #70

Earlier quoted context omitted.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Why use a personal harness? You have to pay API pricing, which is far more costly. I'd either switch to GLM wholesale or just continue to use Opus within Claude Code as the blessed, subsidized path.

I use GLM in my custom harness. It completes the same tasks at the same level of quality, except 8x faster and 8x cheaper. (Same goes for GPT!)

I'm not sure how that's possible. I expected to get increased correctness for that order of magnitude (something something test-time compute!) but I am not getting it.

Re: Claude Code is steganographically marking requests

#135

Post by [deleted] »

andai wrote: post #128
sebastiennight wrote: post #50

Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn't this "marked" system prompt being sent to that provider's API rather than Anthropic's? I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where "hostname contains deepseek" would never be sen…

Did I understand correctly, that custom base URL triggers this behavior? So if I'm running Claude through a LLM proxy, I'm also affected?

[deleted]

Re: Claude Code is steganographically marking requests

#136

Post by abtinf »

thih9 wrote: post #70
wolttam wrote: post #36

I used Claude Code for a month because my boss gifted me a sub and wanted me to try it. I used that month to complete a work project and then beef up my personal harness so I'd never have to deal with Anthropic (and these sorts of shenanigans) again.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Here is a video I made explaining it from absolute basics:

https://m.youtube.com/watch?v=_AgKuFGvJfI

And the repo:

https://github.com/abtinf/homunctor

Re: Claude Code is steganographically marking requests

#138

Post by JTbane »

echelon wrote: post #85
thih9 wrote: post #70

Earlier quoted context omitted.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Why use a personal harness? You have to pay API pricing, which is far more costly. I'd either switch to GLM wholesale or just continue to use Opus within Claude Code as the blessed, subsidized path.

I would guess it is to avoid model lock-in.

Re: Claude Code is steganographically marking requests

#139

Post by sigmoid10 »

krupan wrote: post #120
sigmoid10 wrote: post #32

If they only collect the data for analysis I guess this is fine (they already get way more sensitive data from users anyways, so if privacy is your concern you've made the mistake many steps ago). The much more interesting question is if they directly act on this data in their API. For example by rate-limiting, compute-limiting or rerouting to weaker models. That might even be legally questionable. I would really lik…

"If they only collect the data for analysis I guess this is fine" I think you missed the memo on how foolish this attitude is. It came out around the time Edward Snowden made his discoveries at the NSA public. I suggest you look into it

As I said above, if you are worried about privacy while hooking up Claude Code, you need to reevaluate your understanding of this technology.

Re: Claude Code is steganographically marking requests

#140

Post by hombre_fatal »

MichaelZuo wrote: post #93
krupan wrote: post #87

Earlier quoted context omitted.

Given the Anthropic shenanigans, do you trust the personal harness code it wrote for you?

Does anyone know what’s gone wrong with Anthropic? They used to be a decently credible company with not-too-shady behaviour... I hope they can actually regain some credibility…

I don't think many people care that they are trying to detect resellers and distillation.

It also doesn't seem very consistent to fixate on that while sending Anthropic everything about you via your day to day prompts, every line of the projects and environments you're working on at work, etc.

Their credibility comes from having one of the best models.

Post reply on HN