Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code is steganographically marking requests

thereallo.dev

Post reply on HN
Print view View original

141–150 of 817 posts

Re: Claude Code is steganographically marking requests

#141

Post by writeslowly »

skeptic_ai wrote: post #118
meowface wrote: post #92

Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering. (This field is known as "underhanded code", coined by the Underhanded C contest: https://www.underhanded-c.org . It's a little-known "art"; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving o…

It’s even more funny how this blew in their faces. They even advertised pretty much all providers on hackernews home page. Here is in case you missed in the article ‘’’ cn baidu.com alibaba-inc.com alipay.com antgroup-inc.cn bytedance.net kuaishou.com xiaohongshu.com jd.com bilibili.co iflytek.com stepfun-inc.com moonshot.ai anyrouter.top claude-code-hub.app claude-opus.top openclaude.me proxyai.com yunwu.ai zenmux.a…

The site collection seems pretty random. There's a mix of actual AI labs, extremely questionable resellers (like whatever "claude-opus.top" is), and then random consumer sites like baidu and xiaohongshu.

Re: Claude Code is steganographically marking requests

#142

Post by yomismoaqui »

thih9 wrote: post #70
wolttam wrote: post #36

I used Claude Code for a month because my boss gifted me a sub and wanted me to try it. I used that month to complete a work project and then beef up my personal harness so I'd never have to deal with Anthropic (and these sorts of shenanigans) again.

How do people build something like a personal harness? Are there tools for that or is it done from scratch?

Building something like this is the todo list of agents.

I found this one easy to understand:

https://ampcode.com/notes/how-to-build-an-agent

Re: Claude Code is steganographically marking requests

#143

Post by ajyoon »

m-hodges wrote: post #117
meowface wrote: post #92

Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering. (This field is known as "underhanded code", coined by the Underhanded C contest: https://www.underhanded-c.org . It's a little-known "art"; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving o…

They also could have been much more interesting in the approach. LLMs can use their token distributions to generate stegotext that read like plausible prose but decode to payloads.¹ ¹ https://github.com/hodgesmr/calgacus-mlx

Sure, but the point here is to add a fingerprint from the client.

Re: Claude Code is steganographically marking requests

#144

Post by slopinthebag »

meowface wrote: post #92

Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering. (This field is known as "underhanded code", coined by the Underhanded C contest: https://www.underhanded-c.org . It's a little-known "art"; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving o…

It’s not surprising at all, they’re vibecoding Claude code so of course they are not going to get anything other than slop out of it. A novel or clever solution is just out of the question for them.

Re: Claude Code is steganographically marking requests

#145

Post by sandeepkd »

skeptic_ai wrote: post #121
pmxi wrote: post #80

Earlier quoted context omitted.

This catches Claude resellers. Meaning companies who proxy Claude traffic for users in, say, China. https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...

Won’t catch many after has been on hn home page. And now the providers will be even more careful to upgrade the cc code. Might even provide their own agent to prevent this mockery. And isn’t what anthropic did unauthorized use of another pc which is kind of illegal?

Thats the thing, hoping to control things on client side like this is a lost battle if you are dealing with technical clients. The best they can do is probably based on IP, but again the motivated clients would just create bastion servers in allowed IP ranges. I am surprised why are they even throwing resources in this kind of effort.

Re: Claude Code is steganographically marking requests

#146

Post by slowmovintarget »

MichaelZuo wrote: post #93
krupan wrote: post #87

Earlier quoted context omitted.

Given the Anthropic shenanigans, do you trust the personal harness code it wrote for you?

Does anyone know what’s gone wrong with Anthropic? They used to be a decently credible company with not-too-shady behaviour... I hope they can actually regain some credibility…

Their philosophy is what's gone wrong.

It has some good effects on the their models, like Claude seeking cooperation first. But the people behind the company have a typical "unconstrained" (in the Sowell vision sense) perspective that assumes that they know better, so they are righteous for attempting to control things (users, paying customers, their model outputs, their tool chain, the supposed deity they assume they will produce... etc.)

Re: Claude Code is steganographically marking requests

#148

Post by chvid »

(This sounds like a clumsy way of catching the Chinese that easily can be side-stepped.)

Claude Code has more or less full access to the client computer. The server (that hosts the actual AI) can just go: execute this payload and tell me the result - otherwise I won't answer any further questions or re-route you to a stupider model.

The payload could check for Chinese time-zones, scan for copies of the little red book on the local hard-drive, or ping truth.social to see it was behind the great firewall.

Re: Claude Code is steganographically marking requests

#150

Post by hn_throwaway_99 »

meowface wrote: post #92

Value judgment aside: I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering. (This field is known as "underhanded code", coined by the Underhanded C contest: https://www.underhanded-c.org . It's a little-known "art"; little-known for probably self-explanatory reasons. There are much cleverer ways of achieving o…

At first I was agreeing with you, that this seemed like a sloppy way to implement this that was sure to be pretty quickly detected, but there is another possibility.

Anthropic could have implemented this not as a durable detection system against proxying resellers, but instead as a point-in-time sampling system to detect where (and with what context) proxying reselling is currently happening. Sure, it would be detected eventually, but in the meantime Anthropic could gain useful snapshot data.

Post reply on HN