Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code is steganographically marking requests

thereallo.dev

Post reply on HN
Print view View original

121–130 of 817 posts

Re: Claude Code is steganographically marking requests

#121

Post by skeptic_ai »

pmxi wrote: post #80
sebastiennight wrote: post #50

Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn't this "marked" system prompt being sent to that provider's API rather than Anthropic's? I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where "hostname contains deepseek" would never be sen…

This catches Claude resellers. Meaning companies who proxy Claude traffic for users in, say, China. https://www.chinatalk.media/p/how-to-buy-cheap-claude-tokens...

Won’t catch many after has been on hn home page. And now the providers will be even more careful to upgrade the cc code. Might even provide their own agent to prevent this mockery. And isn’t what anthropic did unauthorized use of another pc which is kind of illegal?

Re: Claude Code is steganographically marking requests

#122

Post by imhoguy »

MichaelZuo wrote: post #93
krupan wrote: post #87

Earlier quoted context omitted.

Given the Anthropic shenanigans, do you trust the personal harness code it wrote for you?

Does anyone know what’s gone wrong with Anthropic? They used to be a decently credible company with not-too-shady behaviour... I hope they can actually regain some credibility…

Enshitification. Too big to.. upset the govt.

Re: Claude Code is steganographically marking requests

#124

Post by jacobgold »

> "That also means the client itself deserves scrutiny. If a coding agent can read your repo and run commands, the binary that ships it should be boring (ƒor example, pi harness)"

You're actually trust your security to your harness AND model AND inference API provider in this scenario: https://jacob.gold/posts/why-i-wont-run-untrusted-models/

Re: Claude Code is steganographically marking requests

#125

Post by [deleted] »

sebastiennight wrote: post #50

Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn't this "marked" system prompt being sent to that provider's API rather than Anthropic's? I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where "hostname contains deepseek" would never be sen…

[deleted]

Re: Claude Code is steganographically marking requests

#127

Post by mgraczyk »

realusername wrote: post #10
MattDamonSpace wrote: post #4

“So the feature mostly punishes the exact people who are easier to fingerprint: normal developers doing weird but legitimate things” What’s the punishment here exactly?

They probably run a heavily dumbed down version of the model, same as what they got caught doing with Fable. And that's also why, as a legitimate customer, want none of it, you never know if you accidentally entered a zone they don't like.

"got caught"

to clarify, this behavior was announced with the model release

Re: Claude Code is steganographically marking requests

#128

Post by andai »

sebastiennight wrote: post #50

Can somebody clarify for me - if ANTHROPIC_BASE_URL is set to a different provider... then isn't this "marked" system prompt being sent to that provider's API rather than Anthropic's? I understand how this can be useful to Anthropic if the 3rd-party is acting as a proxy (because they end up hitting the Claude API with the marked prompt), but it looks like requests where "hostname contains deepseek" would never be sen…

Did I understand correctly, that custom base URL triggers this behavior? So if I'm running Claude through a LLM proxy, I'm also affected?

Re: Claude Code is steganographically marking requests

#130

Post by _alternator_ »

charcircuit wrote: post #95
_alternator_ wrote: post #77

Earlier quoted context omitted.

I'd love for you to try this and report back. My guess is that no models today will successfully run a binary analysis for fingerprinting without a lot of handholding. If you try to use Opus it will almost certainly decline (and fingerprint/ban you).

Not with Claude Code, but I trivially had Opus scan other closed source software for fingerprinting, including native libraries that it called into.

Can you share more details? I ask because my experience suggests that models still require a decent amount of expertise to use for binary analysis (largely inferring because of use on other tasks of this level). I would expect models to always find "something" when you ask for stenographic techniques in the code, but with an extremely high false positive rate.
Post reply on HN