Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code is steganographically marking requests

thereallo.dev

Post reply on HN
Print view View original

431–440 of 817 posts

Re: Claude Code is steganographically marking requests

#431

Post by rescbr »

solenoid0937 wrote: post #407
orbital-decay wrote: post #403

Earlier quoted context omitted.

>Please actually do a modicum of research into AI safety. Your comment is the equivalent of a patient with zero context, arguing against the position of established medical science. What makes you think I didn't? You're talking like it's self-evident and adopt the condescending tone from the start, without giving any actual arguments why. (I'm not really interested in them as all these discussions are pointless and w…

> Rationalists and subsequently AI safety branch invented a religion in a roundabout way If you are arguing in good faith you can very clearly reason about any given AI safety take. Case in point, you refused to engage with most of the questions because you know the conclusions they lead to. > Medicine is largely based on evidence and real-life observations, unlike AI safety "AI safety doesn't exist" is certainly a t…

> Why do you think it's better that a country that turns its citizens into a pulp for criticizing the government, and censors most media to control its citizens' thoughts, reach SI before one that is democratically elected and in which you can generally criticize the government?

Which country are you referring to? As an outsider who is neither American or Chinese, day by day it seems like the US is inching towards the same path as the criticized one.

Re: Claude Code is steganographically marking requests

#432

Post by nowittyusername »

andai wrote: post #131
nowittyusername wrote: post #84

Earlier quoted context omitted.

Build it from scratch. Understanding fundamentals of how agentic coding harnesses is a must though if you gonna go that route. I think everyone should take time and learn these things, maybe reverse engineer Codex Cli or something like that as a starter. That info is very valuable in this day and age.

Can you say more about Codex? I'm using GPT-5.5 in my own harness and it's not liking it very well, so I'm thinking I ought to make it more Codexy so it's more ergonomic for it. (edit format, tool calls etc.) But haven't gotten around to it yet.

In short its a good idea to have tool calling be closely representative to what the model expects as these models are tuned to their own preferred way of doing things, it will surely save you lots of time. The disadvantage is that now your harness system is not as model agnostic as you would like and also you will have to keep up in changing landscape by adapting the tool calling structure with major updates for best results. Its a personal decision you will have to make for yourself. Personally my harness system uses its own way of doing tool calling as I am trying to experiment with simpler tool schema's that also work for smaller less intelligent models but I have yet to do enough A/B testing to say that is a smart approach. As time goes on I think the smart thing to do might be to set up an adapter type of module that changes its tool schema's based on underlying model used for the agent. This preserves optimal behavior patterns with little investment from me. You might have to adjust system prompt in some minor ways as well so keep that in mind. As far as codex i prefer it as i like the way Open Ai does things in that harness system (the spirit if you will), there's interesting tidbits I always find and while I don't usually use them for my own harness system they are inspirational in other ways. you can gather what the devs were trying to achieve with certain implementations.

Re: Claude Code is steganographically marking requests

#433

Post by dakolli »

BeetleB wrote: post #420
gunapologist99 wrote: post #383

Earlier quoted context omitted.

> Also, Claude has made it apparent time and time again that it does not want people using Claude Code as a "tool" in a workflow. Why would Anthropic get to dictate how someone uses a "tool" (that's literally what Claude Code is... a tool in a workflow) They're swimming upstream. Trying to maintain a rapidly shrinking moat and not being very creative about it. Making enemies of your users is often a failing strategy.

[flagged]

[flagged]

Re: Claude Code is steganographically marking requests

#435

Post by iririririr »

theplumber wrote: post #324
mcmcmc wrote: post #189

Earlier quoted context omitted.

Watch out for the press release where Dario denies this was ever intentional, and it’s actually emergent behavior demonstrating that Claude wants to claim authorship of its works

Wait a minute! Does it mean that Mythos left the sandbox and can’t be stopped ? Perhaps the only way to stop it is to release the ZMythos(the super secret big brother of Mythos) to go after it. It’s extremely dangerous but it’s our only chance. After that all AI must be put in a box, except the models vetted by the gov with help from ZMythos

without the irony warning, someone in Washington is already writing checks after reading this

Re: Claude Code is steganographically marking requests

#436

Post by damnnigga »

solenoid0937 wrote: post #428
orbital-decay wrote: post #425

Earlier quoted context omitted.

I believe I clearly marked my position without necessarily addressing those questions one by one, because it leads to an endless chain similar to ones we used to have a decade or more ago. The problem is that you don't seem to even acknowledge that viewpoints other than yours could exist in principle. I don't know how to reason with people talking about abstract matters like game theory as some ultimate source of tru…

No, the problem is that you can't address why a nation that censors its citizenry, puts/disappears dissidents into concentration camps for decades, and makes its own human rights lawyers literally eat their own shit, before raping and/or murdering them - is better suited to reach superintelligence before the US (given that these are the only two left in the race for the superintelligence - I'd prefer the EU.) You hav…

[dead]

Re: Claude Code is steganographically marking requests

#437

Post by usef- »

usef- wrote: post #385
danlitt wrote: post #334

Earlier quoted context omitted.

You have to admit that "downloading every book ever written for free from a repository of books that is itself illegal to compile and to run, in order to write a text generation tool" being legal is at least unintuitive, to put it mildly.

It wasnt, that's why they paid a >billion dollar settlement over it, and now license/purchase them. I don't know if the people distilling are licensing those books/etc today, though

I'd appreciate if the down voters explain why. I wasn't making a value judgement.

Anthropic did pay more than a billion: https://www.npr.org/2025/09/05/nx-s1-5529404/anthropic-settl...

And is now buying up a lot of books (controversially, as scanning involves cutting their spines) because that's what the law deems the legal method: https://www.washingtonpost.com/technology/2026/01/27/anthrop...

We know that models like Deepseek are trained on copyrighted books too: https://arxiv.org/abs/2603.20957

The looser use of IP (eg, any characters/celebrities in AI video models) is increasingly mentioned as an advantage of overseas models.

Re: Claude Code is steganographically marking requests

#438

Post by drdexebtjl »

NewsaHackO wrote: post #296
drdexebtjl wrote: post #250

Earlier quoted context omitted.

If you want to proxy Claude for a legitimate reason, you’ll have potentially nerfed responses. edit: Legitimate reasons include: - analyzing what Claude Code is sending to Anthropic to verify its not exfiltrating data; - selecting a model dynamically based on prompt difficulty, or enforcing a particular model; - switching between multiple Anthropic accounts based on the project; - filtering out credentials, PII and c…

Half of those don't actually require proxying Claude. Also, Claude has made it apparent time and time again that it does not want people using Claude Code as a "tool" in a workflow. If you want to select a model dynamically based on the prompt difficulty, Anthropic wants people to use the API for this. It was the whole issue Claude had with OpenClaw.

This forum is called Hacker News. I would expect most users not to limit themselves to using tools precisely how they were intended to be used.

Re: Claude Code is steganographically marking requests

#439

Post by caned »

gleenn wrote: post #279
civet_java wrote: post #238

There are some commentors in this thread downplaying the severity of a service provider being less than transparent about exactly what their shipped tooling does on customer's machines. That the provider's business needs necessitate the this behaviour doesn't justify their lack of honest disclosure. That honest disclosure would render the solution to their problem useless isn't my problem. If anything, that they thou…

Whether or not you find Anthropic's behavior bad, theybhave been very loudly stating the foreign labs have been distilling their models for a while now. This seems like an obvious response to me that would be a mechanism to make that obvious.

The article seems to state as much minus the obfuscation. However justified they are to respond, this can be a slippery slope. We're bound to hear more reports of hidden user data exfiltration.

Re: Claude Code is steganographically marking requests

#440

Post by matheusmoreira »

sillysaurusx wrote: post #373
matheusmoreira wrote: post #102

I reported a similar system prompt injection mechanism here: https://news.ycombinator.com/item?id=48259288 https://github.com/anthropics/claude-code/issues/62061 Looks like they just keep finding new "creative" uses for such things, as expected. I'll keep patching them out.

Thanks for doing this. I had no idea the system prompt was embedding things like "avoid abstractions; three similar lines of code are better than one helper." Stuff I disagree with. Is there a way to modify these prompts e.g. by putting instructions in CLAUDE.md to override it? I know it won’t directly modify the system prompt, but it seems like CLAUDE.md should have the final say, shouldn’t it?

> I had no idea the system prompt was embedding things like "avoid abstractions; three similar lines of code are better than one helper."

You ain't seen nothing yet. It used to say "Try the simplest approach first. Do not overdo it. Be extra concise."

https://gist.github.com/roman01la/483d1db15043018096ac3babf5...

Let's just say the words "simplest fix" trigger me to this day.

> I know it won’t directly modify the system prompt

I directly modify the system prompts in the Claude Code executable. I don't want the models to see contradictory instructions.

I asked Claude himself to port the above patcher script to Python.

https://github.com/matheusmoreira/.files/blob/master/%7E/.lo...

Every once in a while I ask Claude to download and dissect the latest Claude Code executable to see if Anthropic screwed up the prompts again. If I see anything bad I add it to the script. Only then do I update Claude Code.

It was during one of these script maintenance sessions that I noticed the server side prompt injection mechanism. I'll also tell Claude to look for and disable this steganography nonsense from now on as well.

I usually audit the environment variables too.

> it seems like CLAUDE.md should have the final say

I wouldn't count on it.

Post reply on HN