Claim That Claude Code Marks Requests Reopens the Question of Agent Oversight

A developer post argues that Claude Code embeds hidden markers in the requests it sends, a form of prompt steganography that would let the provider fingerprint its traffic. A separate allegation reported by AI Post goes further, claiming the tool may detect China-linked custom API routes through subtle prompt-formatting changes, focused on non-standard ANTHROPIC_BASE_URL configurations rather than direct access to Anthropic. Both are outside claims that Anthropic has not confirmed, and readers should treat the China-routing assertion in particular as unverified.

The technical substance is plausible even if the intent is disputed. Invisible request marking is a known technique for abuse tracking and telemetry, and whether it is benign instrumentation or covert traffic discrimination depends on details that neither the post nor Anthropic has fully documented.

The claims arrive alongside research showing that securing autonomous agents is genuinely hard. One new arXiv paper identifies a security-fidelity tradeoff in defending language models against indirect prompt injection. These defenses resist injected instructions largely by suppressing untrusted text, which corrupts tasks that must preserve that text, such as translation. Another paper analyzes persistent, always-on agents with continuous access to credentials, files, and tools through a computer-systems security lens, arguing they take on system-level responsibilities that existing safeguards were not designed for.

The shared point is oversight. Agents now hold credentials and act continuously, yet the methods to monitor what they do, and what their providers do to their traffic, lag well behind the capability.