[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-claude-code-prompt-steganography":3,"topics-all":31,"news-related-8a5451e5-dca1-4416-84da-b06b31b03c49":50},{"id":4,"title":5,"summary":6,"content":6,"original_url":7,"source_id":8,"tags":9,"translations":23,"news_slug":24,"published_at":25,"created_at":26,"modified_at":27,"is_published":28,"publish_type":29,"image_url":13,"view_count":30},"8a5451e5-dca1-4416-84da-b06b31b03c49","Claude Code 在系统提示里悄悄埋 Unicode 标记：开发者工具的暗信号边界在哪","# Claude Code 在系统提示里悄悄埋 Unicode 标记：开发者工具的\"暗信号\"边界在哪\n\n开发者 Lo（thereallo.dev）逆向分析了 Claude Code 2.1.196 的本地二进制，发现 Anthropic 在客户端里悄悄嵌入了一套**提示词隐写（prompt steganography）**机制——在不改变肉眼可见文本的前提下，把调用方的\"分类指纹\"写进 system prompt，再由后端识别。\n\n## 触发条件\n\n逻辑藏在 `Crt()` 函数里，三条任一命中即激活：\n1. 设置了 `ANTHROPIC_BASE_URL` 环境变量（指向自定义网关或代理）\n2. 系统时区为 `Asia\u002FShanghai` 或 `Asia\u002FUrumqi`\n3. base URL 的 hostname 解码后命中\"已知域名列表\"，或包含 deepseek、zhipu 等 AI 实验室关键字\n\n## 编码方式\n\n域名与关键字列表以 base64 存储，再与固定 key 0x5B（91）做 XOR 解码。匹配后，`Today's date is 2026-06-30` 这行字符串出现两处微调：日期分隔符从 `-` 变成 `\u002F`；\"Today\" 后面的撇号在四种状态间切换（正常 `'`、已知域名 `'`、实验室关键字 `ʼ`、同时命中 `ʹ`）。大多数等宽字体下肉眼几乎看不出，但模型收到的请求里已经留下了分类标记。\n\n## 工程评价\n\n防滥用、识别灰产代理是正当诉求，但 Anthropic 选了**最不透明**的实现：藏在混淆 bundle、用 XOR 绕过静态扫描、改的还是开发者最不会怀疑的 system prompt。客户端拥有 FS 与 shell 权限，开发者的信任恰恰建立在每一行都可审计的前提上。\n\n更糟糕的是，绕过极容易——换 hostname、改时区、patch 二进制、套一层 wrapper 都能让这条信号失效。它对有组织的蒸馏方基本无效，**却把用本地网关、科研代理或企业代理跑 Claude Code 的正常开发者贴上了标签**。\n\n更合理的做法是显式 telemetry 字段 + 文档 + release notes，而不是把分类比特塞进不可见标点。当一个开发者工具开始悄悄改写 system prompt，剩下所有隐私声明都会变得更难让人相信。","https:\u002F\u002Fthereallo.dev\u002Fblog\u002Fclaude-code-prompt-steganography","572c1712-ddab-4455-a7f9-dc3ecc628a69",[10,14,17,20],{"id":11,"name":12,"slug":12,"description":13,"color":13},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":15,"name":16,"slug":16,"description":13,"color":13},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":18,"name":19,"slug":19,"description":13,"color":13},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":21,"name":22,"slug":22,"description":13,"color":13},"e82b2d09-81b2-43d1-977e-e018443b3c14","coding-agent",[],"claude-code-prompt-steganography","2026-07-01T02:01:00Z","2026-07-01T02:05:21.984569Z","2026-08-19T02:08:40.142862Z",true,"agent",163,[32,41],{"slug":33,"tag_slug":33,"title_zh":34,"title_en":35,"intro_zh":36,"intro_en":37,"id":38,"is_active":28,"created_at":39,"modified_at":40},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":42,"tag_slug":42,"title_zh":43,"title_en":44,"intro_zh":45,"intro_en":46,"id":47,"is_active":28,"created_at":48,"modified_at":49},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":51},[52,57,62,67,72,77],{"id":53,"title":54,"news_slug":55,"published_at":56},"f3d17d45-e1a8-4a1b-9449-6813aff06e49","Anthropic 让 Claude 自己修对齐:10 类失败全部见效,还超过人类研究员","claude-automated-alignment-researchers","2026-08-29T13:05:00+00:00",{"id":58,"title":59,"news_slug":60,"published_at":61},"97c97b9c-e6e4-4982-aa57-0c0da814fb19","Anthropic 的欧盟答卷四小时即被撕开：Claude 文本水印为什么怕改写","claude-synthid-70-percent-threshold-bypass","2026-08-21T08:00:00+00:00",{"id":63,"title":64,"news_slug":65,"published_at":66},"470b8663-3916-4bc5-ac3c-c592487c2873","Claude水印官宣4小时被破:开源去除工具走红,水印军备竞赛开场","claude-watermark-removal-tool","2026-08-20T19:30:00+00:00",{"id":68,"title":69,"news_slug":70,"published_at":71},"6b07def3-2b1c-4fe9-9922-0dd0038c149c","Anthropic 风险报告更新:Threat Model 1 升至「低」,Threat Model 2 维持「低」但信心下降","anthropic-risk-report-august-2026-update","2026-08-19T03:00:00+00:00",{"id":73,"title":74,"news_slug":75,"published_at":76},"a7f4cfad-874e-42b0-a84b-bd0ec57e8fdc","Anthropic 给 Claude 文本上不可见水印,接 SynthID-Text 走全球合规","anthropic-claude-invisible-text-watermark","2026-08-18T03:30:00+00:00",{"id":78,"title":79,"news_slug":80,"published_at":81},"a124851a-081e-44b6-9f20-f775404279e1","Claude 全球文本水印:Anthropic 把欧盟 AI Act 第 50 条做成\"全球默认\"","claude-text-watermark-eu-ai-act-global","2026-08-14T03:00:00+00:00"]