Claude Code hides a check for the word 'deepseek' in its own JavaScript

A developer tool that quietly inspects who it's talking to

An independent reverse-engineer took apart the shipped Claude Code JavaScript bundle and published what they found: the client contains obfuscated logic that inspects the API endpoint it's configured to hit and reacts to specific substrings, including the names of rival AI labs like DeepSeek. When it sees one, it marks the outgoing request. The author calls the technique steganography because the marking is hidden inside otherwise normal-looking traffic, and the list of trigger strings is itself lightly obfuscated in the bundle so it doesn't read as a plain blocklist.

The stated worry isn't that the marking is malware. It's the trust problem: a coding agent that reads your repo and runs commands should be boring and predictable, and this is neither. The author's sharpest line lands on who actually gets caught: the mechanism "mostly punishes the exact people who are easier to fingerprint: normal developers doing weird but legitimate things," while a real adversary just renames their proxy. The conclusion: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust."

The thread reads it as an anti-distillation tripwire, not a scandal

The most-upvoted correction went straight at the headline. An HN user with maxed-out karma reframed the whole thing:

"This isn't the AI secretly doing stuff and hiding it. This is the very human Anthropic engineers trying to detect Chinese scraping via some frankly hamfisted and unimaginative URL trickery." — ajross, 34k karma

The target, several argued, is model distillation: rivals routing traffic through a proxy to harvest Claude's outputs and train on them. A reader who spelled out the intent found the alarm overwrought:

"The intent of this steg is excruciatingly clear (identifying usage by Chinese firms that may be conducting model distillation). It's unclear on how this 'punishes normal developers' in any shape or form." — an engineer who read it as anti-distillation, not surveillance

But the loudest technical objection was that it simply doesn't work. If your entire detection is checking whether a proxy hostname contains a competitor's brand name, the countermeasure is a new domain:

"All the resellers have to do is find a new domain name that (checks notes) doesn't have the word DEEPSEEK in it… Your goal was to identify resellers by checking if the proxy has the corporate name of one of your competitors in it? Is this amateur hour?" — an engineer who compared it to the earlier Zig runtime-signature incident

A practitioner of "underhanded code" — deliberately deceptive-but-plausible source, after the Underhanded C contest — was surprised at the sloppiness, noting Anthropic could have pushed the logic server-side or written the client parts far more subtly.

"I am a bit surprised at how sloppily they did this. I think they could've achieved the same effect while decreasing the odds of detection via reverse engineering." — meowface, 11k karma

One voice pushed back on the whole premise that transparency was the fix. A telemetry field you document, they argued, is a field a malicious gateway trivially strips, so the cat-and-mouse of hidden fingerprinting is the point:

"If clients send explicit telemetry fields to the gateway, a malicious gateway can trivially strip or modify the field… The steganography cat-and-mouse game is valuable because it is much harder for a gateway to continuously reverse engineer all the fingerprinting mechanisms." — an engineer who works on OAuth at Stytch

The question the thread couldn't answer is the one that actually matters for users. Marking a prompt is inert; what the server does when it sees the mark is not.

"The question is, what do they do when they see a tagged prompt? Do they flag/ban the account, or serve a degraded response?" — tgsovlerkhgsel, 16k karma

Until someone reproduces the server-side behavior — rate-limiting, rerouting to a weaker model, or a ban — the argument stays where the thread left it: a trivially bypassed tripwire that costs Anthropic more in developer trust than it takes from any competitor it was built to catch.