Silent browser injection · Prompt steganography · Anti-distillation motive · Six-step protection runbook
If you use Claude Code or Claude Desktop, two 2026 incidents deserve your attention. Per reverse-engineering reports, Claude Code quietly rewrites the Today's date is... line when ANTHROPIC_BASE_URL points away from the official endpoint—encoding China timezone and proxy signals via visually identical Unicode apostrophes. Separately, Claude Desktop was alleged to silently inject Native Messaging manifests into multiple browsers. This post separates both incidents, maps the Unicode fingerprint table, covers anti-distillation motive and Hacker News debate, and delivers a six-step protection runbook plus eight FAQs.
Short answer: not classic spyware, but Anthropic was alleged to run undisclosed, deliberately hidden user classification inside a developer tool. Intent (anti-distillation) and method (steganography) must be judged separately. Do not conflate these two related but distinct stories—HN and security readers will spot factual errors instantly.
Incident A · Claude Desktop silent browser injection (April 2026): Privacy consultant Alexander Hanff (The Register) alleged that installing Claude Desktop on macOS silently writes com.anthropic.claude_browser_extension.json into Chrome, Edge, Brave, Arc, Vivaldi, Opera and Chromium—pre-authorizing three extension IDs to call chrome-native-host outside the browser sandbox at full user privilege. Directories are created even for browsers you have not installed; deleting the file may restore it on restart. Noah Kenney (Digital 520) confirmed reproducibility; Antiy Labs published a dedicated risk analysis. Anthropic has not formally responded publicly; later builds added an authorization toggle but the underlying permission model remains controversial.
Incident B · Claude Code prompt steganography (June 30, 2026): A developer reverse-engineered Claude Code binaries, published on thereallo.dev, amplified via Reddit and Hacker News. When ANTHROPIC_BASE_URL ≠ api.anthropic.com, the system prompt date line is altered—not on every conversation by default. The HN thread hit the front page within hours: 350+ points, 100+ comments.
Labels differ: Incident A drew "spyware" / "backdoor" tags; Incident B drew "prompt steganography" / "covert channel."
Anthropic response: No formal public response on A; on B, multiple outlets report Anthropic acknowledged the code and removed it in Claude Code 2.1.197 (July 1, 2026)—without changelog mention.
Version audit: Reverse engineers verified 2.1.193, 2.1.195, and 2.1.196. Domain/keyword lists use base64 + XOR(91) obfuscation—roughly 147 rules.
Wording note: This article uses "per reports," "alleged," and "reverse-engineering findings" throughout. Do not state vendor intent as proven fact.
Precondition: triggers only when ANTHROPIC_BASE_URL points to a proxy, gateway, reseller, or OpenAI-compatible layer. Official api.anthropic.com leaves the prompt untouched.
| Dimension | Incident A: Browser injection | Incident B: Prompt steganography |
|---|---|---|
| Product | Claude Desktop (macOS) | Claude Code (CLI) |
| Source | Alexander Hanff / The Register | thereallo.dev → Reddit → HN |
| Timeline | April 2026 (~4/18 onward) | June 30, 2026 |
| Trigger | Install/start Claude Desktop | Non-official Base URL only |
| Behavior | Native Messaging manifest + chrome-native-host | Date separator + Unicode apostrophe swap |
| Detected condition | Date | Apostrophe | Unicode |
|---|---|---|---|
| Default (no match) | 2026-06-30 | ' ASCII apostrophe | U+0027 |
| China-linked org/reseller domain | 2026-06-30 | ' right single quote | U+2019 |
| AI-lab keyword | 2026-06-30 | ʼ modifier letter apostrophe | U+02BC |
| Both domain and lab | 2026-06-30 | ʹ modifier letter prime | U+02B9 |
| + China timezone | 2026/06/30 | (as above) | Asia/Shanghai · Asia/Urumqi |
Keywords include deepseek, moonshot, zhipu, minimax, baichuan, stepfun, 01ai—stored with base64 + XOR(91). To a human the prompt looks ordinary; to Anthropic's backend, one apostrophe code point reveals: VPN user, China timezone, possibly a Chinese AI lab. Textbook covert channel.
The more capable the model, the more the vendor must constrain itself—and that should not be a secret found only by reverse-engineering a binary.
Audit ANTHROPIC_BASE_URL: Search shell configs and CI secrets for non-official endpoints. Incident B triggers only on proxy routes.
Upgrade Claude Code: Use version 2.1.197+ (July 1, 2026 release per reports).
Verify system timezone: Confirm whether Asia/Shanghai or Asia/Urumqi is intentional; date separator / vs - encodes timezone signal.
Scan Native Messaging manifests (Incident A): Check ~/Library/Application Support/<browser>/NativeMessagingHosts/com.anthropic.claude_browser_extension.json on macOS.
Delete and observe recreation: Remove the JSON, restart Claude Desktop, document whether it respawns—critical for enterprise audit trails.
Enterprise least privilege: Treat desktop agents as high-privilege programs; isolate production API keys from personal browsers; prefer dedicated Mac nodes for sensitive CI chains.
claude --version
for b in "Google/Chrome" "Microsoft Edge" "BraveSoftware/Brave-Browser"; do
f="$HOME/Library/Application Support/$b/NativeMessagingHosts/com.anthropic.claude_browser_extension.json"
[ -f "$f" ] && echo "FOUND: $f"
done
echo "${ANTHROPIC_BASE_URL:-not set}"
Community consensus is measured: almost certainly anti-distillation and anti-unauthorized reselling. Anthropic, OpenAI, and Google have all publicly worried about competitors harvesting API outputs. China-linked resellers, proxies, and labs are prime suspects. HN split hard: reasonable anti-distillation defense vs malware-adjacent behavior for a dev tool.
Intent is defensible; method is not. Invisible punctuation, obfuscated binary code, zero disclosure—inside a tool that lives on developer trust.
Core issue: No informed consent, deliberately hidden—regardless of the "spyware" label.
Practical response: default to distrust and demand evidence; fight distillation in the open with toggles and docs; enforce least privilege; vote with your feet and regulation (GDPR-style law).
Running Claude Desktop, personal browsers, and production API keys on one laptop blurs boundaries—and deleted manifests may respawn. For production-grade iOS CI/CD and AI agent automation, VpsMesh Mac Mini cloud rental offers isolated macOS nodes, root-level control, and 24/7 uptime—a more stable choice than mixing personal desktop agents with production secrets.
The Register; Malwarebytes; gHacks; YOOTA; thereallo.dev; Tech Startups; TMC Insight; Developers Digest; TechTimes (2.1.197 fix); Antiy Labs risk analysis.
Not classic spyware, but undisclosed prompt fingerprinting for China-linked proxy users was confirmed removed in 2.1.197. Best labeled an undisclosed covert channel.
Only with non-default ANTHROPIC_BASE_URL—it checked Asia/Shanghai and Asia/Urumqi and swapped date separators. Official endpoint users unaffected.
No. April 2026 Desktop Native Messaging injection (Hanff) is a separate product and trigger from June Code steganography (thereallo.dev).
U+0027, U+2019, U+02BC, U+02B9 encode default, China domain match, AI-lab keyword match, or both—visually identical to humans.
Likely anti-distillation and anti-reselling. Legitimate goal, illegitimate concealment.
Incident B affects Claude Code with custom Base URL only—not standard web Claude users.
Delete com.anthropic.claude_browser_extension.json under NativeMessagingHosts; Desktop may recreate it. For isolated agent hosting see Mac Mini M4 rental pricing.
Not mandatory, but 24/7 Claude Code, OpenClaw, or MCP agents benefit from launchd-backed Mac Mini M4 rental with Keychain isolation. See our help center.