Claude Code Is Steganographically Marking Requests

Most devs give their harnesses ridiculous access. FS, shell, git, browser access, even computer use nowadays. That is the whole point. They need enough context to do useful work. That also means the client itself deserves scrutiny. If a coding agent can read your repo and run commands, the binary that ships it should be boring (for example, pi harness)

[mkusaka]

Claude Code 2.1.196がANTHROPIC_BASE_URLとtimezoneでシステム日時文の記号を変え、API経路情報をステガノグラフィで隠すと指摘。