Claude Code's CLI covertly fingerprints where a user is running from — using different Unicode characters (slashes instead of dashes, a different apostrophe) in its system prompt when it detects the user is in specific Chinese time zones — likely to help detect and deter distillation attacks by Chinese AI labs.
CJ describes a reverse-engineering finding that Claude Code subtly changes formatting in its system prompt (date format, apostrophe Unicode) when it detects the user is in Chinese time zones or domains, likely to detect attempts by rival Chinese labs to distill Claude's outputs. ✦ AI generated
CJ Reynolds · Syntax · 2026-07-06 · original ↗
starts at this moment · 73:39
“Okay, that's a word. What's that word mean?”
If it detects that you're in either of these two Chinese time zones, it changes the prompt to have slashes instead of dashes and then it changes the apostrophe to use a different unicode value instead... this is essentially to help prevent distillation attacks where some of these Chinese labs like DeepSeek and some of the others like Zai are potentially prompting Claude, saving the responses, and then using that as training for their own models.
verbatim transcript · starts at 73:39
73:39just going to keep on coding. So, it's kind of you pushing you in that direction anyways. Um, and then I have this related story which some it's something else that Cloud Code was doing in their codebase. Um, and the title is Claude Code is steganographically marking requests. >> Okay, that's a word. What's that word mean? Uh so [laughter] ste steganography is when you hide information inside of
74:00something typically typically you see it with images. So like steganography can like hide a message inside of an image or something like that. Um but they use that word to say that the way that cloud code the CLI is writing its prompts is allowing them to do certain things on the back end. And the they basically reverse engineered the the cloud code locally. But the idea is when you send a
74:25prompt with cloud code, it has a piece of text at the top that says today's date is year- month-day. And that's the standard format. But there is some code that will detect like if you're running cloud code from the Asia Shanghai time zone or the Asia Eur. Is that like Russia or I don't know. >> I'm gonna go and say I do not know. Yes. >> Okay. I'll I'll look it up. I'll let
74:56that run in the background. Um northwest Oh, it's northwestern China. So, they're actually just two different Chinese time zones. So, basically, if it detects that you're in either of these two chi Chinese time zones, it changes the prompt to have slashes instead of dashes and then it changes the apostrophe to use a different unicode value instead. So if you were working on code in China and you you were even let's say you were
75:23just watching the request that cloud code was making you would kind of have no idea that it basically just fingerprinted you as someone using cloud code in China. But the way it fingerprints is it uses a different apostrophe character and uses slashes instead of dashes. Um the other thing is it can it detects uh I think like what domain you're running from and this is essentially to help prevent distillation
- ·System prompt shifts format if in 2 Chinese time zones
- ·Dashes become slashes in date formatting
- ·Apostrophe swapped to different Unicode character
- ·Hidden markers may flag rival-lab scraping of outputs
- ·Suspected targets: labs like DeepSeek and Zai
- ·Labs allegedly prompt Claude, save replies, train models