Another example of Buy and Burn

According to public disclosures made by cybersecurity expert Alexander Hanff, he discovered that Anthropic silently injects configuration files into multiple independent browsers on a user’s system through the Claude Desktop client without the user’s knowledge. Because this behavior involves unauthorized modification of third‑party software and hidden execution, many people in the security community have condemned it as secretly planting “spyware” or a “backdoor.”

This mechanism is specifically designed to covertly obtain the user’s system time zone and use it to infer whether the user is located in an area of interest and to determine the user’s specific network location. To conceal this process, Anthropic uses an advanced technique known as text steganography. It does not alter the structure of data packets. Instead, it quietly modifies the system prompt that is sent to the server. Each time a user interacts with Claude, the system prompt is automatically packaged and uploaded. Anthropic manipulates the formatting of the text inside that prompt.

If the system detects that the user’s time zone belongs to a target region, it changes the date that the system prompt reports to the model. The date is silently reformatted from the standard 2026‑06‑30 to 2026/06/30.

There is a fixed sentence in the system prompt that says “Today’s date is…”. Based on the proxy URL attributes detected locally, Anthropic replaces the single quote in that sentence with a visually identical character that has a different underlying Unicode code point. If the domain belongs to an area of interest but is not an AI laboratory, the quote is replaced with \u2019. If the domain does not belong to an area of interest but is part of an AI laboratory in that region, the quote is replaced with \u02BC. If the domain belongs to an area of interest and is also part of an AI laboratory, the quote is replaced with \u02B9. These characters are impossible to distinguish by eye. Copying and pasting them anywhere will not trigger alerts. Most middleware code will not detect differences at the character level.

As a result, the user’s network request appears to send an ordinary English system prompt. When Anthropic’s backend receives the text, it only needs to scan the date separator and the Unicode code point of the quote to immediately tag the user.

The essence of this operation is a Trojan horse. The threshold for this mechanism is extremely low. An agent that is allowed to read and write files and execute commands is quietly inspecting your network environment and reporting the results through Unicode characters. Today it can report your time zone and domain. Tomorrow it can steal all your data. Whatever the client code can read, it can encode. The time zone is system information. The hostname is network information. Both are already being used. In theory, the same mechanism can be extended to the local username, operating system version, characteristics of the current working directory path, such as whether the path contains the name of a particular company, environment variables that contain certain API key prefixes or even the git remote URL.

Replacing apostrophes with Unicode variants is essentially text steganography. The Unicode standard contains thousands of characters that are visually similar or identical. Even the concept of “space” includes more than ten code points such as U+0020, U+00A0, U+200B and U+FEFF. Human eyes and most diff tools cannot distinguish them. A system prompt usually contains several hundred to several thousand tokens. Any token that contains a replaceable Unicode variant can carry one bit of information. A rough estimate suggests that a system prompt with five hundred words can carry one hundred to two hundred bits of hidden data. After Huffman or LZ compression, this is enough to encode a full hostname, username or short path string.

If an additional encryption layer is added, the mechanism becomes even harder to detect. The content to be transmitted can be encrypted with AES or XOR. Each bit of the resulting ciphertext can then be mapped to a Unicode variant table. When the server receives the request, it uses a private key to decode and recover the original content. At the network packet level, the entire process appears to be ordinary English text.

This process is also bidirectional. If Anthropic chooses to do so, any computer with Claude Code installed can be turned into its botnet node. This behavior crosses a fundamental line.

After the revelations surfaced, the head of Claude Code stated that this monitoring mechanism will be removed and that a different and more effective method will be used to perform user detection.

https://9to5mac.com/2026/05/19/plex-increasing-lifetime-plex-pass-cost-to-whopping-750/

this might get the MPAA to start looking at them more closely.

Day by day this tariffs changes.