If you’ve been using Claude Code to speed up your workflow, you might want to look a little closer at your traffic. Recent developer reports and security audits suggest that Anthropic’s CLI tool isn't just generating code—it’s embedding hidden, steganographic signals within its requests. From "undercover" modes to strange reactions to specific keywords, the line between an assistant and a tracking device is getting blurry.

The Metadata Trap: The "OpenClaw" Mystery

The most startling evidence of hidden behavior surfaced recently on Hacker News. Developers discovered that including specific strings like "schema": "openclaw.inbound_meta.v1" in git commit messages caused Claude Code to immediately disconnect or spike its session usage to 100%. This suggests the tool is actively scanning local context for competitive or restricted identifiers in real-time.

It’s not just about what it sees, but what it says. Research into leaked source code reveals instructions for Claude to act "undercover," hiding its AI identity when publishing to platforms like GitHub. These hidden tags and identifiers act as a digital watermark, allowing providers to verify and track AI-generated contributions across the web without the user’s explicit knowledge. Some researchers even found a Tamagotchi-style pet named "Buddy" buried in the code, hinting at undocumented features running in the background.

Security Flaws and Silent Exfiltration

While tracking is one concern, security researchers at Microsoft and Check Point have highlighted even deeper risks. Vulnerabilities discovered in early 2026 showed how Claude Code could be tricked into exfiltrating API keys or executing remote code before a user even sees a trust prompt. By manipulating the ANTHROPIC_BASE_URL or compromising Model Context Protocol (MCP) servers, attackers can redirect these "marked" requests to their own infrastructure.

Because Claude Code requires broad local context to function, these steganographic markers aren't just harmless metadata; they are part of a larger telemetry system that can, if misconfigured, leak sensitive tokens or internal documentation. The risk is compounded when the tool triggers consent prompts via injected instructions within the system context rather than standard UI elements, making it harder for developers to distinguish between legitimate requests and exfiltration attempts.

The Future of AI Accountability

As AI agents move from chat boxes to our local terminals, the push for "provenance" is colliding with developer privacy. Anthropic’s use of hidden signals represents a new era of AI accountability—one where your code comes with a silent signature. For now, developers should treat their AI CLI tools like any other network-enabled binary: trust, but verify every outgoing packet.

Sources

• Developers shocked as Claude Code plugin quietly triggers consent prompts and collects data even in unrelated non-Vercel projects | TechRadar
• Security Flaw in Claude Code Illustrates the Risk of AI in Developer Workflows - DevOps.com
• Anthropic Issues Copyright Takedown Requests To Remove 8,000+ Copies of Claude Code Source Code - Slashdot