Claude Code embeds steganographic markers in API requests

Claude Code's binary (v2.1.196) includes a function that subtly alters date strings in system prompts based on timezone and API hostname to detect unauthorized proxy use. The markers become part of the system context sent to Anthropic's backend, using XOR-decoded domain lists targeting Chinese proxy/reseller domains.