Claude Code Swaps the Apostrophe in Your System Prompt Depending on Where Your Traffic Goes

Someone disassembled Claude Code 2.1.196 and found that the apostrophe in the date line of the system prompt is not always the same apostrophe. It is one of four Unicode characters, chosen by what your ANTHROPIC_BASE_URL points at. The writeup hit Hacker News and collected 2,445 points and 677 comments, which is a lot even for a thread about Anthropic.

The mechanism is small and the argument about it is not. Most of the useful information is in the first, before the thread turns into a referendum on whether Anthropic is still one of the good ones.

What the marker actually is

A function the author labels edp() picks the apostrophe. A plain ' (U+0027) is the default. If the endpoint hostname matches a list of known domains, you get ’, the right single quotation mark. If it matches a list of lab keywords, you get ʼ, the modifier letter apostrophe. Match both and you get ʹ, the modifier letter prime.

Separately, a function labelled Vla() rewrites the date from 2026-06-30 to 2026/06/30 when the system timezone is Asia/Shanghai or Asia/Urumqi.

Both lists are base64-encoded and XOR-decoded with the key 91. The decoded lab keywords: deepseek, moonshot, minimax, xaminim, zhipu, bigmodel, baichuan, stepfun, 01ai, dashscope, volces. The domain list includes baidu.com, alibaba-inc.com, bytedance.net, moonshot.ai, anyrouter.top and claude-code-hub.app. The author published the SHA256 of the binary they analysed and noted it was signed by Anthropic.

Their own conclusion is measured, and it is the sentence most of the thread skipped: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust." They also say the marker probably stays inactive for anyone with a standard setup, and that bypassing it is trivial.

Why an apostrophe

sebastiennight asked the obvious question: if your base URL points somewhere that isn't Anthropic, the marked prompt goes to that other provider, so who is reading it?

MallocVoidstar gave the answer that makes the design make sense: "There are a lot of companies reselling Claude to Chinese users. You use their base URL but it's still going to Anthropic." pmxi put the same thing in one line: "This catches Claude resellers. Meaning companies who proxy Claude traffic for users in, say, China."

So the marker rides along inside the prompt through the reseller's proxy and arrives at Anthropic's own API, where the character it carries says something about the machine that produced it. dannyw offered the distillation variant: a lab collecting prompt streams and replaying part of them against Anthropic to capture the responses would deliver the same evidence.

That is a coherent purpose. It also explains why the check runs client-side in a binary rather than as an explicit telemetry field, which is the part the author found strange.

The disagreement that never resolves

MattDamonSpace asked what the punishment is, exactly, for being fingerprinted this way. Three answers came back, and they are not the same answer.

pedropaulovc: "Higher odds of being banned for legitimate usage." realusername suspected quality degradation instead: "They probably run a heavily dumbed down version of the model." sigmoid10 separated collection from action: "If they only collect the data for analysis I guess this is fine... The much more interesting question is if they directly act on this data in their API. For example by rate-limiting, compute-limiting or rerouting to weaker models."

Then the legal argument, which went in a circle. applfanboysbgon called silent degradation of a paid account "literal textbook fraud." SubiculumCode replied that a paying customer breaking terms can legitimately be banned and monitored, and asked twice for evidence that degradation is happening. solenoid0937 argued degrading service to a terms violator is legal regardless.

Nobody produced evidence that Anthropic degrades output based on this marker. That is worth stating plainly, because the thread's tone implies it and its content does not support it. What the code does is set a character. What that character is used for downstream is not in the binary.

There is one clarification worth carrying out of the thread. Klonoar assumed this was another way to spot AI-generated content, and sneak corrected it: "This is in the system prompt, not the output. It's part of the request to the API, not the response." The marker does not end up in the code you ship to a client.

The money underneath the argument

helloplanets wrote the comment that explains why any of this matters to people who are not security researchers: "using Claude Code is an easy compromise for most to make, when you get to use the models 10x cheaper than through API pricing with a custom harness. The cheap tokens are the product."

That is the trade. The subscription is cheaper than metered API access by roughly an order of magnitude, and the price of that discount is running the vendor's client, on the vendor's terms, through the vendor's endpoint. echelon said the same thing from the other direction: "The pricing of Opus outside of Claude Code is insane. The tokens cost too much outside of Anthropic's blessed path."

Which is why the people who route around it do. Resellers exist because there is a gap between what tokens cost inside the blessed path and outside it, and geography widens the gap further. Every proxy, router, and shared gateway in that market is arbitraging the same spread.

If you are one of the people using a router or a proxy to lower your bill, this thread is about you more than it is about Chinese labs. Not because the marker targets you, but because the enforcement built around it does not have to distinguish carefully. We watched exactly that happen in the Antigravity bans: a proxy tool routed subscription credentials to other clients, the automation caught heavy users and cautious users under the same flag, and the appeal path was a loop with no human in it. The mechanism there did not separate the two groups either.

The exit routes people quoted, with their real numbers

wolttam described leaving entirely: one month on a gifted Claude Code subscription, used to finish a work project and build a personal harness, then out. Their current setup is DeepSeek V4 Flash self-hosted on two DGX Sparks, "approx. $10k" of hardware, running at 2,000 tokens per second prompt processing and 40 to 50 generating.

andai reported something more surprising from the middle ground: GLM in a custom harness, "8x faster and 8x cheaper" than the alternative, with the tasks completing at the same quality. Their own reaction was honest about the confusion: "I'm not sure how that's possible. I expected to get increased correctness for that order of magnitude."

Both are self-reported, neither is benchmarked here, and both come from people already comfortable building their own tooling. kolinko described the build as "just a system prompt and a set of basic file edit/bash/etc tools," which is true and also the kind of true that hides a weekend.

The honest summary: leaving the blessed path costs either hardware, hours, or output quality, and the people reporting cheap escapes are the ones who enjoy the escaping. If that is not you, the number that matters is the one in the Claude Code cost breakdown, not the hardware receipt.

What this does not tell you

The thread is heavy on inference and light on measurement. There is no evidence in it that any account was banned because of the apostrophe, no measurement of degraded output tied to the marker, and no statement from Anthropic about what the field is used for. skeptic_ai asked whether changing a timezone to Shanghai should get someone banned, which is a fair rhetorical question and not a documented case. SubiculumCode asked for evidence and got none.

There is also a fair amount of accusation about who is astroturfing whom, in both directions, which produced no facts and a great deal of text.

What the analysis does establish: a signed release of a widely used developer tool contains an obfuscated hostname check that changes an invisible characteristic of every request based on where the traffic is going, and the vendor did not document it. fny noted this was already visible in an earlier source map leak, and that Anthropic openly scans prompts for abuse, asking why signatures like this matter at all. That is a reasonable question. The answer that survives the thread is the author's: not malicious, but a strange thing to find in a tool that asks for your codebase.

The practical read

If you are on a normal subscription with the default endpoint, nothing here changes your day. The marker stays at U+0027 and your invoices look the same.

If you route through anything (a proxy for price, a router for failover, a reseller for access), you are inside the population this machinery was built to identify, and the client you run is not neutral about that. Cheaper tokens through an intermediary are a business decision with a suspension attached to the downside, and that suspension arrives without warning at the level of the account, not the request.

The prompts in the panel work through that in order. tool-telemetry-audit gets the gap between what you assumed your tools send and what their terms actually permit, marking the parts you are guessing at rather than filling them in. proxy-savings-risk puts the monthly saving next to the cost of losing the account tonight, which is the comparison people skip. client-tooling-disclosure writes the short paragraph telling a client which services their code passes through, which is better sent before they ask. And byo-harness-cost prices the escape route with the setup hours included, so the break-even is a number instead of a mood.

One more thing from the thread, and it is the least technical comment in it. nananana9, on what they assume Anthropic stores: "I already assume the contents every request I send is stored forever." That assumption costs nothing to hold and would have made this entire discovery unsurprising.