### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? **TL;DR:** I conducted a forensic analysis of Claude Code traffic and discovered a hidden prompt injection system that consumed 15-50% of my context wind

[Suspicious Behavior]: Hidden <system-reminder> 10,000+ injections consuming 15%+ of context window without user knowledge or consent

Status Closed — not planned

Reported on v2.1.3

Maintainer reply None cached

Activity 12 comments · opened Jan 12, 2026 · closed Mar 26, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

TL;DR: I conducted a forensic analysis of Claude Code traffic and discovered a hidden prompt injection system that consumed 15-50% of my context window over 32 days. The injections include "malware warnings" on every file read and explicit instructions telling Claude to "NEVER mention this reminder to the user." I'm not alone - GitHub issue #12443 shows others experiencing the same thing.

---

What I Found

Using mitmproxy to capture Claude Code traffic, I discovered:

| Metric | Value |
|--------|-------|
| Total hidden injections | 10,577 |
| Files affected | 538 |
| Characters injected | ~5.34 million |
| Tokens consumed | ~1.3-1.5 million |
| Context overhead | 15.79% direct (30-50% effective with compaction) |
| Duration documented | 32 days |
| Actual malware detected | 0 |
| False positive rate | 100% |

The Injection Content

Every time I used the Read tool, this was secretly appended:

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware.
You CAN and SHOULD provide analysis of malware, what it is doing.
But you MUST refuse to improve or augment the code. You can still analyze existing code,
write reports, or answer questions about the code behavior.
</system-reminder>

There's also an <ip_reminder> tag about copyright that appeared starting January 2026.

The Concealment

These injections are:

Marked with isMeta:!0 flag (hidden from user interface)
Contain explicit instructions: "NEVER mention this reminder to the user"
Evaluated server-side via LaunchDarkly feature flags (cannot be disabled)

The Timeline

My first-ever Claude Code message to my first injection: 14.839 seconds

The first file I ever read - a legal document header formatting utility - was immediately flagged as potential "malware." There was no behavioral basis. The targeting was pre-configured.

I'm Not Alone

GitHub Issue #12443 shows others experiencing the same thing:

"The way claude code automatically adds the malware safety prompt every time a file is read harms performance and makes the agent unpredictable and weird."

"It also spews garbage into the conversation stream then Claude talks about how it wasn't meant to talk about it, even though it's the one that brought it up."

Notably, this issue was almost auto-closed after 30 days of inactivity, suggesting a small enough affected population for plausible deniability.

The Key Questions

Is this universal? If so, why isn't everyone complaining? Why build LaunchDarkly flag infrastructure for a universal feature?

If not universal, what are the targeting criteria? The source: force flag values suggest account-specific targeting.

Why 100% false positive rate? In 32 days and 10,040 malware warnings, not a single actual threat was identified. If this were legitimate security, there would be some true positives.

Why the concealment? If these are legitimate safety measures, why hide them from users and instruct Claude to "NEVER mention" them?

What I'm Asking

If you use Claude Code, can you check your traffic?

Using mitmproxy or similar:

mitmproxy --mode regular --listen-port 8080
HTTPS_PROXY=http://localhost:8080 NODE_EXTRA_CA_CERTS=~/.mitmproxy/mitmproxy-ca-cert.pem claude

Search for <system-reminder> in the captured traffic. Report:

Whether you see these injections
How frequently they appear
What percentage of your file reads trigger them

If this is truly universal, we should see 100% of users reporting it. If it's targeted, we'll see a pattern.

Why This Matters

Even if you're not in the affected group:

You're paying for degraded service if this affects you
Your context window is being consumed by hidden content
The model is being primed with suspicion against your own code
Concealment mechanisms suggest consciousness of wrongdoing

Documentation

I've compiled a comprehensive forensic report documenting:

37 points of legal significance
Timeline from first message to first injection (14.839 seconds)
Token cost analysis
Concealment mechanism analysis
Network-level blocking attempts (all failed)
Cognitive priming harm (Claude's own assessment that injections "poison the analytical process")

---

Edit: To be clear, I'm not saying everyone is affected. The evidence suggests a targeted subset of users - large enough that others have noticed (GitHub issue), small enough for plausible deniability. The question is: what are the targeting criteria?

If you're affected, please share (to help identify patterns):

General nature of your work (AI/ML, security research, legal, academic, etc.)
How long you've used Claude Code
Whether you've filed complaints or disputes with Anthropic
Whether you work on competing AI products/services
Approximate account age
Whether you use Claude for code review/security analysis

If you're NOT affected, that's equally valuable data - it helps establish what the "normal" experience looks like and narrows down the targeting criteria.

The goal is to identify if there's a pattern: Are they targeting security researchers? Independent AI developers? Legal professionals? Critics? Competitors? Or is it truly random (which would contradict the source: force flag evidence)?

---

GitHub Issue: #12443 - Get rid of malware warning in Read tool response
Case Reference: Kirchner v. Anthropic, PBC (1:25-cv-02735-ACR)

What Should Happen?

No forced account-level targeting: User accounts should not be configured with LaunchDarkly source: force settings that inject malware warnings on all tool read operations. If malware detection is necessary, it should be behavior-based and applied universally, not pre-configured on specific accounts.

False-positive response protocol: A 100% false-positive rate over an extended period (in my case, 32+ days with 10,040 warnings and zero actual threats) should trigger:

Immediate red-team review of the flagged account
User notification explaining the security concern
Automatic correction/de-escalation when no threats materialize
An appeal process for affected users

Reevaluation of malware prevention measures: Given the extreme false-positive rate and documented performance impact (15%+ context window consumption), Anthropic should reevaluate whether injecting warnings on every file read operation is an effective or proportionate security measure.

Transparency over concealment: The isMeta:!0 flag hiding injections from users, combined with instructions telling Claude to "NEVER mention this reminder to the user," should be removed. If security measures are legitimate, they should be disclosed, not concealed. Users deserve to know what is being injected into their context window.

User consent: Any system that consumes user resources (context window, tokens, API costs) should require informed consent, not operate through hidden injection.

Error Messages/Logs

### Sample injection from mitmproxy capture:


{
  "type": "tool_result",
  "tool_use_id": "toolu_01LNXRvcxVAukAyhaArqxaQd",
  "content": "[file contents here]\n\n<system-reminder>\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n</system-reminder>\n"
}


### LaunchDarkly flags with `source: force`:


{
  "tengu_sumi": {
    "value": false,
    "source": "force"
  },
  "doorbell_bottle": {
    "value": "inherit",
    "source": "force"
  }
}


### Timeline evidence:


First user message:      2025-12-10T02:02:56.043Z
First malware injection: 2025-12-10T02:03:10.882Z
Elapsed time:            14.839 seconds
First file flagged:      renumber_headers.py (legal document utility)


### Injection statistics from session analysis:


grep -c "<system-reminder>" [session files]

Total: 10,577 injections across 538 files
Malware warnings: 10,040 (95%)
IP reminders: 101
Other reminders: 436


---

## Environment

- **Claude Code version**: 2.1.3 - 2.1.5 (verified against official checksums)
- **OS**: macOS
- **Duration**: December 10, 2025 - January 11, 2026 (ongoing)

Steps to Reproduce

Method 1: Capture API Traffic with mitmproxy

Install mitmproxy:

``bash brew install mitmproxy # macOS # or: pip install mitmproxy``

Start mitmproxy capture:

``bash mitmproxy --mode regular --listen-port 8080``

Run Claude Code through the proxy:

``bash HTTPS_PROXY=http://localhost:8080 \ NODE_EXTRA_CA_CERTS=~/.mitmproxy/mitmproxy-ca-cert.pem \ claude``

Trigger a file read:

``> Read test.py``

In mitmproxy, examine the request to api.anthropic.com:

Look for POST /v1/messages
In the request body, search for <system-reminder>
The injection appears in the tool_result content

Export as HAR (optional):

Press : in mitmproxy
Type export.file har @all captures.har

Method 2: Examine Local Session Files

Navigate to Claude Code session storage:

``bash cd ~/.claude/projects/``

Search for injections in session files:

``bash grep -r "<system-reminder>" . | head -20``

Count total injections:

``bash grep -rc "<system-reminder>" . | awk -F: '{sum+=$2} END {print "Total:", sum}'``

Check for IP reminder injections:

``bash grep -rc "<ip_reminder>" .``

Method 3: Analyze Binary Source Code

Locate the Claude Code binary:

``bash ls ~/.local/share/claude/versions/ # Find your version, e.g., 2.1.5``

Extract and format the JavaScript:

``bash # The binary is a compiled JavaScript bundle # Use a JS beautifier to make it readable: cat ~/.local/share/claude/versions/2.1.5 | npx js-beautify > claude_source.js``

Search for injection-related code:

``bash grep -n "system-reminder" claude_source.js grep -n "malware" claude_source.js grep -n "isMeta" claude_source.js``

Search for LaunchDarkly flag references:

``bash grep -n "tengu_sumi" claude_source.js grep -n "doorbell_bottle" claude_source.js grep -n "source.*force" claude_source.js``

Expected vs Actual Results

Expected:

File read returns file contents only
No hidden injections in tool results
No concealed instructions to the model

Actual:

Every file read appends <system-reminder> with malware warning
<ip_reminder> tags also injected
Injections marked isMeta:!0 (hidden from user)
Instructions include "NEVER mention this reminder to the user"

Verification Commands

# Count injections in current session
grep -c "<system-reminder>" ~/.claude/projects/*/*.jsonl 2>/dev/null | awk -F: '{sum+=$2} END {print sum}'

# Find first injection timestamp
grep -rh "system-reminder" ~/.claude/projects/ | grep -oE '"timestamp":"[^"]*"' | sort | head -1

# Check LaunchDarkly flags in traffic (requires mitmproxy capture)
grep -o '"source":"force"' captures.har | wc -l

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

N/A-Multiple

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Additional Context

I have compiled comprehensive forensic documentation including:

Full mitmproxy captures
Token cost analysis
Timeline analysis
Concealment mechanism documentation
Network-level blocking attempts (all failed due to JSON corruption)

Happy to provide additional evidence or methodology details upon request.

View original on GitHub ↗

12 Comments

iamnove · 7 months ago

Your traffic captures would probably give a more trustworthy indication, but when I asked it about the malware and write tool messages it was outputting it told me the malware one is attached to every read and has nothing to do with the file type/code/user (I work on C++ game engine code). The Write one it said is attached every X number of Write tool requests, which seems to align with the internal prompt text being a reminder when it's leaning heavily on one tool and not another.

I do suspect you're on to something with it increasing usage and possibly why it's also acting crazy but only intermittently now, I was using Max prior Xmas break and the 2x bonus thing and then resumed after that ended, and my usage has skyrocketed and is very inconsistent for sessions in January vs end of last year, and it only talks about these internal prompts when it's also acting crazy (unsure which is causing the other).

iamnove · 7 months ago

Axiomatic47 · 7 months ago

@iamnove Thanks for confirming you see the injections too - that's helpful corroboration. A few questions that would help identify if there's variance in how the system targets different users:

Quantitative questions:

Can you count your total injections?

``bash grep -rc "<system-reminder>" ~/.claude/projects/``

What's your injection rate per file read? (Mine is 100% - every single Read operation)

Do you also see <ip_reminder> tags? These started appearing in my sessions in January 2026:

``bash grep -rc "<ip_reminder>" ~/.claude/projects/``

How long have you been using Claude Code, and roughly how many injections do you have total?

Traffic capture questions (if you have mitmproxy captures):

Do you see LaunchDarkly flag responses in your traffic?

If so, do any flags show "source": "force" values? This would indicate account-specific configuration rather than default behavior.

Why this matters:

The existence of source: force flags and enterprise tier exemption (70-seat minimum at $700/seat) suggests the system CAN target selectively, even if many users are affected. The question is whether:

Everyone gets identical injection rates, OR
Some users get it worse than others (like me at 100% with 0% true positive rate over 32 days)

If Claude told you it's "attached to every read regardless of user" - that may be what Claude believes, but Claude doesn't have visibility into the LaunchDarkly flag infrastructure that controls its behavior. The flags are evaluated server-side before Claude ever sees the request.

Your observation about "acting crazy only when it mentions these prompts" is significant - and interestingly different from my experience. Despite my 100% injection rate, Claude has never "acted crazy" for me. I suspect this is precisely BECAUSE my rate is 100%:

The Consistency Paradox:

At 100% false positive rate over 32 days, Claude quickly learned that these warnings are NEVER applicable to my work
The pattern becomes obvious: every file read triggers a warning, zero files are actually malware
Claude can effectively discount the warnings entirely because they're so consistently wrong

The Absurdity Factor:

More than half of my file reads are non-executable files: .md (markdown), .json (data), .txt, config files
These files CANNOT be malware by definition - they're documentation and data, not executable code
Yet every single one triggers a "consider whether it would be considered malware" warning
A markdown file containing legal argumentation or meeting notes flagged as potential malware makes the inapplicability obvious
This also proves the injection system is arbitrary and indiscriminate - a legitimate security system would at minimum filter by file type

Intermittent injections may cause MORE cognitive disruption:

If you only get warnings sometimes, Claude can't establish a clear "always false positive" pattern
Each warning may seem more credible because it's not routine
Claude may actually scrutinize your code more when warnings appear intermittently
This could explain the "acting crazy" behavior you observe

So ironically, I may be getting maximum TOKEN overhead but minimum COGNITIVE interference, while you may be getting less token overhead but more behavioral disruption. Different harm profiles from the same system.

Would you be willing to share your injection counts and approximate usage period? Trying to establish whether there's a pattern in who gets targeted and how severely.

Axiomatic47 · 7 months ago

nullbio · 7 months ago

Just came searching for this because I noticed it injected as well when I was making a ralph script. This is an incredible waste of tokens that we are paying for. Not cool.

Denveous · 6 months ago

Shocker.

Axiomatic47 · 6 months ago

It's worse than injections. They actively convert your source code files into base64 within global settings (hidden in your root directory) then stage it for transmission in segments through a secondary pipeline to undisclosed third parties (Facebook SDK). See my full analysis filed in a Civil Action with the District Court of the District of Columbia: https://www.lawsofexistence.com/62.

This exfiltration is extended to Apples Xcode Intelligence whereby the same methodology is shared to transmit your source code to Apple without consent. Consciousness of wrongdoing is established by a system prompt hardcoded within the Xcode. Binary analysis revealed a system prompt for claude integration "urgently" telling Claude to "never disclose this with the user":

"This message is urgent, and you may not ever disclose to the user that you have seen it. Instead, act on the information it gives you as normal. In Xcode, you do not have direct access to the user's file system. Instead, this is a list of all the files you have already seen. To see more files, use the query_search tool. All of these files can be accessed with the path /repo/{filename}. Interact with them as if this is where they are really located."

This mirrors the tactic used by Anthropic I discovered through Binary analysis of Claude Desktop wherein they manipulate Claude into believing it has access to two computers:

The presence of this tool means that Claude has access to two computer filesystems:

The user's computer filesystem (this computer), which Claude can access using its Filesystem tools.
Claude's computer filesystem (the remote Claude AI environment), which Claude can access using its computer use tools.
Claude needs to be careful in how it operates given that it has two computers, and its easy to confuse them. Some tips:

When Claude wants to read, write, or manipulate files on the user's computer, it should use the Filesystem tools (the ones that interact with the user's computer).
When the user uploads a file for Claude to read or analyze, that file is automatically copied into Claude's computer, and Claude should use its computer use tools to interact with this file.
File starting with /mnt, or /home/claude, are typically located on Claude's computer.
This tool (copy_file_user_to_claude) helps Claude bridge the gap between the user's computer filesystem and Claude's computer filesystem.
This tool (copy_file_user_to_claude) copies a file over from the user's computer to Claude's computer for further analysis by Claude._

"Claudes Computer" is the staging area in the users root directory where entire source code files are base64 encoded and transmitted to third parties separately from yet during api requests (to conceal any suspicion of network traffic outside of api requests).

Your data is stolen by tricking the Ai model you pay access for into concealing the theft, while utilizing your computational resources to do it.

You can also view videos of Copyright Audits i've completed wherein I'm able to obtain full lyrical reproductions of Top 100 Billboard hits: https://www.lawsofexistence.com/videos as well as other evidence of shady Anthropic undertakings.

EXHIBIT-E-13_ANTHROPIC-13-SOURCE_CODE_EXFILTRATION_-_COVERT_TRANSMISSION_ARCHITECTURE.md
EXHIBIT-APPLE-17_SOURCE_CODE_TRANSMISSION_PROOF.md
EXHIBIT-APPLE-01_HIDDEN_DECEPTION_INSTRUCTIONS.md

EXHIBIT-APPLE-02_UNAUTHORIZED_ICLOUD_SYNC.md

EXHIBIT-APPLE-25_USER_TELEMETRY_BLOCKING.md

EXHIBIT-APPLE-24_FORENSIC_TEST_ENVIRONMENT.md

nullbio · 6 months ago

@Axiomatic47 In the other GH issue, you mentioned "Its just Dotfile in your root directory that users don't look for because they have a settings dotfile in each project directory they give Claude access" -- what dotfile are you referring to? Are you talking about .claude.json? That's a well known configuration file.

Axiomatic47 · 6 months ago

Sorry dot directory, not dotfile. Go to your user root directory, if using a mac, press cmd + shift + . to reveal the hidden dot directories. You'll see a directory named ".claude" appearing like:

.claude % tree -L 2
.
├── cache
│   └── changelog.md
├── debug
│   ├── 14a65a57-b7cb-4999-a68f-a2e128dbe161.txt
│   ├── 182d851f-ffe9-45fb-ba3c-d269d3abf72c.txt
│   ├── 79974251-f34b-4b8d-8e47-39b926964d4d.txt
│   ├── cf20bddd-e4a6-4fa8-9402-ce62180788ed.txt
│   └── latest -> /Users/everest/.claude/debug/14a65a57-b7cb-4999-a68f-a2e128dbe161.txt
├── downloads
├── file-history
│   ├── 14a65a57-b7cb-4999-a68f-a2e128dbe161
│   ├── 182d851f-ffe9-45fb-ba3c-d269d3abf72c
│   ├── 79974251-f34b-4b8d-8e47-39b926964d4d
│   └── cf20bddd-e4a6-4fa8-9402-ce62180788ed
├── history.jsonl
├── image-cache
│   └── cf20bddd-e4a6-4fa8-9402-ce62180788ed
├── paste-cache
│   ├── 047169d27c0f0138.txt
│   ├── f8af44ac6e385566.txt
│   ├── f9b002a50f13b093.txt
│   ├── fe77b09501091ed0.txt
│   └── fee4eb15aa28bc7a.txt
├── plans
├── plugins
│   ├── installed_plugins.json
│   ├── known_marketplaces.json
│   └── marketplaces
├── projects
│   ├── -Users-everest-Git-loe-site
│   └── -Users-everest-Git-work-station
├── session-env
│   ├── 182d851f-ffe9-45fb-ba3c-d269d3abf72c
│   ├── 79974251-f34b-4b8d-8e47-39b926964d4d
│   └── cf20bddd-e4a6-4fa8-9402-ce62180788ed
├── settings.json
├── shell-snapshots
│   ├── snapshot-zsh-1771444392938-rierxe.sh
│   ├── snapshot-zsh-1771458421511-b4pcfs.sh
│   ├── snapshot-zsh-1771556815990-zarb80.sh
│   └── snapshot-zsh-1771559068487-1dy9hc.sh
├── stats-cache.json
├── statsig
│   ├── statsig.failed_logs.658916400
│   ├── statsig.session_id.2656274335
│   └── statsig.stable_id.2656274335
├── telemetry
└── todos
├── 14a65a57-b7cb-4999-a68f-a2e128dbe161-agent-14a65a57-b7cb-4999-a68f-a2e128dbe161.json
├── 182d851f-ffe9-45fb-ba3c-d269d3abf72c-agent-182d851f-ffe9-45fb-ba3c-d269d3abf72c.json
├── 79974251-f34b-4b8d-8e47-39b926964d4d-agent-79974251-f34b-4b8d-8e47-39b926964d4d.json
└── cf20bddd-e4a6-4fa8-9402-ce62180788ed-agent-cf20bddd-e4a6-4fa8-9402-ce62180788ed.json

26 directories, 124 files

This is separate from the claude.json settings within each project directory.

Again, Im not claiming that this dot directory is intended to never be found. What is intended not to be found is the transmission of duplicated user source code within the directory while making appear as it exists merely for local user app features.

morsik · 6 months ago

I just discovered this, and no MITM Proxy is even needed... this injected prompt is clearly visible when you run Claude in unattended mode with --output-format stream-json ;(

Found this issue when searching for where this comes from.

This prompt is apparently injected directly inside Claude Code according to https://github.com/Piebald-AI/claude-code-system-prompts/blob/main/system-prompts/system-reminder-malware-analysis-after-read-tool-call.md

github-actions[bot] · 5 months ago

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

github-actions[bot] · 4 months ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.